--- originale.c	Wed May 19 18:43:34 1999
+++ ssl_engine_kernel.c	Thu May 20 14:16:44 1999
@@ -109,6 +109,69 @@
                                             -- Unknown                */
 #include "mod_ssl.h"
   
+/* Giacob: static declaration data and function for ocsp */
+
+#include <lber.h>
+#include <ldap.h>
+#include "ocsp.h"
+
+typedef struct cert_file_st 
+        { 
+        char *name;
+        int   status;
+        int   reason;
+        char *time;
+        char *this;
+        char *next; 
+        } CERT_FILE;
+    
+typedef struct response_st
+        {
+        CERT_FILE *cert_file;
+        int rsp_status;
+        } RESPONSE_FILE;
+   
+typedef struct strtbl_st { int t; char *m; } STRTBL;
+
+static OCSP_RESPONSE *ocsp_response_hook(int id, int  rsp_status, X509* xcert, OCSP_CERTID *certid, OCSP_CERTSTATUS *ocsp_status, char *this, char *next);
+static OCSP_REQUEST *ocsp_request_hook(X509* xcert, OCSP_CERTID *certid);
+static RESPONSE_FILE *ocsp_ldap_hook(X509 *xs, char *mail, char *time);
+static void get_entry(LDAP *ld, LDAPMessage *entry, RESPONSE_FILE **response, char *cert, int len);
+static void *ocsp_responder(X509 *xs);
+
+static STRTBL crlReasons[8]= {
+        { OCSP_REVOKED_STATUS_UNSPECIFIED, "unspecified" },
+        { OCSP_REVOKED_STATUS_KEYCOMPROMISE, "keyCompromise" },
+        { OCSP_REVOKED_STATUS_CACOMPROMISE, "cACompromise" },
+        { OCSP_REVOKED_STATUS_AFFILIATIONCHANGED, "affiliationChanged" },
+        { OCSP_REVOKED_STATUS_SUPERSEDED, "superseded" },
+        { OCSP_REVOKED_STATUS_CESSATIONOFOPERATION, "cessationOfOperation" },
+        { OCSP_REVOKED_STATUS_CERTIFICATEHOLD, "certificateHold" },
+        { OCSP_REVOKED_STATUS_REMOVEFROMCRL, "removeFromCRL" } };
+
+static STRTBL respStatus[6] = {
+        { OCSP_RESPONSE_STATUS_SUCCESSFULL, "successfull" },
+        { OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, "malformedRequest" },
+        { OCSP_RESPONSE_STATUS_INTERNALERROR, "internalError" },
+        { OCSP_RESPONSE_STATUS_TRYLATER, "tryLater" },
+        { OCSP_RESPONSE_STATUS_SIGREQUIRED, "sigRequired" },
+        { OCSP_RESPONSE_STATUS_UNAUTHORIZED, "unauthorized" } };
+
+static STRTBL certStatus[3] = {
+        { V_OCSP_CERTSTATUS_GOOD, "good" },
+        { V_OCSP_CERTSTATUS_REVOKED, "revoked" },
+        { V_OCSP_CERTSTATUS_UNKNOWN, "unknown" } };
+
+static STRTBL respIds[2] = {
+        { V_OCSP_RESPID_NAME, "name" },
+        { V_OCSP_RESPID_KEY, "key" } };
+
+static BIO *bio_err = NULL; 
+static char ocsp_response[20] = "no check";
+
+FILE *fperr; /* ocsp debug file pointer */
+
+
 /*  _________________________________________________________________
 **
 **  SSL Engine Kernel
@@ -913,6 +976,7 @@
     }
 #endif /* SSL_EXPERIMENTAL */
 
+
     /*
      * Check SSLRequire boolean expressions
      */
@@ -1011,6 +1075,535 @@
     NULL
 };
 
+/* Giacob: retrieve cert status from ldap */
+   
+static RESPONSE_FILE *ocsp_ldap_hook(X509 *xs, char *mail, char *time)
+{ 
+   RESPONSE_FILE *response; 
+   STRTBL *table;
+   LDAP *ld;
+   LDAPMessage *res,*e;
+   BIO *bp_cert;
+   
+   char *attrs[] = {"mail", "cn", "usercertificate;binary", NULL}; /* attributes to be retrieved from LDAP */
+   char filtpattern[1024];
+   char *ldapservers = "/*ldap-idd.comune.modena.it:389*/ callisto.comune.modena.it:3389";
+
+   unsigned char *cert, *buf;
+   char *certificate;
+   int len;
+
+   int done, rc;
+   
+   /* default response: certificate status REVOKED */
