revocation: Log error if no OCSP signer candidate found

Fixes evaluation of ikev2/ocsp-untrusted-cert.

diff --git a/src/libstrongswan/plugins/revocation/revocation_validator.c b/src/libstrongswan/plugins/revocation/revocation_validator.c
index eb9065fb370819d4425e5144cce53b5e09d7c2f5..9fd5b2a22743f78ad82f93afab2816d3e9902d26 100644 (file)
--- a/src/libstrongswan/plugins/revocation/revocation_validator.c
+++ b/src/libstrongswan/plugins/revocation/revocation_validator.c
@@ -118,7 +118,6 @@ static bool verify_ocsp(ocsp_response_t *response, certificate_t *ca)
                {       /* OCSP signer currently invalid */
                        continue;
                }
-               found = TRUE;
                if (!ca->equals(ca, issuer))
                {       /* delegated OCSP signer? */
                        if (!lib->credmgr->issued_by(lib->credmgr, issuer, ca, NULL))
@@ -130,6 +129,7 @@ static bool verify_ocsp(ocsp_response_t *response, certificate_t *ca)
                                continue;
                        }
                }
+               found = TRUE;
                if (lib->credmgr->issued_by(lib->credmgr, subject, issuer, NULL))
                {
                        DBG1(DBG_CFG, "  ocsp response correctly signed by \"%Y\"",