-
Notifications
You must be signed in to change notification settings - Fork 847
Fix the Loading of Client Certificate Chains #9177
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Client certificate chain loading was using the wrong OpenSSL API, causing the chain to be loaded incorrectly.
|
[approve ci autest] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think this is a good find. But the OpenSSL docs isn't very specific on whether the first cert needs to be added using SSL_CTX_use_certificate. Since it says (https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_use_certificate.html) "The rest of the certificates needed to form the complete certificate chain can be specified using the SSL_CTX_add_extra_chain_cert function". Could you confirm that all certs can be added to the chain using SSL_CTX_add_extra_chain_cert, including the first one?
The first cert is still added using Before this change, loading a certificate chain and a private key will cause OpenSSL to give an error that the cert and key don't match. I can confirm that loading the chain this way gets OpenSSL to pass the |
I do not think SSL_CTX_add_extra_chain_cert can add the first one. |
|
@bryancall Approves this, but he's lost his Github access because his mobile provider is terrible. |
Client certificate chain loading was using the wrong OpenSSL API, causing the chain to be loaded incorrectly. (cherry picked from commit 9a7b464)
|
Cherry-picked to v9.2.x |
Client certificate chain loading was using the wrong OpenSSL API, causing the chain to be loaded incorrectly.
* asf/9.2.x: Fix Loading Client Certificate Chain (apache#9177)
Additional certificates in a chain should be loaded with the
SSL_CTX_add_extra_chain_certAPI.