www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2026-10-28 11:57:22 +03:00
Code Activity
Files
mpm-event-optimization
apache/modules/ssl/ssl_util_stapling.c
Kaspar Brand 9900465205 Set OPENSSL_NO_SSL_INTERN when compiling against OpenSSL 1.0.1 
or later, so that mod_ssl retains binary compatibility with future
versions when internal structures are changed. Use API functions
where available, and fall back to direct access for OpenSSL up
to 1.0.0, where needed.

Remove SSL_make_ciphersuite() from ssl_util_ssl.[ch], as it was
never used by any released version of mod_ssl.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1222917 13f79535-47bb-0310-9956-ffa450edef68
2011-12-24 06:31:37 +00:00

696 lines
22 KiB
C
Raw Permalink Blame History

/* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/* _ _
* _ __ ___ ___ __| | ___ ___| | mod_ssl
* | '_ ` _ \ / _ \ / _` | / __/ __| | Apache Interface to OpenSSL
* | | | | | | (_) | (_| | \__ \__ \ |
* |_| |_| |_|\___/ \__,_|___|___/___/_|
* |_____|
* ssl_stapling.c
* OCSP Stapling Support
*/
/* ``Where's the spoons?
Where's the spoons?
Where's the bloody spoons?''
-- Alexei Sayle */
#include "ssl_private.h"
#include "ap_mpm.h"
#include "apr_thread_mutex.h"
#ifdef HAVE_OCSP_STAPLING
/**
* Maxiumum OCSP stapling response size. This should be the response for a
* single certificate and will typically include the responder certificate chain
* so 10K should be more than enough.
*
*/
#define MAX_STAPLING_DER 10240
/* Cached info stored in certificate ex_info. */
typedef struct {
/* Index in session cache SHA1 hash of certificate */
UCHAR idx[20];
/* Certificate ID for OCSP requests or NULL if ID cannot be determined */
OCSP_CERTID *cid;
/* Responder details */
char *uri;
} certinfo;
static void certinfo_free(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
int idx, long argl, void *argp)
{
certinfo *cinf = ptr;
if (!cinf)
return;
if (cinf->uri)
OPENSSL_free(cinf->uri);
OPENSSL_free(cinf);
}
static int stapling_ex_idx = -1;
void ssl_stapling_ex_init(void)
{
if (stapling_ex_idx != -1)
return;
stapling_ex_idx = X509_get_ex_new_index(0, "X509 cached OCSP info", 0, 0,
certinfo_free);
}
static X509 *stapling_get_issuer(modssl_ctx_t *mctx, X509 *x)
{
X509 *issuer = NULL;
int i;
X509_STORE *st = SSL_CTX_get_cert_store(mctx->ssl_ctx);
X509_STORE_CTX inctx;
STACK_OF(X509) *extra_certs = NULL;
#ifdef OPENSSL_NO_SSL_INTERN
SSL_CTX_get_extra_chain_certs(mctx->ssl_ctx, &extra_certs);
#else
extra_certs = mctx->ssl_ctx->extra_certs;
#endif
for (i = 0; i < sk_X509_num(extra_certs); i++) {
issuer = sk_X509_value(extra_certs, i);
if (X509_check_issued(issuer, x) == X509_V_OK) {
CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509);
return issuer;
}
}
if (!X509_STORE_CTX_init(&inctx, st, NULL, NULL))
return 0;
if (X509_STORE_CTX_get1_issuer(&issuer, &inctx, x) <= 0)
issuer = NULL;
X509_STORE_CTX_cleanup(&inctx);
return issuer;
}
int ssl_stapling_init_cert(server_rec *s, modssl_ctx_t *mctx, X509 *x)
{
certinfo *cinf;
X509 *issuer = NULL;
STACK_OF(OPENSSL_STRING) *aia = NULL;
if (x == NULL)
return 0;
cinf = X509_get_ex_data(x, stapling_ex_idx);
if (cinf) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02215)
"ssl_stapling_init_cert: certificate already initialized!");
return 0;
}
cinf = OPENSSL_malloc(sizeof(certinfo));
if (!cinf) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02216)
"ssl_stapling_init_cert: error allocating memory!");
return 0;
}
cinf->cid = NULL;
cinf->uri = NULL;
X509_set_ex_data(x, stapling_ex_idx, cinf);
issuer = stapling_get_issuer(mctx, x);
if (issuer == NULL) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02217)
"ssl_stapling_init_cert: Can't retrieve issuer certificate!");
return 0;
}
cinf->cid = OCSP_cert_to_id(NULL, x, issuer);
X509_free(issuer);
if (!cinf->cid)
return 0;
X509_digest(x, EVP_sha1(), cinf->idx, NULL);
aia = X509_get1_ocsp(x);
if (aia)
cinf->uri = sk_OPENSSL_STRING_pop(aia);
if (!cinf->uri && !mctx->stapling_force_url) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02218)
