--- ./sm/certlist.c_org	2023-07-24 03:41:06.033554227 +0000
+++ ./sm/certlist.c	2023-07-24 03:44:27.700588437 +0000
@@ -158,10 +158,10 @@
 
   if (mode == USE_MODE_OCSP)
     {
-      if (use != ~0
-          && (have_ocsp_signing
-              || (use & (KSBA_KEYUSAGE_KEY_CERT_SIGN
-                         |KSBA_KEYUSAGE_CRL_SIGN))))
+      if (have_ocsp_signing
+          || (use & (KSBA_KEYUSAGE_KEY_CERT_SIGN
+                     |KSBA_KEYUSAGE_CRL_SIGN)))
+
         return 0;
       if (!silent)
         log_info (_("certificate should not have "