+   response->rsp_status = OCSP_RESPONSE_STATUS_SUCCESSFULL;
+   response->cert_file->status = V_OCSP_CERTSTATUS_REVOKED;
+   response->cert_file->reason = OCSP_REVOKED_STATUS_KEYCOMPROMISE;
+   response->cert_file->time = time;
+   table = &certStatus[V_OCSP_CERTSTATUS_REVOKED];
+   strcpy(ocsp_response, table->m);
+
+   /* Convert certificate from X509* to DER, put it in a string certificate */
+   len = i2d_X509(xs, NULL);
+   cert = malloc(len);
+   buf = cert;
+   if (!(i2d_X509(xs, &buf)))
+      {
+       fprintf(fperr,"Can't convert X509 certificate in DER format.\n");
+       fflush(fperr);
+       response->rsp_status = OCSP_RESPONSE_STATUS_INTERNALERROR;
+       response->cert_file->status = V_OCSP_CERTSTATUS_UNKNOWN;
+       table = &respStatus[OCSP_RESPONSE_STATUS_INTERNALERROR];
+       strcpy(ocsp_response, table->m);
+       return response;
+      }
+   certificate = (char *)cert;
+
+   fprintf(fperr, "Certificate to verify lenght in bytes: %d. \n", len);
+   fflush(fperr);
+   
+   if ((ld = ldap_init(ldapservers, 0)) == NULL )
+       {
+        fprintf(fperr,"Can't initialize ldap support \n");
+        fflush(fperr);
+        response->rsp_status = OCSP_RESPONSE_STATUS_INTERNALERROR;
+        response->cert_file->status = V_OCSP_CERTSTATUS_UNKNOWN;
+        table = &respStatus[OCSP_RESPONSE_STATUS_INTERNALERROR];
+        strcpy(ocsp_response, table->m);
+        return response;
+       }
+   ld -> ld_options = LDAP_OPT_REFERRALS;
+   ld -> ld_sizelimit = 0;
+   ld -> ld_timelimit = 0;
+   ld -> ld_deref = LDAP_DEREF_ALWAYS;
+   
+ if ((rc = ldap_bind_s (ld, NULL, NULL, LDAP_AUTH_SIMPLE)) != LDAP_SUCCESS)
+    {
+     fprintf(fperr,"can't bind to LDAP server %s\n",ldap_err2string (rc));
+     fflush(fperr);
+     response->rsp_status = OCSP_RESPONSE_STATUS_TRYLATER;
+     response->cert_file->status = V_OCSP_CERTSTATUS_UNKNOWN;
+     table = &respStatus[OCSP_RESPONSE_STATUS_TRYLATER];
+     strcpy(ocsp_response, table->m);
+     return response;
+    } else {
+            fprintf(fperr,"binded to LDAP server!!!\n");
+            fflush(fperr);
+           }
+   
+   /* build filter for ldap search by e-mail */
+   ldap_build_filter (filtpattern, 1024, "(%a=%v)", NULL, NULL, "mail", mail, NULL);
+   
+   if (ldap_search(ld, "o=giacob ,c=it", LDAP_SCOPE_SUBTREE, filtpattern, attrs, 0 ) == -1 )
+      {
+       fprintf(fperr,"User %s NOT found in LDAP\n", mail);
+       fflush(fperr);
+       response->rsp_status = OCSP_RESPONSE_STATUS_UNAUTHORIZED-1;
+       response->cert_file->status = V_OCSP_CERTSTATUS_UNKNOWN;
+       table = &respStatus[OCSP_RESPONSE_STATUS_UNAUTHORIZED-1];
+       strcpy(ocsp_response, table->m);
+       return response;
+      } else {
+              fprintf(fperr,"user %s found in LDAP\n", mail);
+              fflush(fperr);
+             }
+   
+   done = 0;
+   
+   /* retrieve results of ldap search: must be just one entry */
+   while ((rc = ldap_result(ld, LDAP_RES_ANY, 0, NULL, &res)) == LDAP_RES_SEARCH_ENTRY)
+          {
+           e = ldap_first_entry(ld, res);
+           get_entry(ld, e, &response, cert, len);
+           ldap_msgfree(res);
+           done = 1;
+          }
+   
+   if (!done) {
+               fprintf(fperr,"Ldap search result not retrieved: %s.\n", ldap_err2string (rc));
+               fflush(fperr);
+               response->rsp_status = OCSP_RESPONSE_STATUS_UNAUTHORIZED-1;
