| 129 | } |
| 130 | |
| 131 | int ssl_stapling_init_cert(server_rec *s, apr_pool_t *p, apr_pool_t *ptemp, |
| 132 | modssl_ctx_t *mctx, X509 *x) |
| 133 | { |
| 134 | UCHAR idx[SHA_DIGEST_LENGTH]; |
| 135 | certinfo *cinf = NULL; |
| 136 | X509 *issuer = NULL; |
| 137 | OCSP_CERTID *cid = NULL; |
| 138 | STACK_OF(OPENSSL_STRING) *aia = NULL; |
| 139 | const char *pem = NULL; |
| 140 | int rv = 1; /* until further notice */ |
| 141 | |
| 142 | if (x == NULL) |
| 143 | return 0; |
| 144 | |
| 145 | if (!(issuer = stapling_get_issuer(mctx, x))) { |
| 146 | /* In Apache pre 2.4.40, we use to come here only when mod_ssl stapling |
| 147 | * was enabled. With the new hooks, we give other modules the chance |
| 148 | * to provide stapling status. However, we do not want to log ssl errors |
| 149 | * where we did not do so in the past. */ |
| 150 | if (mctx->stapling_enabled == TRUE) { |
| 151 | ssl_log_xerror(SSLLOG_MARK, APLOG_ERR, 0, ptemp, s, x, APLOGNO(02217) |
| 152 | "ssl_stapling_init_cert: can't retrieve issuer " |
| 153 | "certificate!"); |
| 154 | return 0; |
| 155 | } |
| 156 | return 1; |
| 157 | } |
| 158 | |
| 159 | if (X509_digest(x, EVP_sha1(), idx, NULL) != 1) { |
| 160 | rv = 0; |
| 161 | goto cleanup; |
| 162 | } |
| 163 | |
| 164 | if (modssl_cert_get_pem(ptemp, x, issuer, &pem) != APR_SUCCESS) { |
| 165 | rv = 0; |
| 166 | goto cleanup; |
| 167 | } |
| 168 | |
| 169 | if (ap_ssl_ocsp_prime(s, p, (const char*)idx, sizeof(idx), pem) == APR_SUCCESS |
| 170 | || ssl_run_init_stapling_status(s, p, x, issuer) == OK) { |
| 171 | /* Someone's taken over or mod_ssl's own implementation is not enabled */ |
| 172 | if (mctx->stapling_enabled != TRUE) { |
| 173 | SSL_CTX_set_tlsext_status_cb(mctx->ssl_ctx, stapling_cb); |
| 174 | ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(10177) "OCSP stapling added via hook"); |
| 175 | } |
| 176 | goto cleanup; |
| 177 | } |
| 178 | |
| 179 | if (mctx->stapling_enabled != TRUE) { |
| 180 | /* mod_ssl's own implementation is not enabled */ |
| 181 | goto cleanup; |
| 182 | } |
| 183 | |
| 184 | cinf = apr_hash_get(stapling_certinfo, idx, sizeof(idx)); |
| 185 | if (cinf) { |
| 186 | /* |
| 187 | * We already parsed the certificate, and no OCSP URI was found. |
| 188 | * The certificate might be used for multiple vhosts, though, |
no test coverage detected