From f1255684405bebeeb12a7175bab91ca2da9286f8 Mon Sep 17 00:00:00 2001 From: Soma Aishwarya Date: Fri, 16 Oct 2026 16:51:42 +0530 Subject: [PATCH] sbi: reject expired client certificates in verify_callback --- lib/sbi/nghttp2-server.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/lib/sbi/nghttp2-server.c b/lib/sbi/nghttp2-server.c index f7e1edeee..00fe4235f 100644 --- a/lib/sbi/nghttp2-server.c +++ b/lib/sbi/nghttp2-server.c @@ -330,11 +330,6 @@ static int verify_callback(int preverify_ok, X509_STORE_CTX *ctx) if (!preverify_ok) { int err = X509_STORE_CTX_get_error(ctx); int depth = X509_STORE_CTX_get_error_depth(ctx); - if (err == X509_V_ERR_CERT_HAS_EXPIRED && depth == 0) { - ogs_error("The client certificate has expired, but is accepted by " - "configuration"); - return 1; - } ogs_error("client certificate verify error:num=%d:%s:depth=%d", err, X509_verify_cert_error_string(err), depth); }