+               response->cert_file->status = V_OCSP_CERTSTATUS_UNKNOWN;
+               table = &respStatus[OCSP_RESPONSE_STATUS_UNAUTHORIZED-1];
+               strcpy(ocsp_response, table->m);
+               return response;
+              }
+   
+   ldap_msgfree(res);
+   ldap_unbind(ld);
+   
+   fprintf(fperr,"Risposta ocsp: %s.\n", ocsp_response);
+   fflush(fperr);
+   
+   return response;
+}  
+
+static void get_entry (LDAP *ld, LDAPMessage *entry, RESPONSE_FILE **response, char *cert, int len)
+   {
+    char *attribute;
+    char *value;
+    char *cert_ldap;
+    int cert_len;
+
+    BerElement *ber;
+    struct berval **bvals;
+    int k;
+    STRTBL *table;
+   
+    /* retrieve attributes of the entry found by ldap search */
+    for (attribute = ldap_first_attribute(ld, entry, &ber); attribute != NULL; attribute = ldap_next_attribute(ld, entry, ber))
+        {
+         if ((bvals = ldap_get_values_len(ld, entry, attribute)) != NULL)
+             {
+              /* get each attribute value of current entry */
+              for (k = 0; bvals[k] != NULL; k++)
+                  {
+                   value = bvals[k]->bv_val;
+                   if (!strcmp(attribute, "usercertificate;binary"))
+                      {
+                       cert_ldap = value;
+                       cert_len = bvals[k]->bv_len;
+                       fprintf(fperr,"Certificato trovato in LDAP lungo %d caratteri:\n", cert_len);
+                       fflush(fperr);
+   
+                       /* cert_ldap, cert_len = current certificate from LDAP in DER, certificate lenght in byte */
+                       /* cert, len  = certificate to verify, certificate lenght in byte */
+                       if (cert_len == len)
+                          {
+                           /* verify certificate found in LDAP */
+                           char *ldapc;
+                           char *clientc;
+                           clientc = cert;
+                           ldapc = cert_ldap;
+                            
+                           while (ldapc < cert_ldap + cert_len && *ldapc++ == *clientc++); /* NULL INSTRUCTION */
+   
+                           if (ldapc == cert_ldap + cert_len)   /* certificate found ! */
+                              {
+                               (*response)->rsp_status = OCSP_RESPONSE_STATUS_SUCCESSFULL;
+                               (*response)->cert_file->status = V_OCSP_CERTSTATUS_GOOD;
+                               table = &certStatus[V_OCSP_CERTSTATUS_GOOD];
+                               strcpy(ocsp_response, table->m);
+                              }
+                          }
+                      }
+                    else {
+                          /* Nothing on other attributes retrieved: mail, cn */
+                          fprintf(fperr, "%s=%s\n", attribute, value);
+                          fflush(fperr);
+                         }
+                   }
+   
+              }
+         ber_bvecfree(bvals);  /* frees array of berval returned from search */
+  }
+
+ return;
+}
+
+/* Giacob: creating ocsp request on certificate */
+
+static OCSP_REQUEST *ocsp_request_hook (X509 *xcert, OCSP_CERTID *certid)
+{
+ OCSP_REQUEST *req = NULL;
+ X509_NAME *xn = NULL;
+ BIO *bio = NULL;
+ STACK *extns = NULL;
+
+ xn = X509_get_subject_name(xcert);
+
+ if (!(req = OCSP_request_new(xn, extns))) 
+    {
+     fprintf(fperr,"Can't create OCSP request.\n");
