You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficserver.apache.org by jp...@apache.org on 2014/08/22 22:01:49 UTC
[1/2] git commit: TS-3027: add hashed intermediate certificate support
Repository: trafficserver
Updated Branches:
refs/heads/master ba1c77c26 -> 99fabae49
TS-3027: add hashed intermediate certificate support
if ssl_ca_name= is configured in ssl_multicert.config
use that to build the cert chain
else if proxy.config.ssl.CA.cert.filename is configured (along with proxy.config.ssl.CA.cert.path)
use that file to build the chain
else if proxy.config.ssl.CA.cert.path is configured (and proxy.config.ssl.CA.cert.filename is NULL)
use the hashed symlinks in that directory to build the chain
else
error out because we don't have the right configuration to build the chain
Project: http://git-wip-us.apache.org/repos/asf/trafficserver/repo
Commit: http://git-wip-us.apache.org/repos/asf/trafficserver/commit/5b1b1e06
Tree: http://git-wip-us.apache.org/repos/asf/trafficserver/tree/5b1b1e06
Diff: http://git-wip-us.apache.org/repos/asf/trafficserver/diff/5b1b1e06
Branch: refs/heads/master
Commit: 5b1b1e06755029e0bbb41a1000124dd356d14bde
Parents: ba1c77c
Author: Steven Feltner <st...@gmail.com>
Authored: Fri Aug 22 12:54:29 2014 -0700
Committer: James Peach <jp...@apache.org>
Committed: Fri Aug 22 12:54:29 2014 -0700
----------------------------------------------------------------------
iocore/net/SSLUtils.cc | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/trafficserver/blob/5b1b1e06/iocore/net/SSLUtils.cc
----------------------------------------------------------------------
diff --git a/iocore/net/SSLUtils.cc b/iocore/net/SSLUtils.cc
index 0d85a49..9992ac2 100644
--- a/iocore/net/SSLUtils.cc
+++ b/iocore/net/SSLUtils.cc
@@ -1069,6 +1069,27 @@ SSLInitServerContext(
goto fail;
}
}
+
+ // SSL_CTX_load_verify_locations() builds the cert chain from the
+ // serverCACertFilename if that is not NULL. Otherwise, it uses the hashed
+ // symlinks in serverCACertPath.
+ //
+ // if ssl_ca_name is NOT configured for this cert in ssl_multicert.config
+ // AND
+ // if proxy.config.ssl.CA.cert.filename and proxy.config.ssl.CA.cert.path
+ // are configured
+ // pass that file as the chain (include all certs in that file)
+ // else if proxy.config.ssl.CA.cert.path is configured (and
+ // proxy.config.ssl.CA.cert.filename is NULL)
+ // use the hashed symlinks in that directory to build the chain
+ if (!sslMultCertSettings.ca && params->serverCACertPath != NULL) {
+ if ((!SSL_CTX_load_verify_locations(ctx, params->serverCACertFilename, params->serverCACertPath)) ||
+ (!SSL_CTX_set_default_verify_paths(ctx))) {
+ SSLError("invalid CA Certificate file or CA Certificate path");
+ goto fail;
+ }
+ }
+
if (params->clientCertLevel != 0) {
if (params->serverCACertFilename != NULL && params->serverCACertPath != NULL) {
[2/2] git commit: Add TS-3027 to CHANGES
Posted by jp...@apache.org.
Add TS-3027 to CHANGES
Project: http://git-wip-us.apache.org/repos/asf/trafficserver/repo
Commit: http://git-wip-us.apache.org/repos/asf/trafficserver/commit/99fabae4
Tree: http://git-wip-us.apache.org/repos/asf/trafficserver/tree/99fabae4
Diff: http://git-wip-us.apache.org/repos/asf/trafficserver/diff/99fabae4
Branch: refs/heads/master
Commit: 99fabae491897a3aa1005a77d70b6b3ed0b75287
Parents: 5b1b1e0
Author: James Peach <jp...@apache.org>
Authored: Fri Aug 22 13:01:48 2014 -0700
Committer: James Peach <jp...@apache.org>
Committed: Fri Aug 22 13:01:48 2014 -0700
----------------------------------------------------------------------
CHANGES | 3 +++
1 file changed, 3 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/trafficserver/blob/99fabae4/CHANGES
----------------------------------------------------------------------
diff --git a/CHANGES b/CHANGES
index ae0017a..39b3fd6 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
-*- coding: utf-8 -*-
Changes with Apache Traffic Server 5.2.0
+ *) [TS-3027] Add hashed intermediate SSL certificate support.
+ Author: Steven Feltner <st...@gmail.com>
+
*) [TS-2970] Fix assertions with transparent pass through.
Author: Susan Hinrichs <sh...@network-geographics.com>