From e59fc62eea954afd7cc756f43e59f23d4f78762f Mon Sep 17 00:00:00 2001 From: beck <> Date: Fri, 22 May 2020 02:37:27 +0000 Subject: Ensure we only attach an ocsp staple to a leaf certificate, because for the moment that is all we support. fixes an issue where gnuTLS cares that mistmatching staples come back on the certs in the chain. This should be fixed correctly later by associating the staple to the individual certs rather than the ssl, so this is temporary. running on www@. ok tb@, "got that's oopy but an interim ok" jsing@ --- src/lib/libssl/tls13_server.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'src/lib/libssl/tls13_server.c') diff --git a/src/lib/libssl/tls13_server.c b/src/lib/libssl/tls13_server.c index 42409edbf7..e0ea6b564d 100644 --- a/src/lib/libssl/tls13_server.c +++ b/src/lib/libssl/tls13_server.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls13_server.c,v 1.50 2020/05/21 18:34:34 jsing Exp $ */ +/* $OpenBSD: tls13_server.c,v 1.51 2020/05/22 02:37:27 beck Exp $ */ /* * Copyright (c) 2019, 2020 Joel Sing * Copyright (c) 2020 Bob Beck @@ -461,7 +461,12 @@ tls13_server_certificate_send(struct tls13_ctx *ctx, CBB *cbb) for (i = 0; i < sk_X509_num(chain); i++) { cert = sk_X509_value(chain, i); - if (!tls13_cert_add(ctx, &cert_list, cert, tlsext_server_build)) + /* + * XXX we don't send extensions with chain certs to avoid sending + * a leaf ocsp stape with the chain certs. This needs to get + * fixed + */ + if (!tls13_cert_add(ctx, &cert_list, cert, NULL)) goto err; } -- cgit v1.2.3-55-g6feb