+     fflush(fperr);
+     return NULL;
+    } 
+    else {
+          fprintf(fperr,"OCSP request created.\n");
+          fflush(fperr);
+         }   
+
+ if (OCSP_request_add(req, certid, NULL) == 0)
+    {
+     fprintf(fperr,"Can't put data in OCSP request.\n");                            
+     fflush(fperr);
+     if (req) OCSP_REQUEST_free(req);
+     return NULL; 
+    }
+    else {
+          fprintf(fperr,"OCSP request filled with data.\n");
+          fflush(fperr);
+         }
+
+ if ((bio = BIO_new(BIO_s_file())) != NULL) BIO_set_fp(bio, fperr, BIO_NOCLOSE);
+ if (!(OCSP_REQUEST_print(bio, req)))
+    {
+     fprintf(fperr,"Can't print OCSP request.\n");
+     fflush(fperr);
+     if (req) OCSP_REQUEST_free(req);
+     return NULL;
+    }
+    else fflush(fperr);
+
+ return req;
+}
+
+/* Giacob: creating ocsp response on certificate */
+    
+static OCSP_RESPONSE *ocsp_response_hook(int id, int rsp_status, X509 *xcert, OCSP_CERTID *certid, OCSP_CERTSTATUS *ocsp_status, char *this, char *next)
+{   
+ OCSP_BASICRESP *brsp = NULL;
+ OCSP_RESPONSE *rsp = NULL;
+ X509_NAME* xn;
+ X509 *xs_srvr;
+ EVP_PKEY *key;
+ STACK *sk;
+
+ BIO *bio;
+ FILE *fp_srvr;
+    
+ xn = X509_get_subject_name(xcert);
+
+ if ((fp_srvr = fopen("/m/home/giacob/src/work_ocsp/apache/conf/ssl.crt/server.crt", "r")) == NULL)
+    {   
+     fprintf(fperr,"Can't open server certificate file.\n");
+     fflush(fperr);
+     if (brsp) OCSP_BASICRESP_free(brsp);
+     return NULL;
+    }
+
+ xs_srvr = PEM_read_X509(fp_srvr, NULL, NULL);
+ fclose(fp_srvr);
+ if (!xs_srvr)
+    {
+     fprintf(fperr,"Can't read server certificate file.\n");
+     fflush(fperr);
+     if (brsp) OCSP_BASICRESP_free(brsp);
+     return NULL;
+    }
+    else {
+          fprintf(fperr,"Server certificate:\n");
+          X509_print_fp(fperr, xs_srvr);
+          fflush(fperr);
+         }
+
+ if (!(brsp = OCSP_basic_response_new(id, xs_srvr, NULL)))
+    { 
+     fprintf(fperr,"Cant't create OCSP basic response.\n");
+     fflush(fperr);
+     return NULL;
+    }
+    else {
+          fprintf(fperr,"OCSP basic response created.\n");
+          fflush(fperr);
+         }
+
+ if (!(OCSP_basic_response_add(brsp, certid, ocsp_status, this, next, NULL)))
+    {
+     fprintf(fperr,"Can't put data in OCSP basic response.\n");
+     fflush(fperr);
+     if (brsp) OCSP_BASICRESP_free(brsp);
+     return NULL;
+    }
+    else {
+          fprintf(fperr,"OCSP basic response filled with data.\n");  
+          fflush(fperr);
+         }
+ 
+ if (!(sk = sk_new(NULL)))
+    {
+     fprintf(fperr,"Can't initialize stack.\n");
+     fflush(fperr);
+     if (brsp) OCSP_BASICRESP_free(brsp);
+     return NULL;
+    }
+
+ if (!sk_push(sk, (char *) xs_srvr))
+    {
+     fprintf(fperr,"Can't put server certificate in stack.\n");
+     fflush(fperr);
+     if (brsp) OCSP_BASICRESP_free(brsp);
+     return NULL;
+    }
+
+ if ((fp_srvr = fopen("/m/home/giacob/src/work_ocsp/apache/conf/ssl.key/server.key", "r")) == NULL)
+    {   
+     fprintf(fperr,"Can't open server key file.\n");
+     fflush(fperr);
+     if (brsp) OCSP_BASICRESP_free(brsp);
+     return NULL;
+    }
+
+ key = PEM_read_PrivateKey(fp_srvr, NULL, NULL);
+ fclose(fp_srvr);
+ if (!key)
+    {
+     fprintf(fperr,"Can't read server key file.\n");
+     fflush(fperr);
+     if (brsp) OCSP_BASICRESP_free(brsp);
+     return NULL;
+    }
+    else {
+          fprintf(fperr,"Server key:\n");