"ssl_stapling_init_cert: no responder URL");
}
if (aia)
X509_email_free(aia);
return 1;
}
static certinfo *stapling_get_cert_info(server_rec *s, modssl_ctx_t *mctx,
SSL *ssl)
{
certinfo *cinf;
X509 *x;
x = SSL_get_certificate(ssl);
if (x == NULL)
return NULL;
cinf = X509_get_ex_data(x, stapling_ex_idx);
if (cinf && cinf->cid)
return cinf;
ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, APLOGNO(01926)
"stapling_get_cert_info: stapling not supported for certificate");
return NULL;
}
/*
* OCSP response caching code. The response is preceded by a flag value
* which indicates whether the response was invalid when it was stored.
* the purpose of this flag is to avoid repeated queries to a server
* which has given an invalid response while allowing a response which
* has subsequently become invalid to be retried immediately.
*
* The key for the cache is the hash of the certificate the response
* is for.
*/
static BOOL stapling_cache_response(server_rec *s, modssl_ctx_t *mctx,
OCSP_RESPONSE *rsp, certinfo *cinf,
BOOL ok, apr_pool_t *pool)
{
SSLModConfigRec *mc = myModConfig(s);
unsigned char resp_der[MAX_STAPLING_DER];
unsigned char *p;
int resp_derlen;
BOOL rv;
apr_time_t expiry;
resp_derlen = i2d_OCSP_RESPONSE(rsp, NULL) + 1;
if (resp_derlen <= 0) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01927)
"OCSP stapling response encode error??");
return FALSE;
}
if (resp_derlen > sizeof resp_der) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01928)
"OCSP stapling response too big (%u bytes)", resp_derlen);
return FALSE;
}
p = resp_der;
/* TODO: potential optimization; _timeout members as apr_interval_time_t */
if (ok == TRUE) {
*p++ = 1;
expiry = apr_time_from_sec(mctx->stapling_cache_timeout);
}
else {
*p++ = 0;
expiry = apr_time_from_sec(mctx->stapling_errcache_timeout);
}
expiry += apr_time_now();
i2d_OCSP_RESPONSE(rsp, &p);
rv = mc->stapling_cache->store(mc->stapling_cache_context, s,
cinf->idx, sizeof(cinf->idx),
expiry, resp_der, resp_derlen, pool);
if (rv != APR_SUCCESS) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01929)
"stapling_cache_response: OCSP response session store error!");
return FALSE;
}
return TRUE;
}
static BOOL stapling_get_cached_response(server_rec *s, OCSP_RESPONSE **prsp,
BOOL *pok, certinfo *cinf,
apr_pool_t *pool)
{
SSLModConfigRec *mc = myModConfig(s);
apr_status_t rv;
OCSP_RESPONSE *rsp;
unsigned char resp_der[MAX_STAPLING_DER];
const unsigned char *p;
unsigned int resp_derlen = MAX_STAPLING_DER;
rv = mc->stapling_cache->retrieve(mc->stapling_cache_context, s,
cinf->idx, sizeof(cinf->idx),
resp_der, &resp_derlen, pool);
if (rv != APR_SUCCESS) {
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01930)
"stapling_get_cached_response: cache miss");
return TRUE;
}
if (resp_derlen <= 1) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01931)
"stapling_get_cached_response: response length invalid??");
return TRUE;
}
p = resp_der;
if (pok) {
if (*p)
*pok = TRUE;
else
*pok = FALSE;
}
p++;
resp_derlen--;
rsp = d2i_OCSP_RESPONSE(NULL, &p, resp_derlen);
if (!rsp) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01932)
"stapling_get_cached_response: response parse error??");
return TRUE;
}
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01933)
"stapling_get_cached_response: cache hit");
*prsp = rsp;
return TRUE;
}
static int stapling_set_response(SSL *ssl, OCSP_RESPONSE *rsp)
{
int rspderlen;
unsigned char *rspder = NULL;
rspderlen = i2d_OCSP_RESPONSE(rsp, &rspder);
if (rspderlen <= 0)
return 0;
SSL_set_tlsext_status_ocsp_resp(ssl, rspder, rspderlen);
return 1;
}
static int stapling_check_response(server_rec *s, modssl_ctx_t *mctx,
certinfo *cinf, OCSP_RESPONSE *rsp,
BOOL *pok)
{
int status, reason;
OCSP_BASICRESP *bs = NULL;
ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
int response_status = OCSP_response_status(rsp);
if (pok)
*pok = FALSE;
/* Check to see if response is an error. If so we automatically accept
* it because it would have expired from the cache if it was time to
* retry.
