Hello. I'm trying to integrate OCSP certificate validation support in OpenSSL. By now I have incorporated OCSP check for the last certificate in chain (and for all certificates -- depending on flags) into the check_revocation(X509_STORE_CTX *) function (crypto/x509/x509_vfy.c).
The check itself is very similar to CRL's one, but actual code was taken from the bundled "ocsp" openssl app. This way OCSP goes to libcrypto.so, which is the library libssl.so is dependent on. But OCSP check requires libssl to establish connection to the OCSP responder. Some apps (like ssh) are linking only libcrypto (without libssl), and thus resulting in "unresolved symbol" errors on startup. The problem is that I have to cross-link libcrypto.so and libssl.so in order to fix this issue, which is indeed not a very nice way to deal with the things. So shall OCSP be placed in some other place (though check_revocation(X509_STORE_CTX *) seems rather logical place) or is there some other way to solve this problem? -- Best wishes, Alexander Komyagin ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [email protected]
