Merge pull request #4456 from dgarske/zd13032

Fix to not try OCSP or CRL checks if there is already an error
2021-10-11 08:20:58 +10:00
parent f757318eeb 668f8700a4
commit 511c74ea52
1 changed files with 3 additions and 1 deletions
--- a/src/internal.c
+++ b/src/internal.c
@ -12355,7 +12355,9 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
        {
            if (args->count > 0) {
            #if defined(HAVE_OCSP) || defined(HAVE_CRL)
-                if (args->fatal == 0) {
+                /* only attempt to check OCSP or CRL if not previous error such 
+                 * as ASN_BEFORE_DATE_E or ASN_AFTER_DATE_E */
+                if (args->fatal == 0 && ret == 0) {
                    int doLookup = 1;

                    if (ssl->options.side == WOLFSSL_CLIENT_END) {