diff --git a/src/libraries/Native/Unix/System.Security.Cryptography.Native/opensslshim.h b/src/libraries/Native/Unix/System.Security.Cryptography.Native/opensslshim.h index 050df1193ff021..1524a427b296c4 100644 --- a/src/libraries/Native/Unix/System.Security.Cryptography.Native/opensslshim.h +++ b/src/libraries/Native/Unix/System.Security.Cryptography.Native/opensslshim.h @@ -408,7 +408,6 @@ const EVP_CIPHER* EVP_chacha20_poly1305(void); REQUIRED_FUNCTION(OCSP_cert_to_id) \ REQUIRED_FUNCTION(OCSP_check_nonce) \ REQUIRED_FUNCTION(OCSP_request_add0_id) \ - REQUIRED_FUNCTION(OCSP_request_add1_nonce) \ REQUIRED_FUNCTION(OCSP_REQUEST_free) \ REQUIRED_FUNCTION(OCSP_REQUEST_new) \ REQUIRED_FUNCTION(OCSP_resp_find_status) \ @@ -863,7 +862,6 @@ FOR_ALL_OPENSSL_FUNCTIONS #define OCSP_check_nonce OCSP_check_nonce_ptr #define OCSP_CERTID_free OCSP_CERTID_free_ptr #define OCSP_request_add0_id OCSP_request_add0_id_ptr -#define OCSP_request_add1_nonce OCSP_request_add1_nonce_ptr #define OCSP_REQUEST_free OCSP_REQUEST_free_ptr #define OCSP_REQUEST_new OCSP_REQUEST_new_ptr #define OCSP_resp_find_status OCSP_resp_find_status_ptr diff --git a/src/libraries/Native/Unix/System.Security.Cryptography.Native/pal_x509.c b/src/libraries/Native/Unix/System.Security.Cryptography.Native/pal_x509.c index 54f1482e6ec2ef..d0bb424f004477 100644 --- a/src/libraries/Native/Unix/System.Security.Cryptography.Native/pal_x509.c +++ b/src/libraries/Native/Unix/System.Security.Cryptography.Native/pal_x509.c @@ -875,7 +875,8 @@ static X509VerifyStatusCode CheckOcsp(OCSP_REQUEST* req, int nonceCheck = req == NULL ? 1 : OCSP_check_nonce(req, basicResp); // Treat "response has no nonce" as success, since not all responders set the nonce. - if (nonceCheck == -1) + // Treat "neither has a nonce" as success, since we do not send nonces in our requests. + if (nonceCheck == -1 || nonceCheck == 2) { nonceCheck = 1; } @@ -1074,8 +1075,9 @@ OCSP_REQUEST* CryptoNative_X509ChainBuildOcspRequest(X509_STORE_CTX* storeCtx, i // Ownership was successfully transferred to req certId = NULL; - // Add a random nonce. - OCSP_request_add1_nonce(req, NULL, -1); + // We return the request without setting a nonce on it. Most public CA OCSP responders ignore the nonce, and in some + // cases flat out error when presented with a nonce. + // This behavior also matches Windows and Apple platforms. return req; }