allow TLS-Session-Cert-File to be set

diff --git a/src/main/tls.c b/src/main/tls.c
index 7343b43c134d2a58993837c6199e22262b00fb9d..9e72a50d255cd1db6c02201169f46fb15cd0dd29 100644 (file)
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -709,6 +709,43 @@ tls_session_t *tls_new_session(TALLOC_CTX *ctx, fr_tls_server_conf_t *conf, REQU
        SSL_set_msg_callback_arg(new_tls, state);
        SSL_set_info_callback(new_tls, cbtls_info);
 
+       /*
+        *      Allow policies to load context-specific certificate chains.
+        */
+       vp = fr_pair_find_by_num(request->config, PW_TLS_SESSION_CERT_FILE, 0, TAG_ANY);
+       if (vp) {
+               RDEBUG2("(TLS) Loading session certificate file \"%s\"", vp->vp_strvalue);
+
+               if (SSL_use_certificate_file(state->ssl, vp->vp_strvalue, SSL_FILETYPE_PEM) != 1) {
+                       tls_error_log(request, "Failed loading TLS session certificate \"%s\"",
+                                     vp->vp_strvalue);
+               error:
+                       talloc_free(state);
+                       return NULL;
+               }
+
+               /*
+                *      Note that there is either no password, or it
+                *      has to be the same as what's in the
+                *      configuration.
+                *
+                *      There is just no additional security to
+                *      putting a password into the same file system
+                *      as the private key.
+                */
+               if (SSL_use_PrivateKey_file(state->ssl, vp->vp_strvalue, SSL_FILETYPE_PEM) != 1) {
+                       tls_error_log(request, "Failed loading TLS session certificate \"%s\"",
+                                     vp->vp_strvalue);
+                       goto error;
+               }
+
+               if (SSL_check_private_key(state->ssl) != 1) {
+                       tls_error_log(request, "Failed validating TLS session certificate \"%s\"",
+                                     vp->vp_strvalue);
+                       goto error;
+               }
+       }
+
        /*
         *      In Server mode we only accept.
         */