Align the FFM handling of OCSP TRY_LATER responses with Tomcat Native.

markt-asf · markt-asf · commit 721591f7bff4 · 2026-03-11T22:41:17.000Z
Patch by remm
diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
@@ -1403,6 +1403,8 @@ private static int processOCSPRequest(EngineState state, URL url, MemorySegment
                         return V_OCSP_CERTSTATUS_UNKNOWN();
                     }
                     return status;
+                } else {
+                    X509_STORE_CTX_set_error(x509ctx, X509_V_ERR_UNABLE_TO_GET_CRL());
                 }
             }
         } catch (IOException ioe) {
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
@@ -202,6 +202,10 @@
       <update>
         Update the recommended version for Tomcat Native 2.x to 2.0.14. (markt)
       </update>
+      <fix>
+        Align the FFM handling of OCSP <code>TRY_LATER</code> responses with
+        Tomcat Native. (remm)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Jasper">

Original file line number	Diff line number	Diff line change
`@@ -1403,6 +1403,8 @@ private static int processOCSPRequest(EngineState state, URL url, MemorySegment`
`1403`	`1403`	`return V_OCSP_CERTSTATUS_UNKNOWN();`
`1404`	`1404`	`}`
`1405`	`1405`	`return status;`
	`1406`	`+ } else {`
	`1407`	`+ X509_STORE_CTX_set_error(x509ctx, X509_V_ERR_UNABLE_TO_GET_CRL());`
`1406`	`1408`	`}`
`1407`	`1409`	`}`
`1408`	`1410`	`} catch (IOException ioe) {`