| Subject: | clear error inside SSL_OCSP_response_verify before reattempting OCSP_basic_verify |
OCSP_basic_verify adds an error to the error queue if it fails. If the first OCSP_basic_verify fails inside SSL_OCSP_response_verify but the second attempt (with the intermediate certificate) succeeds SSL_OCSP_response_verify will return success but the error from the first OCSP_basic_verify is still in the OpenSSL error queue which causes the next call to fail.
In case of LWP accessing a site supporting OCSP stapling this next failing call will be the syswrite of the HTTP request, which makes the request fail. The fix is simple: just clear the error queue. Fix attached.
| Subject: | SSLeay.diff |
Index: SSLeay.xs
===================================================================
--- SSLeay.xs (revision 512)
+++ SSLeay.xs (working copy)
@@ -6693,6 +6693,7 @@
* So find this CA ourself and retry verification. */
X509 *issuer;
X509 *last = sk_X509_value(chain,sk_X509_num(chain)-1);
+ ERR_clear_error(); /* clear error from last OCSP_basic_verify */
if (last && (issuer = find_issuer(last,store,chain))) {
OCSP_basic_add1_cert(bsr, issuer);
TRACE(1,"run OCSP_basic_verify with issuer for last chain element");