From: Aki Tuomi <aki.tuomi@dovecot.fi>
Date: Fri, 3 Nov 2017 15:28:57 +0000 (+0200)
Subject: lib-ssl-iostream: Fix alt cert support
X-Git-Tag: 2.3.0.rc1~588
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a6366f3b2ccb3fb2f871a42b23ff2833309d8794;p=thirdparty%2Fdovecot%2Fcore.git

lib-ssl-iostream: Fix alt cert support

It was only partially implemented in 0577701d04beea222fc49a7318851ddcea3b99d3
---

diff --git a/src/lib-ssl-iostream/iostream-openssl-context.c b/src/lib-ssl-iostream/iostream-openssl-context.c
index ef8c70615f..17a995ab44 100644
--- a/src/lib-ssl-iostream/iostream-openssl-context.c
+++ b/src/lib-ssl-iostream/iostream-openssl-context.c
@@ -392,6 +392,16 @@ ssl_iostream_context_set(struct ssl_iostream_context *ctx,
 		if (ssl_iostream_ctx_use_key(ctx, &set->cert, error_r) < 0)
 			return -1;
 	}
+	if (set->alt_cert.cert != NULL &&
+	    ssl_ctx_use_certificate_chain(ctx->ssl_ctx, set->alt_cert.cert) == 0) {
+		*error_r = t_strdup_printf("Can't load alternative SSL certificate: %s",
+			openssl_iostream_use_certificate_error(set->alt_cert.cert, NULL));
+		return -1;
+	}
+	if (set->alt_cert.key != NULL) {
+		if (ssl_iostream_ctx_use_key(ctx, &set->alt_cert, error_r) < 0)
+			return -1;
+	}
 
 	if (set->dh != NULL) {
 		if (ssl_iostream_ctx_use_dh(ctx, set, error_r) < 0)