www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2025-08-08 15:02:10 +03:00
Code Activity

in case there is actually a cert chain in the cache, we should be

Browse Source 
using the value of SSL_get_peer_certificate(ssl) to verify as it will
have been removed from the chain before it was put in the cache.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@95603 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Doug MacEachern
2002-06-11 03:45:54 +00:00
parent db7a29e3b7
commit 295e115b4a
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
modules/ssl/ssl_engine_kernel.c
View File

@@ -710,7 +710,9 @@ int ssl_hook_Access(request_rec *r)
cert_stack = (STACK_OF(X509) *)SSL_get_peer_cert_chain(ssl);
if (!cert_stack && (cert = SSL_get_peer_certificate(ssl))) {
cert = SSL_get_peer_certificate(ssl);
if (!cert_stack && cert) {
/* client cert is in the session cache, but there is
* no chain, since ssl3_get_client_certificate()
* sk_X509_shift-ed the peer cert out of the chain.
@@ -736,7 +738,10 @@ int ssl_hook_Access(request_rec *r)
return HTTP_FORBIDDEN;
}
cert = sk_X509_value(cert_stack, 0);
if (!cert) {
cert = sk_X509_value(cert_stack, 0);
}
X509_STORE_CTX_init(&cert_store_ctx, cert_store, cert, cert_stack);
depth = SSL_get_verify_depth(ssl);