denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

CA certificates are allowed to sign OCSP responsed without OCSP_SIGNER flag

Browse Source
This commit is contained in:
Martin Willi
2008-03-20 07:21:44 +00:00
parent 48acfe98ae
commit ca7663ece6
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/x509/x509_ocsp_response.c
+2 -1
View File
@@ -680,7 +680,8 @@ static bool issued_by(private_x509_ocsp_response_t *this, certificate_t *issuer,
return FALSE; return FALSE;
} }
} }
if (!(x509->get_flags(x509) & X509_OCSP_SIGNER)) if (!(x509->get_flags(x509) & X509_OCSP_SIGNER) &&
!(x509->get_flags(x509) & X509_CA))
{ {
return FALSE; return FALSE;
} }