0036fdd5c5
RFC2560 mandates that a valid OCSP response will contain exactly one relevant certificate. However, some OCSP responders include extraneous certificates. iPXE currently assumes that the first certificate in the OCSP response is the relevant certificate; OCSP checks will therefore fail if the responder includes the extraneous certificates before the relevant certificate. Fix by using the responder ID to identify the relevant certificate. Reported-by: Christian Stroehmeier <stroemi@mail.uni-paderborn.de> Signed-off-by: Michael Brown <mcb30@ipxe.org> |
||
|---|---|---|
| .. | ||
| axtls | ||
| aes_wrap.c | ||
| arc4.c | ||
| asn1.c | ||
| axtls_aes.c | ||
| bigint.c | ||
| cbc.c | ||
| chap.c | ||
| clientcert.c | ||
| cms.c | ||
| crc32.c | ||
| crypto_null.c | ||
| drbg.c | ||
| entropy.c | ||
| hash_df.c | ||
| hmac_drbg.c | ||
| hmac.c | ||
| md5.c | ||
| null_entropy.c | ||
| ocsp.c | ||
| random_nz.c | ||
| rbg.c | ||
| rootcert.c | ||
| rsa.c | ||
| sha1.c | ||
| sha1extra.c | ||
| sha256.c | ||
| x509.c | ||