From c6e7ea685ed13e4841305615cb3f161fd8c2db04 Mon Sep 17 00:00:00 2001
From: Andras Fekete <andras@wolfssl.com>
Date: Tue, 14 Mar 2023 18:09:45 -0400
Subject: [PATCH] Add in CERT_UNKNOWN detection

---
 src/ocsp.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/ocsp.c b/src/ocsp.c
index 69be0534b..6a393b8f7 100644
--- a/src/ocsp.c
+++ b/src/ocsp.c
@@ -395,7 +395,11 @@ int CheckOcspResponse(WOLFSSL_OCSP *ocsp, byte *response, int responseSz,
 end:
     if (ret == 0 && validated == 1) {
         WOLFSSL_MSG("New OcspResponse validated");
-    } else if (ret != OCSP_CERT_REVOKED) {
+    } else if ((ret == ocsp->error) && (ocspResponse->single->status->status == CERT_UNKNOWN)) {
+        WOLFSSL_MSG("OCSP unknown");
+        ret = OCSP_CERT_UNKNOWN;
+    } else if ((ret != OCSP_CERT_REVOKED) && (ret != ocsp->error)) {
+        WOLFSSL_MSG("OCSP lookup failure");
         ret = OCSP_LOOKUP_FAIL;
     }