www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2025-08-08 15:02:10 +03:00
Code Activity

Modify SSLProxyMachineCertificateChainFile to use X509 instead of X509_INFO and use openssl to construct the chain

Browse Source 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1170833 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Daniel Ruggeri
2011-09-14 20:16:02 +00:00
parent 63e02b35ac
commit 47cf15b852
6 changed files with 42 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
modules/ssl/ssl_engine_kernel.c
View File

@@ -1588,11 +1588,12 @@ int ssl_callback_proxy_cert(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
server_rec *s = mySrvFromConn(c);
SSLSrvConfigRec *sc = mySrvConfig(s);
X509_NAME *ca_name, *issuer, *ca_issuer;
X509_INFO *info, *ca_info;
X509_INFO *info;
X509 *ca_cert;
STACK_OF(X509_NAME) *ca_list;
STACK_OF(X509_INFO) *certs = sc->proxy->pkp->certs;
STACK_OF(X509_INFO) *ca_certs;
STACK_OF(X509_INFO) **ca_cert_chains;
STACK_OF(X509) *ca_certs;
STACK_OF(X509) **ca_cert_chains;
int i, j, k;
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
@@ -1640,21 +1641,21 @@ int ssl_callback_proxy_cert(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
return TRUE;
}
if (ca_cert_chains) {
if (ca_cert_chains) {
/*
* Failed to find direct issuer - search intermediaries
* Failed to find direct issuer - search intermediates
* (by issuer name), if provided.
*/
ca_certs = ca_cert_chains[j];
for (k = 0; k < sk_X509_INFO_num(ca_certs); k++) {
ca_info = sk_X509_INFO_value(ca_certs, k);
ca_issuer = X509_get_issuer_name(ca_info->x509);
for (k = 0; k < sk_X509_num(ca_certs); k++) {
ca_cert = sk_X509_value(ca_certs, k);
ca_issuer = X509_get_issuer_name(ca_cert);
if(X509_NAME_cmp(ca_issuer, ca_name) == 0 ) {
modssl_proxy_info_log(c, info, "found acceptable cert by intermediary");
modssl_proxy_info_log(c, info, "found acceptable cert by intermediate CA");
modssl_set_cert_info(info, x509, pkey);
return TRUE;
}
} /* end loop through chained certs */