From c6a2911725dc845985c44b9a3f1a2547b7b8c76a Mon Sep 17 00:00:00 2001 From: Alex Gaynor Date: Mon, 16 Oct 2017 19:23:21 -0400 Subject: [PATCH] tls: Handle when OCSP responder cert expires before a response it issued (#1922) * Handle the case of an OCSP responder certificate expiring before an OCSP response it issued * oops * doh, gofmt --- caddytls/maintain.go | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/caddytls/maintain.go b/caddytls/maintain.go index a657f0c7..9e42fc87 100644 --- a/caddytls/maintain.go +++ b/caddytls/maintain.go @@ -334,8 +334,15 @@ func DeleteOldStapleFiles() { // meaning that it is not expedient to get an // updated response from the OCSP server. func freshOCSP(resp *ocsp.Response) bool { + nextUpdate := resp.NextUpdate + // If there is an OCSP responder certificate, and it expires before the + // OCSP response, use its expiration date as the end of the OCSP + // response's validity period. + if resp.Certificate != nil && resp.Certificate.NotAfter.Before(nextUpdate) { + nextUpdate = resp.Certificate.NotAfter + } // start checking OCSP staple about halfway through validity period for good measure - refreshTime := resp.ThisUpdate.Add(resp.NextUpdate.Sub(resp.ThisUpdate) / 2) + refreshTime := resp.ThisUpdate.Add(nextUpdate.Sub(resp.ThisUpdate) / 2) return time.Now().Before(refreshTime) }