* Set the minimum TLS protocol version to the specified SSL context. * * @param context The ssl context. * @param tlsProtocolmin The minimum TLS protocol version. */
| 332 | * @param tlsProtocolmin The minimum TLS protocol version. |
| 333 | */ |
| 334 | void SetTlsProtocolminToSSLContext(const Shared<boost::asio::ssl::context>::Ptr& context, const String& tlsProtocolmin) |
| 335 | { |
| 336 | #if OPENSSL_VERSION_NUMBER >= 0x10100000L |
| 337 | int ret = SSL_CTX_set_min_proto_version(context->native_handle(), ResolveTlsProtocolVersion(tlsProtocolmin)); |
| 338 | |
| 339 | if (ret != 1) { |
| 340 | char errbuf[256]; |
| 341 | |
| 342 | ERR_error_string_n(ERR_peek_error(), errbuf, sizeof errbuf); |
| 343 | Log(LogCritical, "SSL") |
| 344 | << "Error setting minimum TLS protocol version: " << ERR_peek_error() << ", \"" << errbuf << "\""; |
| 345 | BOOST_THROW_EXCEPTION(openssl_error() |
| 346 | << boost::errinfo_api_function("SSL_CTX_set_min_proto_version") |
| 347 | << errinfo_openssl_error(ERR_peek_error())); |
| 348 | } |
| 349 | #else /* OPENSSL_VERSION_NUMBER >= 0x10100000L */ |
| 350 | // This should never happen. On this OpenSSL version, ResolveTlsProtocolVersion() should either return TLS 1.2 |
| 351 | // or throw an exception, as that's the only TLS version supported by both Icinga and ancient OpenSSL. |
| 352 | VERIFY(ResolveTlsProtocolVersion(tlsProtocolmin) == TLS1_2_VERSION); |
| 353 | #endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */ |
| 354 | } |
| 355 | |
| 356 | /** |
| 357 | * Loads a CRL and appends its certificates to the specified Boost SSL context. |
no test coverage detected