]> git.ipfire.org Git - thirdparty/haproxy.git/commit
MEDIUM: ssl: Added support for creating SSL_CTX with multiple certs
authoryanbzhu <yanbzhu@cisco.com>
Wed, 2 Dec 2015 18:01:29 +0000 (13:01 -0500)
committerWilly Tarreau <w@1wt.eu>
Mon, 14 Dec 2015 10:22:29 +0000 (11:22 +0100)
commit08ce6ab0c9fdad9cca599984b94cb58e63191116
tree2a30a174223644f2cedb25f18de18a3f36db6a81
parent488a4d2e753150f3384df51354a7b662fc018d33
MEDIUM: ssl: Added support for creating SSL_CTX with multiple certs

Added ability for users to specify multiple certificates that all relate
a single server. Users do this by specifying certificate "cert_name.pem"
but having "cert_name.pem.rsa", "cert_name.pem.dsa" and/or
"cert_name.pem.ecdsa" in the directory.

HAProxy will now intelligently search for those 3 files and try combine
them into as few SSL_CTX's as possible based on CN/SAN. This will allow
HAProxy to support multiple ciphersuite key algorithms off a single
SSL_CTX.

This change integrates into the existing architecture of SNI lookup and
multiple SNI's can point to the same SSL_CTX, which can support multiple
key_types.
src/ssl_sock.c