Skip to content
This repository has been archived by the owner on Jun 30, 2021. It is now read-only.

[New feature] satisfy the https private key decrypt requirement #16

Closed
helinbo2015 opened this issue Jul 20, 2017 · 3 comments · Fixed by #17
Closed

[New feature] satisfy the https private key decrypt requirement #16

helinbo2015 opened this issue Jul 20, 2017 · 3 comments · Fixed by #17

Comments

@helinbo2015
Copy link

1. feature background

As a https server, for better security consideration, user may not keep the private key(for example: named as tls.key) in a clear text. it may use some encryption algo to encrypt the tls.key for protecting from server inbreak.
so when before use tls.key to create a https connection, user first decrypt the tls.key.

2. current implementation

now, in the evhtp_ssl_init(), cfg->privfile is used directly. this means that user should use a unencrypted privfile. user can not use a encrypted privfile.

    SSL_CTX_use_PrivateKey_file(htp->ssl_ctx,
                                cfg->privfile ? cfg->privfile : cfg->pemfile, SSL_FILETYPE_PEM);

3. solution

i'd like add a member callback (for example: decrypt_privfile_cb) in the evhtp_ssl_cfg_t struct. if this callback is set, it will be called to decrypt the privfile and used by SSL_CTX_use_PrivateKey().

@NathanFrench if this feature is welcome, i can make a commit. Thanks in Advance.

@NathanFrench
Copy link
Collaborator

This is actually a really good idea. Take the security out of the libraries hands.

I welcome this type of ingenuity.

@helinbo2015
Copy link
Author

@NathanFrench Please review the commit. any suggestions are welcome.
thank you in advance.
BTW: i have tested the customize_decrpyt_privfile_cb in my machine and it works ok.

@NathanFrench
Copy link
Collaborator

Merged, thank you very much.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants