This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 1.3.x
in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
The following commit(s) were added to refs/heads/1.3.x by this push:
new 6f80f10dd Stop OCSP checks once a cert in the trust store is reached
6f80f10dd is described below
commit 6f80f10ddab49f683f2b3593f9802c4a26aa191d
Author: Mark Thomas <[email protected]>
AuthorDate: Tue Sep 22 12:49:48 2026 +0100
Stop OCSP checks once a cert in the trust store is reached
---
native/src/sslutils.c | 10 ++++++++--
xdocs/miscellaneous/changelog.xml | 9 +++++++++
2 files changed, 17 insertions(+), 2 deletions(-)
diff --git a/native/src/sslutils.c b/native/src/sslutils.c
index 30b81cbb7..638584a8b 100644
--- a/native/src/sslutils.c
+++ b/native/src/sslutils.c
@@ -546,8 +546,14 @@ static int ssl_verify_OCSP(X509_STORE_CTX *ctx, int
timeout, int verifyFlags)
* is called if OpenSSL already successfully verified the certificate
* (parameter "ok" in SSL_callback_SSL_verify() must be true).
*/
- else if (X509_check_issued(cert,cert) == X509_V_OK) {
- /* don't do OCSP checking for valid self-issued certs */
+ else if (X509_check_issued(cert,cert) == X509_V_OK
+ || X509_STORE_CTX_get_error_depth(ctx) >=
X509_STORE_CTX_get_num_untrusted(ctx)) {
+ /* Don't do OCSP checking for valid self-issued certs, nor for a
certificate that is itself
+ * a trust anchor (present directly in the configured trust store
rather than supplied by the
+ * peer). A trust anchor is trusted unconditionally, so its own
revocation status is not
+ * checked. This aligns with JSSE's PKIXRevocationChecker, which
excludes the trust anchor
+ * of the certification path from revocation checking regardless of
whether it is self-signed.
+ */
X509_STORE_CTX_set_error(ctx, X509_V_OK);
return OCSP_STATUS_UNKNOWN;
}
diff --git a/xdocs/miscellaneous/changelog.xml
b/xdocs/miscellaneous/changelog.xml
index 2c5325ed0..1d8b8c225 100644
--- a/xdocs/miscellaneous/changelog.xml
+++ b/xdocs/miscellaneous/changelog.xml
@@ -32,6 +32,15 @@
</p>
</section>
<section name="1.3.10" rtext="in development">
+ <changelog>
+ <fix>
+ Align the OCSP checking performed by <code>ssl_verify_OCSP()</code> with
+ the behaviour of Tomcat's JSSE based <code>SSLEngine</code>
+ implementation so that a certificate that is itself a trust anchor
+ (whether a self-signed root or a certificate trusted directly via the
+ configured trust store) is not subject to OCSP checking. (markt)
+ </fix>
+ </changelog>
</section>
<section name="1.3.9" rtext="2026-09-07">
<changelog>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
