[gnutls-devel] GnuTLS | It is not possible for server to check whether client requested OCSP stapling (#829)

[Development of GNU's TLS library]

jgh commented:


Fair comment.  Most commonly it'll be just the leaf, but... if we allow for an indefinite number and
combination, that means a bitfield - which no longer fits with the gnutls_session_get_flags() interface.

So that would be a new api call, which I'd fully understand if you don't really want to do.
If you do - one bit position per chain position; bit0 for the leaf, bit set for ocsp-status-of-this-cert-sent.

Perhaps punt on the chain-status support (we can't parse a 1.3 servercert at this time; gnutls_ext_raw_parse() crashes) and just return a single bit via gnutls_session_get_flags() if _any_
status was transmitted?

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/issues/829#note_260526515
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20191215/86dd2ae9/attachment.html>