Disable auto_chain entirely

It just causes confusion and annoyance

diff --git a/src/lib/tls/conf-h b/src/lib/tls/conf-h
index 4a4f2a8ae43202465616707396c1e90a227234d1..b3a78bd2e15fa28dd55f4e64626e11095ae8bd4d 100644 (file)
--- a/src/lib/tls/conf-h
+++ b/src/lib/tls/conf-h
@@ -143,10 +143,6 @@ struct fr_tls_conf_s {
        uint32_t        verify_depth;                   //!< Maximum number of certificates we can traverse
                                                        //!< when attempting to reach the presented certificate
                                                        //!< from our Root CA.
-       bool            auto_chain;                     //!< Allow OpenSSL to build certificate chains
-                                                       //!< from all certificates it has available.
-                                                       //!< If false, the complete chain must be provided in
-                                                       //!< certificate file.
        bool            disable_single_dh_use;
 
        float           tls_max_version;                //!< Maximum TLS version allowed.

diff --git a/src/lib/tls/conf.c b/src/lib/tls/conf.c
index b168f8f06236577090fc8bf19e22a521d02c513a..651afab9da91b73fcf522fe16937a0250eabcc49 100644 (file)
--- a/src/lib/tls/conf.c
+++ b/src/lib/tls/conf.c
@@ -152,8 +152,6 @@ static CONF_PARSER tls_verify_config[] = {
 CONF_PARSER fr_tls_server_config[] = {
        { FR_CONF_OFFSET("virtual_server", FR_TYPE_VOID, fr_tls_conf_t, virtual_server), .func = virtual_server_cf_parse },
 
-       { FR_CONF_OFFSET("auto_chain", FR_TYPE_BOOL, fr_tls_conf_t, auto_chain), .dflt = "yes" },
-
        { FR_CONF_OFFSET("chain", FR_TYPE_SUBSECTION | FR_TYPE_MULTI, fr_tls_conf_t, chains),
          .subcs_size = sizeof(fr_tls_chain_conf_t), .subcs_type = "fr_tls_chain_conf_t",
          .subcs = tls_chain_config, .ident2 = CF_IDENT_ANY },

diff --git a/src/lib/tls/ctx.c b/src/lib/tls/ctx.c
index 9978cd301efb0bf52ebf5bd309efdecd50eb22f9..6b469f482da3f9332ee9164160227b1927f16048 100644 (file)
--- a/src/lib/tls/ctx.c
+++ b/src/lib/tls/ctx.c
@@ -719,8 +719,11 @@ SSL_CTX *fr_tls_ctx_alloc(fr_tls_conf_t const *conf, bool client)
                 *      unless we tell it to not do that.  The problem is that
                 *      it sometimes gets the chains right from a certificate
                 *      signature view, but wrong from the clients view.
+                *
+                *      It's better just to have users specify the complete
+                *      chains.
                 */
-               if (!conf->auto_chain) mode |= SSL_MODE_NO_AUTO_CHAIN;
+               mode |= SSL_MODE_NO_AUTO_CHAIN;
 
                if (client) {
                        mode |= SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER;