BUG/MINOR: ssl: Wrong OCSP CID after modifying an SSL certficate
authorFrédéric Lécaille <flecaille@haproxy.com>
Tue, 5 Dec 2023 14:38:29 +0000 (15:38 +0100)
committerChristopher Faulet <cfaulet@haproxy.com>
Thu, 7 Dec 2023 07:53:59 +0000 (08:53 +0100)
commit2b9f0697bfed1d1a84c99103a1ac9475b3a6cbfb
tree97392df4260244a2423140845b3d361fbd4c3e69
parent2aad6c5356d5aa27de1220723708a80d2f5f469c
BUG/MINOR: ssl: Wrong OCSP CID after modifying an SSL certficate

This bug could be reproduced with the "set ssl cert" CLI command to update
a certificate. The OCSP CID is duplicated by ckchs_dup() which calls
ssl_sock_copy_cert_key_and_chain(). It should be computed again by
ssl_sock_load_ocsp(). This may be accomplished resetting the new ckch OCSP CID
returned by ckchs_dup().

This bug may be in relation with GH #2319.

Must be backported to 2.8.

(cherry picked from commit 75f5977ff4ccf205ee386e4f4b0c384fb6a110d5)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
src/ssl_ckch.c