]> git.ipfire.org Git - thirdparty/squid.git/commit
Preserve configured order of intermediate CA certificate chain (#956)
authorAlex Rousskov <rousskov@measurement-factory.com>
Mon, 10 Jan 2022 10:46:26 +0000 (10:46 +0000)
committerSquid Anubis <squid-anubis@squid-cache.org>
Mon, 10 Jan 2022 10:46:29 +0000 (10:46 +0000)
commit166fb918211b76a0e79eb07967f4d092f74ea18d
tree36f05d853db546bec2ee7c683d38c90693d89383
parent82fe21f8e1f0ecc97ad3540f1436ec0fb32d2538
Preserve configured order of intermediate CA certificate chain (#956)

    https_port ... tls-cert=signing,itsIssuer,itsIssuerIssuer.pem

The order was reversed in commit cf48712, probably by accident. Wrong
order violates TLS protocol and breaks TLS clients that are incapable of
reordering received intermediate CAs. Squid deployments that use
wrong-order bundles (to compensate for this bug) should reorder their
bundles when deploying this fix (or wait for Squid to order certificates
correctly, regardless of the bundle order -- a work in progress).

This is a Measurement Factory project.
src/security/KeyData.cc