summaryrefslogtreecommitdiffstats
path: root/src/ssl_sock.c
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--src/ssl_sock.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index c7403b8..96d826e 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -4136,6 +4136,14 @@ int ssl_sock_load_cert(char *path, struct bind_conf *bind_conf, char **err)
if ((ckchs = ckchs_lookup(path))) {
/* we found the ckchs in the tree, we can use it directly */
cfgerr |= ssl_sock_load_ckchs(path, ckchs, bind_conf, NULL, NULL, 0, &ckch_inst, err);
+
+ /* This certificate has an 'ocsp-update' already set in a
+ * previous crt-list so we must raise an error. */
+ if (ckchs->data->ocsp_update_mode == SSL_SOCK_OCSP_UPDATE_ON) {
+ memprintf(err, "%sIncompatibilities found in OCSP update mode for certificate %s\n", err && *err ? *err: "", path);
+ cfgerr |= ERR_ALERT | ERR_FATAL;
+ }
+
found++;
} else if (stat(path, &buf) == 0) {
found++;