From ddfc40eabdbc59a607b568e946fb116dcd3439fd Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sat, 13 Apr 2024 14:20:30 +0200 Subject: Adding upstream version 2.9.7. Signed-off-by: Daniel Baumann --- src/ssl_sock.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'src/ssl_sock.c') diff --git a/src/ssl_sock.c b/src/ssl_sock.c index c7403b8..96d826e 100644 --- a/src/ssl_sock.c +++ b/src/ssl_sock.c @@ -4136,6 +4136,14 @@ int ssl_sock_load_cert(char *path, struct bind_conf *bind_conf, char **err) if ((ckchs = ckchs_lookup(path))) { /* we found the ckchs in the tree, we can use it directly */ cfgerr |= ssl_sock_load_ckchs(path, ckchs, bind_conf, NULL, NULL, 0, &ckch_inst, err); + + /* This certificate has an 'ocsp-update' already set in a + * previous crt-list so we must raise an error. */ + if (ckchs->data->ocsp_update_mode == SSL_SOCK_OCSP_UPDATE_ON) { + memprintf(err, "%sIncompatibilities found in OCSP update mode for certificate %s\n", err && *err ? *err: "", path); + cfgerr |= ERR_ALERT | ERR_FATAL; + } + found++; } else if (stat(path, &buf) == 0) { found++; -- cgit v1.2.3