don't be so verbose about the OCSP nonce; it is universally unsupported

diff --git a/src/cli.c b/src/cli.c
index e02080d302ae429a1653b97682ca1ba10d9dc1b1..998a1190abda1f9b1655e20b0f0c41d3aaa23f2a 100644 (file)
--- a/src/cli.c
+++ b/src/cli.c
@@ -1880,7 +1880,7 @@ static int cert_verify_ocsp(gnutls_session_t session)
                }
 
                /* verify and check the response for revoked cert */
-               ret = check_ocsp_response(cert, issuer, &resp, &nonce);
+               ret = check_ocsp_response(cert, issuer, &resp, &nonce, verbose);
                if (ret == 1)
                        ok++;
                else

diff --git a/src/ocsptool-common.c b/src/ocsptool-common.c
index ec5903c14be120b1b13a51119e435bd762c3c9f3..b0fb18ddd2d0bb53912cc1e2e8c618efde41eb7c 100644 (file)
--- a/src/ocsptool-common.c
+++ b/src/ocsptool-common.c
@@ -314,7 +314,7 @@ void print_ocsp_verify_res(unsigned int output)
 int
 check_ocsp_response(gnutls_x509_crt_t cert,
                    gnutls_x509_crt_t issuer, gnutls_datum_t * data,
-                   gnutls_datum_t * nonce)
+                   gnutls_datum_t * nonce, int verbose)
 {
        gnutls_ocsp_resp_t resp;
        int ret;
@@ -409,7 +409,8 @@ check_ocsp_response(gnutls_x509_crt_t cert,
 
                ret = gnutls_ocsp_resp_get_nonce(resp, NULL, &rnonce);
                if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
-                       fprintf(stderr, "*** The OCSP reply did not include the requested nonce.\n");
+                       if (verbose)
+                               fprintf(stderr, "*** The OCSP reply did not include the requested nonce.\n");
                        goto finish_ok;
                }
 

diff --git a/src/ocsptool-common.h b/src/ocsptool-common.h
index 5922cb0ae519b0537291a3d18b6573872a0ad5d4..c8b130e479fd67563b80f84e123726afd945c560 100644 (file)
--- a/src/ocsptool-common.h
+++ b/src/ocsptool-common.h
@@ -42,6 +42,7 @@ void print_ocsp_verify_res(unsigned int output);
 
 int
 check_ocsp_response(gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer,
-                   gnutls_datum_t * data, gnutls_datum_t *nonce);
+                   gnutls_datum_t * data, gnutls_datum_t *nonce,
+                   int verbose);
 
 #endif