*-login: Don't fail client's certificate if CRL is expired.

This seems to be returned also when there is no CRL..

diff --git a/src/login-common/ssl-proxy-openssl.c b/src/login-common/ssl-proxy-openssl.c
index 2fba6f24d44625543c200e0d302dd8e69c6adf5e..72c254c64e4718ba0983c4c8ea6595baad3a720f 100644 (file)
--- a/src/login-common/ssl-proxy-openssl.c
+++ b/src/login-common/ssl-proxy-openssl.c
@@ -864,7 +864,9 @@ static int ssl_verify_client_cert(int preverify_ok, X509_STORE_CTX *ctx)
        proxy = SSL_get_ex_data(ssl, extdata_index);
        proxy->cert_received = TRUE;
 
-       if (proxy->client_proxy && ctx->error == X509_V_ERR_UNABLE_TO_GET_CRL) {
+       if (proxy->client_proxy &&
+           (ctx->error == X509_V_ERR_UNABLE_TO_GET_CRL ||
+            ctx->error == X509_V_ERR_CRL_HAS_EXPIRED)) {
                /* no CRL given with the CA list. don't worry about it. */
                preverify_ok = 1;
        }