login-common: If no CRL check is required, allow revoked certs

diff --git a/src/login-common/ssl-proxy-openssl.c b/src/login-common/ssl-proxy-openssl.c
index 586cb49eb485986db0e7792a4e3e0ca6f01de8ca..424ef70703093b1cf5297be2c0c99d534549f6f7 100644 (file)
--- a/src/login-common/ssl-proxy-openssl.c
+++ b/src/login-common/ssl-proxy-openssl.c
@@ -917,7 +917,8 @@ static int ssl_verify_client_cert(int preverify_ok, X509_STORE_CTX *ctx)
 
        if (!proxy->login_set->ssl_require_crl &&
            (ctxerr == X509_V_ERR_UNABLE_TO_GET_CRL ||
-            ctxerr == X509_V_ERR_CRL_HAS_EXPIRED)) {
+            ctxerr == X509_V_ERR_CRL_HAS_EXPIRED ||
+            ctxerr == X509_V_ERR_CERT_REVOKED)) {
                /* no CRL given with the CA list. don't worry about it. */
                preverify_ok = 1;
        }