ACLFilledChecklist::fd() sets the client, not server connection descriptor.

diff --git a/src/forward.cc b/src/forward.cc
index c5d7d7f61977ac1518f738066642f63ecf354a79..a17daf14de0c70100fe3c8f8f237f75691c8e01d 100644 (file)
--- a/src/forward.cc
+++ b/src/forward.cc
@@ -1013,7 +1013,8 @@ FwdState::initiateSSL()
         // The list is used in ssl_verify_cb() and is freed in ssl_free().
         if (acl_access *acl = Config.ssl_client.cert_error) {
             ACLFilledChecklist *check = new ACLFilledChecklist(acl, request, dash_str);
-            check->fd(fd);
+            if (Comm::IsConnOpen(clientConn))
+                check->fd(clientConn->fd);
             SSL_set_ex_data(ssl, ssl_ex_index_cert_error_check, check);
         }
 #if 1 // USE_SSL_CERT_VALIDATOR