Repository navigation

Close OCSP stapling and CRL revocation gaps - #11553

Merged

philljj merged 18 commits into

wolfSSL:masterfrom

Frauschi:ocsp_crl_fixes

Oct 30, 2026

Merged

Close OCSP stapling and CRL revocation gaps#11553
philljj merged 18 commits into
wolfSSL:masterfrom
Frauschi:ocsp_crl_fixes

Commits on Oct 29, 2026
- Check revocation when the peer acks status_request but staples nothing
  Frauschi
  committed
  b496fbe
- Check unstapled chain certificates when OCSP CHECKALL is enabled
  Frauschi
  committed
  2921b3e
- Enforce OCSP must-staple whatever the fallback lookups returned
  Frauschi
  committed
  ab5a233
- Check the CRL for a certificate that failed only the date check
  Frauschi
  committed
  3723eba
- Check the CRL in CertManagerCheckCRL for an out-of-date certificate
  Frauschi
  committed
  882cc51
- Report a chain certificate's revocation failure in the verify result
  Frauschi
  committed
  e42e763
- Do not repeat a revocation lookup that passed when a later one is retried
  Frauschi
  committed
  86102d0
- Report a CRL fetch that would block instead of a missing CRL
  Frauschi
  committed
  f8de0da
- Test the stapling fallback for a CA that names no OCSP responder
  Frauschi
  committed
  53068fa
- Replay a blocked DTLS 1.3 message from its DTLS handshake header
  Frauschi
  committed
  e695a15
- Address review comments
  Frauschi
  committed
  ce1b9e8
- Queue the CRL or date error that cm_check_cert_crl() drops
  Frauschi
  committed
  b9dfc10
- Report the CRL and date verdicts separately, as OpenSSL does
  Frauschi
  committed
  d41af92
- Request peer verification in test_tls13_nonblock_ocsp_low_mfl
  Frauschi
  committed
  a9fac70
- Address review comments
  Frauschi
  committed
  a5a82a7
- Send the same alert for a failed revocation check on every path
  Frauschi
  committed
  8de84ef
- Address review comments
  Frauschi
  committed
  b3ac114
- Skip the copy for an empty OCSP response entry
  Frauschi
  committed
  23108c0

Commits

Commits on Oct 29, 2026