From: Timo Sirainen <tss@iki.fi>
Date: Wed, 25 Apr 2012 18:29:14 +0000 (+0300)
Subject: *-login: Don't fail client's certificate if CRL is expired.
X-Git-Tag: 2.1.6~29
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4bfb75b0f762a1dc9ec9df48991d13ef677f4cbc;p=thirdparty%2Fdovecot%2Fcore.git

*-login: Don't fail client's certificate if CRL is expired.
This seems to be returned also when there is no CRL..
---

diff --git a/src/login-common/ssl-proxy-openssl.c b/src/login-common/ssl-proxy-openssl.c
index 2fba6f24d4..72c254c64e 100644
--- a/src/login-common/ssl-proxy-openssl.c
+++ b/src/login-common/ssl-proxy-openssl.c
@@ -864,7 +864,9 @@ static int ssl_verify_client_cert(int preverify_ok, X509_STORE_CTX *ctx)
 	proxy = SSL_get_ex_data(ssl, extdata_index);
 	proxy->cert_received = TRUE;
 
-	if (proxy->client_proxy && ctx->error == X509_V_ERR_UNABLE_TO_GET_CRL) {
+	if (proxy->client_proxy &&
+	    (ctx->error == X509_V_ERR_UNABLE_TO_GET_CRL ||
+	     ctx->error == X509_V_ERR_CRL_HAS_EXPIRED)) {
 		/* no CRL given with the CA list. don't worry about it. */
 		preverify_ok = 1;
 	}