You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficserver.apache.org by zw...@apache.org on 2019/10/05 21:16:29 UTC
[trafficserver] branch master updated: Turn on certificate
verification, in permissive mode for now
This is an automated email from the ASF dual-hosted git repository.
zwoop pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
The following commit(s) were added to refs/heads/master by this push:
new 0498218 Turn on certificate verification, in permissive mode for now
0498218 is described below
commit 04982180df1de9996e9df207bae37ba200882096
Author: Leif Hedstrom <zw...@apache.org>
AuthorDate: Tue Sep 24 11:30:38 2019 -0600
Turn on certificate verification, in permissive mode for now
---
configs/records.config.default.in | 2 +-
doc/admin-guide/files/records.config.en.rst | 2 +-
mgmt/RecordsConfig.cc | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/configs/records.config.default.in b/configs/records.config.default.in
index 61028b0..df417bc 100644
--- a/configs/records.config.default.in
+++ b/configs/records.config.default.in
@@ -163,7 +163,7 @@ CONFIG proxy.config.reverse_proxy.enabled INT 1
# https://docs.trafficserver.apache.org/records.config#client-related-configuration
# https://docs.trafficserver.apache.org/en/latest/admin-guide/files/ssl_multicert.config.en.html
##############################################################################
-CONFIG proxy.config.ssl.client.verify.server.policy STRING DISABLED
+CONFIG proxy.config.ssl.client.verify.server.policy STRING PERMISSIVE
CONFIG proxy.config.ssl.client.verify.server.properties STRING ALL
CONFIG proxy.config.ssl.client.CA.cert.filename STRING NULL
CONFIG proxy.config.ssl.server.cipher_suite STRING ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES [...]
diff --git a/doc/admin-guide/files/records.config.en.rst b/doc/admin-guide/files/records.config.en.rst
index e4d94c6..c8284d5 100644
--- a/doc/admin-guide/files/records.config.en.rst
+++ b/doc/admin-guide/files/records.config.en.rst
@@ -3349,7 +3349,7 @@ SSL Termination
Client-Related Configuration
----------------------------
-.. ts:cv:: CONFIG proxy.config.ssl.client.verify.server.policy STRING DISABLED
+.. ts:cv:: CONFIG proxy.config.ssl.client.verify.server.policy STRING PERMISSIVE
:reloadable:
:overridable:
diff --git a/mgmt/RecordsConfig.cc b/mgmt/RecordsConfig.cc
index 71214fb..92adf0f 100644
--- a/mgmt/RecordsConfig.cc
+++ b/mgmt/RecordsConfig.cc
@@ -1098,7 +1098,7 @@ static const RecordElement RecordsConfig[] =
,
{RECT_CONFIG, "proxy.config.ssl.client.verify.server", RECD_INT, "0", RECU_DYNAMIC, RR_NULL, RECC_INT, "[0-2]", RECA_NULL}
,
- {RECT_CONFIG, "proxy.config.ssl.client.verify.server.policy", RECD_STRING, "DISABLED", RECU_DYNAMIC, RR_NULL, RECC_NULL, nullptr, RECA_NULL}
+ {RECT_CONFIG, "proxy.config.ssl.client.verify.server.policy", RECD_STRING, "PERMISSIVE", RECU_DYNAMIC, RR_NULL, RECC_NULL, nullptr, RECA_NULL}
,
{RECT_CONFIG, "proxy.config.ssl.client.verify.server.properties", RECD_STRING, "ALL", RECU_DYNAMIC, RR_NULL, RECC_NULL, nullptr, RECA_NULL}
,