*/
if (response_status != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
if (mctx->stapling_return_errors)
return SSL_TLSEXT_ERR_OK;
else
return SSL_TLSEXT_ERR_NOACK;
}
bs = OCSP_response_get1_basic(rsp);
if (bs == NULL) {
/* If we can't parse response just pass it to client */
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01934)
"stapling_check_response: Error Parsing Response!");
return SSL_TLSEXT_ERR_OK;
}
if (!OCSP_resp_find_status(bs, cinf->cid, &status, &reason, &rev,
&thisupd, &nextupd)) {
/* If ID not present just pass back to client */
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01935)
"stapling_check_response: certificate ID not present in response!");
}
else {
if (OCSP_check_validity(thisupd, nextupd,
mctx->stapling_resptime_skew,
mctx->stapling_resp_maxage)) {
if (pok)
*pok = TRUE;
}
else {
/* If pok is not NULL response was direct from a responder and
* the times should be valide. If pok is NULL the response was
* retrieved from cache and it is expected to subsequently expire
*/
if (pok) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01936)
"stapling_check_response: response times invalid");
}
else {
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01937)
"stapling_check_response: cached response expired");
}
OCSP_BASICRESP_free(bs);
return SSL_TLSEXT_ERR_NOACK;
}
}
OCSP_BASICRESP_free(bs);
return SSL_TLSEXT_ERR_OK;
}
static BOOL stapling_renew_response(server_rec *s, modssl_ctx_t *mctx, SSL *ssl,
certinfo *cinf, OCSP_RESPONSE **prsp,
apr_pool_t *pool)
{
conn_rec *conn = (conn_rec *)SSL_get_app_data(ssl);
apr_pool_t *vpool;
OCSP_REQUEST *req = NULL;
OCSP_CERTID *id = NULL;
STACK_OF(X509_EXTENSION) *exts;
int i;
BOOL ok = FALSE;
BOOL rv = TRUE;
const char *ocspuri;
apr_uri_t uri;
*prsp = NULL;
/* Build up OCSP query from server certificate info */
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01938)
"stapling_renew_response: querying responder");
req = OCSP_REQUEST_new();
if (!req)
goto err;
id = OCSP_CERTID_dup(cinf->cid);
if (!id)
goto err;
if (!OCSP_request_add0_id(req, id))
goto err;
id = NULL;
/* Add any extensions to the request */
SSL_get_tlsext_status_exts(ssl, &exts);
for (i = 0; i < sk_X509_EXTENSION_num(exts); i++) {
X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i);
if (!OCSP_REQUEST_add_ext(req, ext, -1))
goto err;
}
if (mctx->stapling_force_url)
ocspuri = mctx->stapling_force_url;
else
ocspuri = cinf->uri;
/* Create a temporary pool to constrain memory use */
apr_pool_create(&vpool, conn->pool);
ok = apr_uri_parse(vpool, ocspuri, &uri);
if (ok != APR_SUCCESS) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01939)
"stapling_renew_response: Error parsing uri %s",
ocspuri);
rv = FALSE;
goto done;
}
else if (strcmp(uri.scheme, "http")) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01940)
"stapling_renew_response: Unsupported uri %s", ocspuri);
rv = FALSE;
goto done;
}
if (!uri.port) {
uri.port = apr_uri_port_of_scheme(uri.scheme);
}
*prsp = modssl_dispatch_ocsp_request(&uri, mctx->stapling_responder_timeout,
