]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MEDIUM: ssl: fix the ssl-skip-self-issued-ca option
authorWilliam Lallemand <wlallemand@haproxy.com>
Mon, 10 Aug 2020 14:18:45 +0000 (16:18 +0200)
committerWilliam Lallemand <wlallemand@haproxy.org>
Mon, 10 Aug 2020 15:08:54 +0000 (17:08 +0200)
commitbf298afe2d7eb2c698640bd8d4212d6be6f79782
tree8c6324498b1c23f7b330dd43b9be30d9fd1d05ec
parent477757c66bdb9c8284656762c8558105baed2fea
BUG/MEDIUM: ssl: fix the ssl-skip-self-issued-ca option

In commit f187ce6, the ssl-skip-self-issued-ca option was accidentally
made useless by reverting the SSL_CTX reworking.

The previous attempt of making this feature was putting each certificate
of the chain in the SSL_CTX with SSL_CTX_add_extra_chain_cert() and was
skipping the Root CA.
The problem here is that doing it this way instead of doing a
SSL_CTX_set1_chain() break the support of the multi-certificate bundles.

The SSL_CTX_build_cert_chain() function allows one to remove the Root CA
with the SSL_BUILD_CHAIN_FLAG_NO_ROOT flag. Use it instead of doing
tricks with the CA.

Should fix issue #804.

Must be backported in 2.2.
src/ssl_sock.c