You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2025/04/08 05:15:24 UTC

[Bug 69647] New: SSLStaplingReturnResponderErrors Directive Behavior Differs from the Documentation

https://bz.apache.org/bugzilla/show_bug.cgi?id=69647

            Bug ID: 69647
           Summary: SSLStaplingReturnResponderErrors Directive Behavior
                    Differs from the Documentation
           Product: Apache httpd-2
           Version: 2.4.62
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: mod_ssl
          Assignee: bugs@httpd.apache.org
          Reporter: hirasawa.yuta@fujitsu.com
  Target Milestone: ---

The behavior of the SSLStaplingReturnResponderErrors directive differs from the
documentation.
The documentation describes the behavior when this directive is set to off as
follows:

> If set to off, only responses indicating a certificate status of "good" will be included in the TLS handshake.

However, in Apache 2.4.58 and later, even with this directive set to off,
responses indicating a certificate status of "revoked" are included in the TLS
handshake.
This behavior seems to be due to the following fix:

[fix]
https://github.com/apache/httpd/commit/4d617dbeaf481d62298d093deb0bda0637537cd8 

Reading the commit message, it appears that this is the intended behavior.
Therefore, shouldn't the documentation be revised?

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 69647] SSLStaplingReturnResponderErrors Directive Behavior Differs from the Documentation

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69647

Rich Bowen <rb...@apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
          Component|mod_ssl                     |Documentation
           Assignee|bugs@httpd.apache.org       |docs@httpd.apache.org
         Resolution|---                         |FIXED

--- Comment #1 from Rich Bowen <rb...@apache.org> ---
Updated SSLStaplingReturnResponderErrors docs to clarify that
responses with a "revoked" status are always included in the TLS
handshake regardless of this setting, because suppressing a known
revocation would be a security risk.

This behavior was intentionally introduced in r1875355.

Fixed in r1933788 (trunk), r1933789 (2.4).

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org