Clarify CLI OCSP documentation

This fixes issue #3043, which ultimately was reported because
documentation was not clear on the meaning of the "-ignore_err" option.
Update both command line documentation and add this option to manpage.

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4143)

diff --git a/apps/ocsp.c b/apps/ocsp.c
index 0b938328d42a76d6d7d975af0178defd9f85455b..3e1201ff738143e78ffb6e21bbcd6824311a2cb4 100644 (file)
--- a/apps/ocsp.c
+++ b/apps/ocsp.c
@@ -108,7 +108,7 @@ const OPTIONS ocsp_options[] = {
     {"host", OPT_HOST, 's', "TCP/IP hostname:port to connect to"},
     {"port", OPT_PORT, 'p', "Port to run responder on"},
     {"ignore_err", OPT_IGNORE_ERR, '-',
-     "Ignore Error response from OCSP responder, and retry "},
+     "Ignore error on OCSP request or response and continue running"},
     {"noverify", OPT_NOVERIFY, '-', "Don't verify response at all"},
     {"nonce", OPT_NONCE, '-', "Add OCSP nonce to request"},
     {"no_nonce", OPT_NO_NONCE, '-', "Don't add OCSP nonce to request"},

diff --git a/doc/man1/ocsp.pod b/doc/man1/ocsp.pod
index 058462f3183743237754e75d78eab643ff1ae9eb..42621df336754c482d2ebebb9de54439b50525e2 100644 (file)
--- a/doc/man1/ocsp.pod
+++ b/doc/man1/ocsp.pod
@@ -74,6 +74,7 @@ B<openssl> B<ocsp>
 [B<-no_cert_checks>]
 [B<-no_explicit>]
 [B<-port num>]
+[B<-ignore_err>]
 [B<-index file>]
 [B<-CA file>]
 [B<-rsigner file>]
@@ -343,6 +344,12 @@ specified in the B<rsigner> option is used.
 Port to listen for OCSP requests on. The port may also be specified
 using the B<url> option.
 
+=item B<-ignore_err>
+
+Ignore malformed requests or responses: When acting as an OCSP client, retry if
+a malformed response is received. When acting as an OCSP responder, continue
+running instead of terminating upon receiving a malformed request.
+
 =item B<-nrequest number>
 
 The OCSP server will exit after receiving B<number> requests, default unlimited.