From ce6065306c2e750251f9c06656b6e9f34fc5c29d Mon Sep 17 00:00:00 2001 From: Kaspar Brand Date: Fri, 18 Apr 2014 09:07:19 +0000 Subject: [PATCH] Also clear the error queue before calling SSL_CTX_use_certificate[_chain]_file (workaround for OpenSSL versions before 0.9.8h, see https://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=1513). PR 56410. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1588427 13f79535-47bb-0310-9956-ffa450edef68 --- CHANGES | 4 ++++ modules/ssl/ssl_engine_init.c | 2 ++ 2 files changed, 6 insertions(+) diff --git a/CHANGES b/CHANGES index 71b2c25b55e..25072b8650f 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,10 @@ -*- coding: utf-8 -*- Changes with Apache 2.5.0 + *) mod_ssl: add workaround for SSLCertificateFile when using OpenSSL + versions before 0.9.8h and not specifying an SSLCertificateChainFile + (regression introduced with 2.4.8). PR 56410. [Kaspar Brand] + *) mod_remoteip: Prevent an external proxy from presenting an internal proxy. PR 55962. [Mike Rumph] diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c index 2aef8d6f79a..e4f234630e9 100644 --- a/modules/ssl/ssl_engine_init.c +++ b/modules/ssl/ssl_engine_init.c @@ -913,6 +913,8 @@ static apr_status_t ssl_init_server_certs(server_rec *s, i++) { key_id = apr_psprintf(ptemp, "%s:%d", vhost_id, i); + ERR_clear_error(); + /* first the certificate (public key) */ if (mctx->cert_chain) { if ((SSL_CTX_use_certificate_file(mctx->ssl_ctx, certfile, -- 2.47.3