diff options
| author | Michael Brown | 2020-12-08 15:39:33 +0100 |
|---|---|---|
| committer | Michael Brown | 2020-12-08 16:04:28 +0100 |
| commit | 6e92d6213d20329d8b84431f00d8cbe7d63bb379 (patch) | |
| tree | 330cacc0a8b25b8e3902d567e5f8f782be2ecaab /contrib | |
| parent | [http] Hide HTTP transport-layer filter implementation details (diff) | |
| download | ipxe-6e92d6213d20329d8b84431f00d8cbe7d63bb379.tar.gz ipxe-6e92d6213d20329d8b84431f00d8cbe7d63bb379.tar.xz ipxe-6e92d6213d20329d8b84431f00d8cbe7d63bb379.zip | |
[ocsp] Remove dummy OCSP certificate root
OCSP currently calls x509_validate() with an empty root certificate
list, on the basis that the OCSP signer certificate (if existent) must
be signed directly by the issuer certificate.
Using an empty root certificate list is not required to achieve this
goal, since x509_validate() already accepts an explicit issuer
certificate parameter. The explicit empty root certificate list
merely prevents the signer certificate from being evaluated as a
potential trusted root certificate.
Remove the dummy OCSP root certificate list and use the default root
certificate list when calling x509_validate().
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'contrib')
0 files changed, 0 insertions, 0 deletions