From ca7663ece640dbabcd6713238855647fe86612b5 Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Thu, 20 Mar 2008 07:21:44 +0000 Subject: [PATCH] CA certificates are allowed to sign OCSP responsed without OCSP_SIGNER flag --- src/libstrongswan/plugins/x509/x509_ocsp_response.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/libstrongswan/plugins/x509/x509_ocsp_response.c b/src/libstrongswan/plugins/x509/x509_ocsp_response.c index 565ab82ab..cf1de6b4e 100644 --- a/src/libstrongswan/plugins/x509/x509_ocsp_response.c +++ b/src/libstrongswan/plugins/x509/x509_ocsp_response.c @@ -680,7 +680,8 @@ static bool issued_by(private_x509_ocsp_response_t *this, certificate_t *issuer, return FALSE; } } - if (!(x509->get_flags(x509) & X509_OCSP_SIGNER)) + if (!(x509->get_flags(x509) & X509_OCSP_SIGNER) && + !(x509->get_flags(x509) & X509_CA)) { return FALSE; }