BUG/MINOR: ssl: load .key in a directory only after PEM

Don't try to load a .key in a directory without loading its associated
certificate file.

This patch ignores the .key files when iterating over the files in a
directory.

Introduced by 4c5adbf ("MINOR: ssl: load the key from a dedicated
file").

diff --git a/doc/configuration.txt b/doc/configuration.txt
index 61c7d5cea020e9509a76a90f9b57194ddee5f8d9..c20311d3decd343b8a91ca70a0ef97fe05d9f206 100644 (file)
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -11341,13 +11341,13 @@ crt <cert>
   are loaded.
 
   If a directory name is used instead of a PEM file, then all files found in
-  that directory will be loaded in alphabetic order unless their name ends with
-  '.issuer', '.ocsp' or '.sctl' (reserved extensions). This directive may be
-  specified multiple times in order to load certificates from multiple files or
-  directories. The certificates will be presented to clients who provide a
-  valid TLS Server Name Indication field matching one of their CN or alt
-  subjects. Wildcards are supported, where a wildcard character '*' is used
-  instead of the first hostname component (e.g. *.example.org matches
+  that directory will be loaded in alphabetic order unless their name ends
+  with '.key', '.issuer', '.ocsp' or '.sctl' (reserved extensions). This
+  directive may be specified multiple times in order to load certificates from
+  multiple files or directories. The certificates will be presented to clients
+  who provide a valid TLS Server Name Indication field matching one of their
+  CN or alt subjects. Wildcards are supported, where a wildcard character '*'
+  is used instead of the first hostname component (e.g. *.example.org matches
   www.example.org but not www.sub.example.org).
 
   If no SNI is provided by the client or if the SSL library does not support

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 1b3cf55ab5d9443a08b108190db6b13763eb7f0c..22985d5b346541b6bbe45497bc31620b95648b78 100644 (file)
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -4416,7 +4416,7 @@ int ssl_sock_load_cert(char *path, struct bind_conf *bind_conf, char **err)
                                struct dirent *de = de_list[i];
 
                                end = strrchr(de->d_name, '.');
-                               if (end && (!strcmp(end, ".issuer") || !strcmp(end, ".ocsp") || !strcmp(end, ".sctl")))
+                               if (end && (!strcmp(end, ".issuer") || !strcmp(end, ".ocsp") || !strcmp(end, ".sctl") || !strcmp(end, ".key")))
                                        goto ignore_entry;
 
                                snprintf(fp, sizeof(fp), "%s/%s", path, de->d_name);