]> git.ipfire.org Git - thirdparty/squid.git/commit
Complete certificate chains using external intermediate certificates
authorChristos Tsantilas <chtsanti@users.sourceforge.net>
Fri, 18 Dec 2015 11:11:53 +0000 (00:11 +1300)
committerAmos Jeffries <squid3@treenet.co.nz>
Fri, 18 Dec 2015 11:11:53 +0000 (00:11 +1300)
commitc398aa3f300160944d8681e674aa41ad65fd1e08
tree7eaa2a67a9e6b1339bcdf5c72c043f19a979376b
parent7ef5d4d2f0479e5ade3b82eb1832f9d0d8e1d525
Complete certificate chains using external intermediate certificates

 ... stored in sslproxy_foreign_intermediate_certs PEM file.

Many origin servers do not send complete certificate chains. Many
browsers use certificate extensions in the server certificate to
download the missing intermediate certificates automatically from
the Internet. Squid does not do that (yet?).

This patch adds the sslproxy_foreign_intermediate_certs configuration directive
to allow an admin to supply a file with intermediate certificates that
Squid may use to complete certificate chains. These intermediate
certificates are _not_ treated as trusted root certificates.

This is a Measurement Factory project.
doc/release-notes/release-3.5.sgml
src/SquidConfig.h
src/cache_cf.cc
src/cf.data.pre
src/ssl/support.cc
src/ssl/support.h