You are viewing a plain text version of this content. The canonical link for it is here.

Posted to bugs@httpd.apache.org by bu...@apache.org on 2025/06/24 14:08:37 UTC

[Bug 60186] Adding a SSL Verify directive to accept expired client certificate

https://bz.apache.org/bugzilla/show_bug.cgi?id=60186

Joe Orton <jo...@redhat.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |WONTFIX
             Status|NEW                         |RESOLVED

--- Comment #1 from Joe Orton <jo...@redhat.com> ---
I'd treat this as the same as the optional_no_ca issue tracked in bug 60028. I
think it's highly unlikely that we get a strong assurance from the OpenSSL API
that if X509_V_ERR_CERT_HAS_EXPIRED is returned that is the *only* verification
error seen in the chain, so enabling this could plausibly mask some more
serious trust/verify issue.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org