[GitHub] [trafficserver] serrislew commented on a diff in pull request #9230: Fail out when intermediate certificate chain fails to load

[GitBox <gi...@apache.org>]

serrislew commented on code in PR #9230:
URL: https://github.com/apache/trafficserver/pull/9230#discussion_r1042539848


##########
iocore/net/SSLUtils.cc:
##########
@@ -2445,6 +2445,8 @@ SSLMultiCertConfigLoader::load_certs(SSL_CTX *ctx, const std::vector<std::string
     // Load up any additional chain certificates
     if (!SSL_CTX_add_extra_chain_cert_bio(ctx, bio.get())) {
       Debug("ssl", "couldn't add chain to %p", ctx);
+      SSLError("failed to load intermediate certificate chain from %s", cert_names_list[i].c_str());
+      return false;

Review Comment:
   This error handling replicates the behavior of all other errors (i.e. `secret_data.empty()` and when cert fails to load certificate chain). Similar to those, it should exit out of that function immediately



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org