+          PEM_write_PrivateKey(fperr, key, NULL, NULL, NULL, NULL);
+          fflush(fperr);
+         }
+
+ if (!(OCSP_basic_response_sign(brsp, key, EVP_sha1(), sk)))
+    {    
+     fprintf(fperr,"Can't sign OCSP basic response.\n");
+     fflush(fperr);    
+     if (brsp) OCSP_BASICRESP_free(brsp);
+     return NULL;
+    }
+    else {
+          fprintf(fperr,"OCSP basic response signed with server certificate.\n");
+          fflush(fperr);
+         }
+
+ if (!(rsp = OCSP_response_new(rsp_status, NID_id_pkix_ocsp_basic, i2d_OCSP_BASICRESP, (char*)brsp)))
+    {
+     fprintf(fperr,"Can't create OCSP response.\n");
+     fflush(fperr);
+     if (brsp) OCSP_BASICRESP_free(brsp);
+     return NULL;
+    }
+    else {
+          fprintf(fperr,"OCSP response created.\n");
+          fflush(fperr);
+         }
+
+ if (!(OCSP_response_verify(rsp, X509_get_pubkey(xs_srvr))))
+    {   
+     fprintf(fperr,"Can't verify OCSP response.\n");
+     fflush(fperr);
+     if (brsp) OCSP_BASICRESP_free(brsp);
+     return NULL;
+    } 
+    else {
+          fprintf(fperr,"OCSP response verified.\n");
+          fflush(fperr);
+         }
+
+ if ((bio = BIO_new(BIO_s_file())) != NULL) BIO_set_fp(bio, fperr, BIO_NOCLOSE);
+ if (!(OCSP_RESPONSE_print(bio, rsp)))
+    {
+     fprintf(fperr,"Can't print OCSP response.\n");
+     fflush(fperr);
+     if (brsp) OCSP_BASICRESP_free(brsp);
+     return NULL;
+    }
+    else fflush(fperr);
+
+ if (brsp) OCSP_BASICRESP_free(brsp);
+
+ return rsp;
+} 
+
+/* Giacob: OCSP responder */
+
+static void *ocsp_responder (X509 *xs)  
+{
+ OCSP_CERTID *new_cid;
+ OCSP_REQUEST *new_req;
+ OCSP_RESPONSE *new_rsp;
+ OCSP_CERTSTATUS *cert_status = NULL;
+ X509 *xs_ca;
+ X509_NAME *xn;
+ RESPONSE_FILE *new_response;
+
+ time_t tc;
+ struct tm *tm;
+
+ int rspid = V_OCSP_RESPID_NAME;
+ char ou[20], name[30], mail[30], now[10], this[10], next[10];
+ 
+ FILE *fp_ca;
+
+
+ xn = X509_get_subject_name(xs);
+
+ X509_NAME_get_text_by_NID(xn, NID_organizationalUnitName, ou, 20);
+
+ fperr = fopen("/tmp/ocsp-err.log", "w");
+
+ if ((fp_ca = fopen("/m/home/giacob/src/work_ocsp/apache/conf/ssl.crt/giacobca.crt", "r")) == NULL)
+    {   
+     fprintf(fperr,"Can't open CA certificate file.\n");
+     fflush(fperr);
+     fclose(fperr);
+     return;
+    }
+
+ xs_ca = PEM_read_X509(fp_ca, NULL, NULL);
+ fclose(fp_ca);
+ if (!xs_ca)
+    {
+     fprintf(fperr,"Can't read CA certificate file.\n");
+     fflush(fperr);
+     fclose(fperr);
+     return;
+    }
+    else {
+          fprintf(fperr,"CA certificate:\n");
+          X509_print_fp(fperr, xs_ca);
+          fflush(fperr);
+         }
+
+ tc = time(NULL);
+ tm = localtime(&tc);
+ /* now = local time */
+ sprintf(now, "%02d%02d%02d%02d%02d%02d%02dZ", (tm->tm_year / 100) + 19, (tm->tm_year % 100), tm->tm_mon+1, tm->tm_mday,
+                tm->tm_hour, tm->tm_min, tm->tm_sec);
+ /* this = this update of certificate status time */
+ sprintf(this, "%02d%02d%02d%02d%02d%02d%02dZ", (tm->tm_year / 100) + 19, (tm->tm_year % 100), tm->tm_mon+1, tm->tm_mday,
+               tm->tm_hour-2, tm->tm_min, tm->tm_sec);
+ /* next = next avaiable update of certificate status time */
+ sprintf(next, "%02d%02d%02d%02d%02d%02d%02dZ", (tm->tm_year / 100) + 19, (tm->tm_year % 100), tm->tm_mon+2, tm->tm_mday,
+               tm->tm_hour, tm->tm_min, tm->tm_sec);
+ fprintf(fperr,"Time: %s, This: %s, Next: %s\n", now, this, next);
+ fflush(fperr);
