Don't check OCSP if there are no OCSP servers in the chain (#255)

square · Feb 9, 2022 · 8f0d49f · 8f0d49f
1 parent dc9943e
commit 8f0d49f
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/lib/ocsp.go b/lib/ocsp.go
@@ -76,6 +76,15 @@ func checkOCSP(chain []*x509.Certificate, ocspStaple []byte) (status *ocsp.Respo
 		return nil, skippedRevocationCheck
 	}
 
+	// Skip if there are no OCSP servers in the chain.
+	numServers := 0
+	for _, cert := range chain[1:] {
+		numServers += len(cert.OCSPServer)
+	}
+	if numServers == 0 {
+		return nil, skippedRevocationCheck
+	}
+
 	retries := maxOCSPValidationRetries
 	if len(ocspStaple) > 0 {
 		// Don't retry if stapled