req, conn, vpool);
apr_pool_destroy(vpool);
if (!*prsp) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01941)
"stapling_renew_response: responder error");
if (mctx->stapling_fake_trylater) {
*prsp = OCSP_response_create(OCSP_RESPONSE_STATUS_TRYLATER, NULL);
}
else {
goto done;
}
}
else {
int response_status = OCSP_response_status(*prsp);
if (response_status == OCSP_RESPONSE_STATUS_SUCCESSFUL) {
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01942)
"stapling_renew_response: query response received");
stapling_check_response(s, mctx, cinf, *prsp, &ok);
if (ok == FALSE) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01943)
"stapling_renew_response: error in retreived response!");
}
}
else {
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01944)
"stapling_renew_response: responder error %s",
OCSP_response_status_str(response_status));
}
}
if (stapling_cache_response(s, mctx, *prsp, cinf, ok, pool) == FALSE) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01945)
"stapling_renew_response: error caching response!");
}
done:
if (id)
OCSP_CERTID_free(id);
if (req)
OCSP_REQUEST_free(req);
return rv;
err:
rv = FALSE;
goto done;
}
/*
* SSLStaplingMutex operations. Similar to SSL mutex except a mutex is
* mandatory if stapling is enabled.
*/
static int ssl_stapling_mutex_init(server_rec *s, apr_pool_t *p)
{
SSLModConfigRec *mc = myModConfig(s);
SSLSrvConfigRec *sc = mySrvConfig(s);
apr_status_t rv;
if (mc->stapling_mutex || sc->server->stapling_enabled != TRUE) {
return TRUE;
}
if ((rv = ap_global_mutex_create(&mc->stapling_mutex, NULL,
SSL_STAPLING_MUTEX_TYPE, NULL, s,
s->process->pool, 0)) != APR_SUCCESS) {
return FALSE;
}
return TRUE;
}
int ssl_stapling_mutex_reinit(server_rec *s, apr_pool_t *p)
{
SSLModConfigRec *mc = myModConfig(s);
apr_status_t rv;
const char *lockfile;
if (mc->stapling_mutex == NULL) {
return TRUE;
}
lockfile = apr_global_mutex_lockfile(mc->stapling_mutex);
if ((rv = apr_global_mutex_child_init(&mc->stapling_mutex,
lockfile, p)) != APR_SUCCESS) {
if (lockfile) {
ap_log_error(APLOG_MARK, APLOG_ERR, rv, s, APLOGNO(01946)
"Cannot reinit %s mutex with file `%s'",
SSL_STAPLING_MUTEX_TYPE, lockfile);
}
else {
ap_log_error(APLOG_MARK, APLOG_WARNING, rv, s, APLOGNO(01947)
"Cannot reinit %s mutex", SSL_STAPLING_MUTEX_TYPE);
}
return FALSE;
}
return TRUE;
}
static int stapling_mutex_on(server_rec *s)
{
SSLModConfigRec *mc = myModConfig(s);
apr_status_t rv;
if ((rv = apr_global_mutex_lock(mc->stapling_mutex)) != APR_SUCCESS) {
ap_log_error(APLOG_MARK, APLOG_WARNING, rv, s, APLOGNO(01948)
"Failed to acquire OCSP stapling lock");
return FALSE;
}
return TRUE;
}
static int stapling_mutex_off(server_rec *s)
{
SSLModConfigRec *mc = myModConfig(s);
apr_status_t rv;
if ((rv = apr_global_mutex_unlock(mc->stapling_mutex)) != APR_SUCCESS) {
ap_log_error(APLOG_MARK, APLOG_WARNING, rv, s, APLOGNO(01949)
"Failed to release OCSP stapling lock");
return FALSE;
}
return TRUE;
}
/* Certificate Status callback. This is called when a client includes a
* certificate status request extension.
