Add DER as an alias for ASN1

diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index a6c689622e630fc0782e3d0c280d081b87819c8b..bd1797109d4cb2918d019148fbf714ed838e1f27 100644 (file)
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -170,8 +170,9 @@ eap {
                certificate {
                        #
                        #  The format of the certificate and private key file may be one of
-                       #  PEM or ASN1.  If PEM format is used a complete certificate chain
-                       #  may be provided in the 'certificate_file'.
+                       #  PEM, DER or ASN1 (ASN1 is an alias for DER).
+                       #  If PEM format is used a complete certificate chain may be provided
+                       #  in the 'certificate_file'.
                        #
 #                      format = "PEM"
 

diff --git a/src/lib/tls/conf.c b/src/lib/tls/conf.c
index 7fc2452f3d231066f16254e79062c5f2d704ca92..954529542f0ae18b3ca79c66cb3b889375a62c36 100644 (file)
--- a/src/lib/tls/conf.c
+++ b/src/lib/tls/conf.c
@@ -45,6 +45,7 @@ USES_APPLE_DEPRECATED_API     /* OpenSSL API has been deprecated by Apple */
 const FR_NAME_NUMBER certificate_format_table[] = {
        { "PEM",        SSL_FILETYPE_PEM        },
        { "ASN1",       SSL_FILETYPE_ASN1       },
+       { "DER",        SSL_FILETYPE_ASN1       },      /* Alternate name for ASN1 */
 
        { NULL,         0                       },
 };

diff --git a/src/lib/tls/ctx.c b/src/lib/tls/ctx.c
index f6b78cc9aa9b3e1766c7f3766aa8f8428777f495..ec6c0104d340794f66b11489774ad922a95336e6 100644 (file)
--- a/src/lib/tls/ctx.c
+++ b/src/lib/tls/ctx.c
@@ -300,6 +300,14 @@ SSL_CTX *tls_ctx_alloc(fr_tls_conf_t const *conf, bool client)
                        return NULL;
                }
        }
+
+       /*
+        *      Sets the list of CAs we send to the peer if we're
+        *      requesting a certificate.
+        *
+        *      This does not change the trusted certificate authorities,
+        *      those are set above with SSL_CTX_load_verify_locations.
+        */
        if (conf->ca_file && *conf->ca_file) SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(conf->ca_file));
 
 #ifdef PSK_MAX_IDENTITY_LEN