www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2025-08-08 15:02:10 +03:00
Code Activity

*) core/mod_ssl/mod_md: adding OCSP response provisioning as core feature. This

Browse Source 
allows modules to access and provide OCSP response data without being tied
     of each other. The data is exchanged in standard, portable formats (PEM encoded
     certificates and DER encoded responses), so that the actual SSL/crypto
     implementations used by the modules are independant of each other.
     Registration and retrieval happen in the context of a server (server_rec)
     which modules may use to decide if they are configured for this or not.
     The area of changes:
     1. core: defines 2 functions in include/http_ssl.h, so that modules may
        register a certificate, together with its issuer certificate for OCSP
        response provisioning and ask for current response data (DER bytes) later.
        Also, 2 hooks are defined that allow modules to implement this OCSP
        provisioning.
     2. mod_ssl uses the new functions, in addition to what it did already, to
        register its certificates this way. If no one is interested in providing
        OCSP, it falls back to its own (if configured) stapling implementation.
     3. mod_md registers itself at the core hooks for OCSP provisioning. Depending
        on configuration, it will accept registrations of its own certificates only,
        all certficates or none.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1888723 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Stefan Eissing
2021-04-13 11:12:00 +00:00
parent 9e2ed5bb85
commit db5aa786d8
16 changed files with 515 additions and 183 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
modules/ssl/ssl_util_ssl.c
View File

@@ -578,3 +578,26 @@ cleanup:
if (in != NULL) BIO_free(in);
return rv;
}
apr_status_t modssl_cert_get_pem(apr_pool_t *p,
X509 *cert1, X509 *cert2,
const char **ppem)
{
apr_status_t rv = APR_ENOMEM;
BIO *bio;
if ((bio = BIO_new(BIO_s_mem())) == NULL) goto cleanup;
if (PEM_write_bio_X509(bio, cert1) != 1) goto cleanup;
if (cert2 && PEM_write_bio_X509(bio, cert2) != 1) goto cleanup;
rv = APR_SUCCESS;
cleanup:
if (rv != APR_SUCCESS) {
*ppem = NULL;
if (bio) BIO_free(bio);
}
else {
*ppem = modssl_bio_free_read(p, bio);
}
return rv;
}