*
* Check for cached responses in session cache. If valid send back to
* client. If absent or no longer valid query responder and update
* cache. */
static int stapling_cb(SSL *ssl, void *arg)
{
conn_rec *conn = (conn_rec *)SSL_get_app_data(ssl);
server_rec *s = mySrvFromConn(conn);
SSLSrvConfigRec *sc = mySrvConfig(s);
SSLConnRec *sslconn = myConnConfig(conn);
modssl_ctx_t *mctx = myCtxConfig(sslconn, sc);
certinfo *cinf = NULL;
OCSP_RESPONSE *rsp = NULL;
int rv;
BOOL ok;
if (sc->server->stapling_enabled != TRUE) {
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01950)
"stapling_cb: OCSP Stapling disabled");
return SSL_TLSEXT_ERR_NOACK;
}
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01951)
"stapling_cb: OCSP Stapling callback called");
cinf = stapling_get_cert_info(s, mctx, ssl);
if (cinf == NULL) {
return SSL_TLSEXT_ERR_NOACK;
}
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01952)
"stapling_cb: retrieved cached certificate data");
/* Check to see if we already have a response for this certificate */
stapling_mutex_on(s);
rv = stapling_get_cached_response(s, &rsp, &ok, cinf, conn->pool);
if (rv == FALSE) {
stapling_mutex_off(s);
return SSL_TLSEXT_ERR_ALERT_FATAL;
}
if (rsp) {
/* see if response is acceptable */
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01953)
"stapling_cb: retrieved cached response");
rv = stapling_check_response(s, mctx, cinf, rsp, NULL);
if (rv == SSL_TLSEXT_ERR_ALERT_FATAL) {
OCSP_RESPONSE_free(rsp);
stapling_mutex_off(s);
return SSL_TLSEXT_ERR_ALERT_FATAL;
}
else if (rv == SSL_TLSEXT_ERR_NOACK) {
/* Error in response. If this error was not present when it was
* stored (i.e. response no longer valid) then it can be
* renewed straight away.
*
* If the error *was* present at the time it was stored then we
* don't renew the response straight away we just wait for the
* cached response to expire.
*/
if (ok) {
OCSP_RESPONSE_free(rsp);
rsp = NULL;
}
else if (!mctx->stapling_return_errors) {
OCSP_RESPONSE_free(rsp);
stapling_mutex_off(s);
return SSL_TLSEXT_ERR_NOACK;
}
}
}
if (rsp == NULL) {
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01954)
"stapling_cb: renewing cached response");
rv = stapling_renew_response(s, mctx, ssl, cinf, &rsp, conn->pool);
if (rv == FALSE) {
stapling_mutex_off(s);
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01955)
"stapling_cb: fatal error");
return SSL_TLSEXT_ERR_ALERT_FATAL;
}
}
stapling_mutex_off(s);
if (rsp) {
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01956)
"stapling_cb: setting response");
if (!stapling_set_response(ssl, rsp))
return SSL_TLSEXT_ERR_ALERT_FATAL;
return SSL_TLSEXT_ERR_OK;
}
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01957)
"stapling_cb: no response available");
return SSL_TLSEXT_ERR_NOACK;
}
void modssl_init_stapling(server_rec *s, apr_pool_t *p, apr_pool_t *ptemp,
modssl_ctx_t *mctx)
{
SSL_CTX *ctx = mctx->ssl_ctx;
SSLModConfigRec *mc = myModConfig(s);
if (mc->stapling_cache == NULL) {
ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01958)
"SSLStapling: no stapling cache available");
ssl_die();
}
if (ssl_stapling_mutex_init(s, ptemp) == FALSE) {
ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01959)
"SSLStapling: cannot initialise stapling mutex");
ssl_die();
}
/* Set some default values for parameters if they are not set */
if (mctx->stapling_resptime_skew == UNSET) {
mctx->stapling_resptime_skew = 60 * 5;
}
if (mctx->stapling_cache_timeout == UNSET) {
mctx->stapling_cache_timeout = 3600;
}
if (mctx->stapling_return_errors == UNSET) {
mctx->stapling_return_errors = TRUE;
}
if (mctx->stapling_fake_trylater == UNSET) {
mctx->stapling_fake_trylater = TRUE;
}
if (mctx->stapling_errcache_timeout == UNSET) {
mctx->stapling_errcache_timeout = 600;
}
if (mctx->stapling_responder_timeout == UNSET) {
mctx->stapling_responder_timeout = 10 * APR_USEC_PER_SEC;
}
SSL_CTX_set_tlsext_status_cb(ctx, stapling_cb);
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01960) "OCSP stapling initialized");
}
#endif
View Git Blame Copy Permalink