SSL HTTP server implementation
| 8240 | |
| 8241 | // SSL HTTP server implementation |
| 8242 | inline SSLServer::SSLServer(const char *cert_path, const char *private_key_path, |
| 8243 | const char *client_ca_cert_file_path, |
| 8244 | const char *client_ca_cert_dir_path, |
| 8245 | const char *private_key_password) { |
| 8246 | ctx_ = SSL_CTX_new(TLS_server_method()); |
| 8247 | |
| 8248 | if (ctx_) { |
| 8249 | SSL_CTX_set_options(ctx_, |
| 8250 | SSL_OP_NO_COMPRESSION | |
| 8251 | SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION); |
| 8252 | |
| 8253 | SSL_CTX_set_min_proto_version(ctx_, TLS1_1_VERSION); |
| 8254 | |
| 8255 | // add default password callback before opening encrypted private key |
| 8256 | if (private_key_password != nullptr && (private_key_password[0] != '\0')) { |
| 8257 | SSL_CTX_set_default_passwd_cb_userdata( |
| 8258 | ctx_, |
| 8259 | reinterpret_cast<void *>(const_cast<char *>(private_key_password))); |
| 8260 | } |
| 8261 | |
| 8262 | if (SSL_CTX_use_certificate_chain_file(ctx_, cert_path) != 1 || |
| 8263 | SSL_CTX_use_PrivateKey_file(ctx_, private_key_path, SSL_FILETYPE_PEM) != |
| 8264 | 1) { |
| 8265 | SSL_CTX_free(ctx_); |
| 8266 | ctx_ = nullptr; |
| 8267 | } else if (client_ca_cert_file_path || client_ca_cert_dir_path) { |
| 8268 | SSL_CTX_load_verify_locations(ctx_, client_ca_cert_file_path, |
| 8269 | client_ca_cert_dir_path); |
| 8270 | |
| 8271 | SSL_CTX_set_verify( |
| 8272 | ctx_, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, nullptr); |
| 8273 | } |
| 8274 | } |
| 8275 | } |
| 8276 | |
| 8277 | inline SSLServer::SSLServer(X509 *cert, EVP_PKEY *private_key, |
| 8278 | X509_STORE *client_ca_cert_store) { |
nothing calls this directly
no outgoing calls
no test coverage detected