]> git.ipfire.org Git - thirdparty/squid.git/commit
Bug 5189: Preserve configured order of intermediate CA certificate chain (#956)
authorAlex Rousskov <rousskov@measurement-factory.com>
Mon, 10 Jan 2022 10:46:26 +0000 (10:46 +0000)
committerAmos Jeffries <yadij@users.noreply.github.com>
Mon, 24 Jan 2022 16:33:09 +0000 (05:33 +1300)
commit372aa0ceac1ca491ccdb5c9721f9fff39071bb3c
treecb01fc22bbee75c1873620d3e9367b83efb3bc72
parent7af95ee426c3caacb6f14ecf225f3b56af5c149f
Bug 5189: Preserve configured order of intermediate CA certificate chain (#956)

    https_port ... tls-cert=signing,itsIssuer,itsIssuerIssuer.pem

The order was reversed in commit cf48712, probably by accident. Wrong
order violates TLS protocol and breaks TLS clients that are incapable of
reordering received intermediate CAs. Squid deployments that use
wrong-order bundles (to compensate for this bug) should reorder their
bundles when deploying this fix (or wait for Squid to order certificates
correctly, regardless of the bundle order -- a work in progress).

This is a Measurement Factory project.
src/security/KeyData.cc