+
+ if (strcmp(ou, "CA"))
+    {
+     fprintf(fperr,"Organizational Unit: %s\n", ou);
+     fprintf(fperr,"Subject certificate:\n");
+     X509_print_fp(fperr, xs);
+     fflush(fperr);
+
+     if ((bio_err=BIO_new(BIO_s_file())) != NULL) BIO_set_fp(bio_err, stderr, BIO_NOCLOSE);
+
+     if (!(new_cid = OCSP_cert_id_new(EVP_md5(), X509_get_issuer_name(xs), xs_ca->cert_info->key->public_key, X509_get_serialNumber(xs))))
+        {
+         fprintf(fperr,"Can't create certificate id.\n");
+         fflush(fperr);
+         return;
+        }
+        else {
+              fprintf(fperr,"New certificate id created.\n");
+              fflush(fperr);
+             }
+
+     if (!(new_req = ocsp_request_hook (xs, new_cid))) return;
+
+     X509_NAME_get_text_by_NID(xn, NID_commonName, name, 30);
+     X509_NAME_get_text_by_NID(xn, NID_pkcs9_emailAddress, mail, 30);
+
+     fprintf(fperr,"Values inside vars: subject name=%s, subject e-mail=%s.\n", name, mail);
+     fflush(fperr);
+
+     if (!(new_response = ocsp_ldap_hook(xs, mail, now)))
+        {
+         fprintf(fperr,"Can't get status from LDAP directory.\n");
+         fflush(fperr);
+         return;
+        }
+        else {
+              fprintf(fperr,"Ldap get status done.\n");
+              fflush(fperr);
+             }
+
+     new_response->cert_file->name = name;
+     new_response->cert_file->time = now;
+     new_response->cert_file->this = this;
+     new_response->cert_file->next = next;
+ 
+     if (!(cert_status = OCSP_cert_status_new(new_response->cert_file->status, new_response->cert_file->reason, now)))
+        {
+         fprintf(fperr,"Can't create new certificate status.\n");
+         fflush(fperr);
+         return;
+        }
+        else {
+              fprintf(fperr,"New certificate status created.\n");       
+              fflush(fperr);
+             }
+
+     /* if status = revoked ssl_log(s, SSL_LOG_ERROR, "Certificate Status Verification: Revoked Certificate");
+      ap_ctx_set(conn->client->ctx, "ssl::verify::error",
+             X509_verify_cert_error_string(X509_V_ERR_CERT_REVOKED));
+      ok = FALSE;*/ 
+ 
+     if (!(new_rsp = ocsp_response_hook(rspid, new_response->rsp_status, xs, new_cid, cert_status, this, next))) return;
+
+     if (cert_status) OCSP_CERTSTATUS_free(cert_status);
+
+     ERR_print_errors(bio_err);
+     ERR_print_errors_fp(stderr);
+    }
+    else {
+          fprintf(fperr,"Organizational Unit: %s\n", ou);
+          fprintf(fperr,"Issuer certificate:\n");
+          X509_print_fp(fperr, xs);
+          fflush(fperr);
+         }
+
+ fflush(fperr);
+ fclose(fperr);
+
+ return;
+}
+
 
 int ssl_hook_Fixup(request_rec *r)
 {
@@ -1029,6 +1622,9 @@
     if (ap_ctx_get(r->connection->client->ctx, "ssl") == NULL)
         return DECLINED;
 
+    /* Giacob: set environment var */
+    ap_table_set(e, "OCSP_LDAP_RESPONSE", ocsp_response);
+
     /*
      * Annotate the SSI/CGI environment with standard SSL information
      */
@@ -1040,6 +1636,7 @@
             ap_table_set(e, var, val);
     }
 
+
     /*
      * On-demand bloat up the SSI/CGI environment with certificate data
      */
@@ -1226,6 +1823,11 @@
                    X509_verify_cert_error_string(X509_V_ERR_CERT_CHAIN_TOO_LONG));
         ok = FALSE;
     }
+
+
+    /* Giacob: take certificate for ldap_hook */
+    ocsp_responder (xs);
+
 
     /*
      * And finally signal OpenSSL the (perhaps changed) state
