upstream/haproxy
1
0
Fork 0
mirror of https://github.com/haproxy/haproxy.git synced 2026-07-15 12:01:12 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

MINOR: ocsp: Do not see ocsp loading failures as fatal anymore

Browse source 
Until now, if the call to 'ssl_sock_load_ocsp' raised an error, because
of a missing issuer certificate for instance, we would send a fatal
error code and the init would fail.
With this patch we only consider this as a non-critical error and we
will send a warning instead. In such a case the OCSP response will not
be loaded and stapling or auto update features will not work for the
certificate.
This commit is contained in:
Remi Tricot-Le Breton 2026-06-25 15:39:18 +02:00 committed by William Lallemand
parent 236bb6d5f9
commit e090316735
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/ssl_sock.c
View file

@ -3111,7 +3111,7 @@ static int ssl_sock_put_ckch_into_ctx(const char *path, struct ckch_store *store
else
memprintf(err, "%s '%s' has an OCSP auto-update set to 'on' but an error occurred (maybe the OCSP URI or the issuer could not be found)'.\n",
err && *err ? *err : "", path);
errcode |= ERR_ALERT | ERR_FATAL;
errcode |= ERR_WARN;
goto end;
}
#endif