From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Wed, 14 Mar 2018 08:04:47 +0000 (+0000)
Subject: Add DER as an alias for ASN1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2c8b934d779c6a0646cecf2cc8e965ad2bf6474b;p=thirdparty%2Ffreeradius-server.git

Add DER as an alias for ASN1
---

diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index a6c689622e6..bd1797109d4 100644
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -170,8 +170,9 @@ eap {
 		certificate {
 			#
 			#  The format of the certificate and private key file may be one of
-			#  PEM or ASN1.  If PEM format is used a complete certificate chain
-			#  may be provided in the 'certificate_file'.
+			#  PEM, DER or ASN1 (ASN1 is an alias for DER).
+			#  If PEM format is used a complete certificate chain may be provided
+			#  in the 'certificate_file'.
 			#
 #			format = "PEM"
 
diff --git a/src/lib/tls/conf.c b/src/lib/tls/conf.c
index 7fc2452f3d2..954529542f0 100644
--- a/src/lib/tls/conf.c
+++ b/src/lib/tls/conf.c
@@ -45,6 +45,7 @@ USES_APPLE_DEPRECATED_API	/* OpenSSL API has been deprecated by Apple */
 const FR_NAME_NUMBER certificate_format_table[] = {
 	{ "PEM",	SSL_FILETYPE_PEM	},
 	{ "ASN1",	SSL_FILETYPE_ASN1	},
+	{ "DER",	SSL_FILETYPE_ASN1	},	/* Alternate name for ASN1 */
 
 	{ NULL,		0			},
 };
diff --git a/src/lib/tls/ctx.c b/src/lib/tls/ctx.c
index f6b78cc9aa9..ec6c0104d34 100644
--- a/src/lib/tls/ctx.c
+++ b/src/lib/tls/ctx.c
@@ -300,6 +300,14 @@ SSL_CTX *tls_ctx_alloc(fr_tls_conf_t const *conf, bool client)
 			return NULL;
 		}
 	}
+
+	/*
+	 *	Sets the list of CAs we send to the peer if we're
+	 *	requesting a certificate.
+	 *
+	 *	This does not change the trusted certificate authorities,
+	 *	those are set above with SSL_CTX_load_verify_locations.
+	 */
 	if (conf->ca_file && *conf->ca_file) SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(conf->ca_file));
 
 #ifdef PSK_MAX_IDENTITY_LEN