From 0d82f93b68b59ccfcf2bdbc9b73fc5da1d7eb9c7 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@netgate.com>
Date: Mon, 18 Mar 2019 12:47:05 -0400
Subject: [PATCH] Correct OSCP Must-Staple cert check for OpenSSL 1.1.1. Fixes
 #9408

---
 src/etc/inc/certs.inc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/etc/inc/certs.inc b/src/etc/inc/certs.inc
index 5e935c77bb..374332f82a 100644
--- a/src/etc/inc/certs.inc
+++ b/src/etc/inc/certs.inc
@@ -667,7 +667,8 @@ function cert_get_ocspstaple($str_crt, $decode = true) {
 		$str_crt = base64_decode($str_crt);
 	}
 	$crt_details = openssl_x509_parse($str_crt);
-	if (!empty($crt_details['extensions']['1.3.6.1.5.5.7.1.24'])) {
+	if (($crt_details['extensions']['tlsfeature'] == "status_request") ||
+	    !empty($crt_details['extensions']['1.3.6.1.5.5.7.1.24'])) {
 		return true;
 	}
 	return false;