Description of problem:
When SSLOCSPEnable is not set and a backend server certificate has OCSP URI in AIA:

# openssl x509 -text -in /certs/newcert.pem | less
       ...
            Authority Information Access: 
                OCSP - URI:http://ocsp.hogesystems.com

OCSP access happens. If a proxy/httpd can not resolve the hostname. The error message appears in error_log:

[Wed Jun 26 05:47:41.650839 2019] [ssl:error] [pid 5054] (EAI 2)Name or service not known: [remote ::1:443] AH01972: could not resolve address of OCSP responde
r ocsp.hogesystems.com


Version-Release number of selected component (if applicable):

mod_ssl-2.4.6-89.el7_6.x86_64
httpd-2.4.6-89.el7_6.x86_64

How reproducible:


Steps to Reproduce:
1. install httpd and mod_ssl-2.4.6-89.el7_6
2. untar untar.tgz

# cd /
# tar xvf untar.tgz

3. restart httpd
4. curl http://localhost/proxy/

Actual results:
OCSP access is done.

Expected results:
OCSP access is not done.

Additional info:

This issue is caused by the code change http://pkgs.devel.redhat.com/cgit/rpms/httpd/commit/?h=rhel-7.6&id=570d29014d0f53ed9670069d2d8bcfc4d187a279 as a fix for BZ https://bugzilla.redhat.com/show_bug.cgi?id=1548501

If SSLOCSPEnable is not set, sc->server->ocsp_mask is "UNSET" = (-1) in ssl_callback_SSLVerify. -1 is 11111111111111111111111111111111 in binary:

(gdb) frame
#4  0x00007fbf5b3fc22f in ssl_callback_SSLVerify (ok=<optimized out>, ctx=0x7ffdff7b27e0) at ssl_engine_kernel.c:1433
/usr/src/debug/httpd-2.4.6/modules/ssl/ssl_engine_kernel.c:1433:53438:beg:0x7fbf5b3fc22f
(gdb) p/t sc.server.ocsp_mask
$6 = 11111111111111111111111111111111
(gdb) p/t SSL_OCSPCHECK_CHAIN
$7 = 10

Therefore, if ssl_verify_error_is_optional(errnum) == false, OCSP request will be tried at the line 1433 in ssl_engine_kernel.c

1419     if (ok && ((sc->server->ocsp_mask & SSL_OCSPCHECK_CHAIN) ||
1420          (errdepth == 0 && (sc->server->ocsp_mask & SSL_OCSPCHECK_LEAF)))) {
1421         /* If there was an optional verification error, it's not
1422          * possible to perform OCSP validation since the issuer may be
1423          * missing/untrusted.  Fail in that case. */
1424         if (ssl_verify_error_is_optional(errnum)) {
1425             X509_STORE_CTX_set_error(ctx, X509_V_ERR_APPLICATION_VERIFICATION);
1426             errnum = X509_V_ERR_APPLICATION_VERIFICATION;
1427             ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, conn, APLOGNO(02038)
1428                           "cannot perform OCSP validation for cert "
1429                           "if issuer has not been verified "
1430                           "(optional_no_ca configured)");
1431             ok = FALSE;
1432         } else {
1433             ok = modssl_verify_ocsp(ctx, sc, s, conn, conn->pool);
1434             if (!ok) {
1435                 errnum = X509_STORE_CTX_get_error(ctx);
1436             }
1437         }
1438     }


Need a code to set it to SSL_OCSPCHECK_NONE (which should be default) when it is not specified.