freeipa

#9412 RFE:"SSLOCSPEnable on no_ocsp_for_cert_ok" alternative to "off" when enabling smartcard (client cert) auth
Closed: wontfix by rcritten. Opened by rcritten.

Closed: wontfix
Reopen Issue

Request for enhancement

The "ipa-advise config-client-for-smart-card-auth" script enables OCSP
checks in httpd, the RHEL docs say to disable it if the client
certificates don't have an OCSP responder URL (third-party CA). [1]

Apache httpd has an undocumented flag "no_ocsp_for_cert_ok" which will
pass certificates without OCSP URLs as valid but still perform OCSP
server checks for certificates that do have an OCSP URL. [2][3]

[1]
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/managing_smart_card_authentication/configuring-idm-for-smart-card-auth_managing-smart-card-authentication#conf-idm-server-for-smart-card-auth_configuring-idm-for-smart-card-auth
[2]
https://bz.apache.org/bugzilla/show_bug.cgi?id=62112
[3]
https://svn.apache.org/viewvc/httpd/httpd/tags/2.4.57/modules/ssl/ssl_engine_ocsp.c?view=markup#l142

Closing this. At best it is a documentation issue. I'm not keen on relying on undocumented behavior in Apache.

Metadata Update from @rcritten:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.