BUG/MINOR: ssl: ssl-skip-self-issued-ca requires >= 1.0.2

The previous fix for ssl-skip-self-issued-ca requires the use of
SSL_CTX_build_cert_chain() which is only available starting from OpenSSL
1.0.2

diff --git a/doc/configuration.txt b/doc/configuration.txt
index 98ec9393c3fd7a73100cb6beaf4e05468e13466d..b6de695d1cd94ac919ce0fa090411c997eb68376 100644 (file)
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -1426,7 +1426,7 @@ ssl-skip-self-issued-ca
   issuer for ocsp without the need for '.issuer' file and be able to share it
   with 'issuers-chain-path'. This concerns all certificates without intermediate
   certificates. It's useless for BoringSSL, .issuer is ignored because ocsp
-  bits does not need it.
+  bits does not need it. Requires at least OpenSSL 1.0.2.
 
 stats socket [<address:port>|<path>] [param*]
   Binds a UNIX socket to <path> or a TCPv4/v6 address to <address:port>.

diff --git a/src/cfgparse-ssl.c b/src/cfgparse-ssl.c
index 060be5ab42bae012a17c63dc184f97cdfb53f749..d22ae96fb3a92b7f35c1dca04c74eca47c78f28f 100644 (file)
--- a/src/cfgparse-ssl.c
+++ b/src/cfgparse-ssl.c
@@ -1698,8 +1698,13 @@ static int ssl_parse_skip_self_issued_ca(char **args, int section_type, struct p
                                         struct proxy *defpx, const char *file, int line,
                                         char **err)
 {
+#ifdef SSL_CTX_build_cert_chain
        global_ssl.skip_self_issued_ca = 1;
        return 0;
+#else
+       memprintf(err, "global statement '%s' requires at least OpenSSL 1.0.2.", args[0]);
+       return -1;
+#endif
 }
 
 

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 0f4eabb34b34605e1dd72b2f5b90c4f1855644b4..f8001c5926b21f16732a0744369580e3f9251015 100644 (file)
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -3011,6 +3011,7 @@ static int ssl_sock_put_ckch_into_ctx(const char *path, const struct cert_key_an
        }
 #endif
 
+#ifdef SSL_CTX_build_cert_chain
        /* remove the Root CA from the SSL_CTX if the option is activated */
        if (global_ssl.skip_self_issued_ca) {
                if (!SSL_CTX_build_cert_chain(ctx, SSL_BUILD_CHAIN_FLAG_NO_ROOT|SSL_BUILD_CHAIN_FLAG_UNTRUSTED|SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR)) {
@@ -3020,6 +3021,7 @@ static int ssl_sock_put_ckch_into_ctx(const char *path, const struct cert_key_an
                        goto end;
                }
        }
+#endif
 
 #ifndef OPENSSL_NO_DH
        /* store a NULL pointer to indicate we have not yet loaded