Hi,

I am encountering an issue when performing a git clone of a repository
hosted on a server using OCSP and that returns multiple OCSP responses.

Note that I have reproduced this using a bare metal installation of Debian
12.9 and 12.10 and from WSL2 installations of 12.9 and 12.10.

There is a documented defect in GnuTLS that indicated that it would fail
under the circumstance documented above.

This defect was fixed in GnuTLS 3.8.8 in commit:
https://github.com/gnutls/gnutls/commit/ae404fe8488dee424876b5963c00d7e041672415

testing and sid contain GnuTLS 3.8.9 at the time of this submission.

Without addressing this concern, the only available workaround is to
disable TLS verification during any http operation where the OCSP response
will contain multiple entries. This is not a secure workaround.

I am requesting that GnuTLS 3.8.8 or later from testing/sid be backported to
bookworm in order to resolve the issue without requiring users to disable
TLS verification.

Additional information may be available in a similar ticket submitted against
Ubuntu (https://bugs.launchpad.net/ubuntu/+source/gnutls28/+bug/2102115)

Thanks.