diff options
| author | Maxim Dounin <mdounin@mdounin.ru> | 2012-10-01 12:51:27 +0000 |
|---|---|---|
| committer | Maxim Dounin <mdounin@mdounin.ru> | 2012-10-01 12:51:27 +0000 |
| commit | 3ebbb7d521e9faeebdfdbba0a98a7a029e56c0a2 (patch) | |
| tree | a5ef1d21f2c0dfd39ee600dedee042221e98a699 /src | |
| parent | 1a07a7f2de10b59a0942706d3049e9da86e55a2a (diff) | |
| download | nginx-3ebbb7d521e9faeebdfdbba0a98a7a029e56c0a2.tar.gz nginx-3ebbb7d521e9faeebdfdbba0a98a7a029e56c0a2.zip | |
OCSP stapling: OCSP_basic_verify() OCSP_TRUSTOTHER flag now used.
This is expected to simplify configuration in a common case when OCSP
response is signed by a certificate already present in ssl_certificate
chain. This case won't need any extra trusted certificates.
Diffstat (limited to 'src')
| -rw-r--r-- | src/event/ngx_event_openssl_stapling.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/event/ngx_event_openssl_stapling.c b/src/event/ngx_event_openssl_stapling.c index 435a40fde..c09b9f7ec 100644 --- a/src/event/ngx_event_openssl_stapling.c +++ b/src/event/ngx_event_openssl_stapling.c @@ -588,7 +588,7 @@ ngx_ssl_stapling_ocsp_handler(ngx_ssl_ocsp_ctx_t *ctx) chain = staple->ssl_ctx->extra_certs; #endif - if (OCSP_basic_verify(basic, chain, store, 0) != 1) { + if (OCSP_basic_verify(basic, chain, store, OCSP_TRUSTOTHER) != 1) { ngx_ssl_error(NGX_LOG_ERR, ctx->log, 0, "OCSP_basic_verify() failed"); goto error; |