| 323 | }; |
| 324 | |
| 325 | static int LoadCertificate(SSL_CTX* ctx, |
| 326 | const std::string& certificate, |
| 327 | const std::string& private_key, |
| 328 | std::vector<std::string>* hostnames) { |
| 329 | // Load the private key |
| 330 | if (IsPemString(private_key)) { |
| 331 | std::unique_ptr<BIO, FreeBIO> kbio( |
| 332 | BIO_new_mem_buf((void*)private_key.c_str(), -1)); |
| 333 | std::unique_ptr<EVP_PKEY, FreeEVPKEY> key( |
| 334 | PEM_read_bio_PrivateKey(kbio.get(), NULL, 0, NULL)); |
| 335 | if (SSL_CTX_use_PrivateKey(ctx, key.get()) != 1) { |
| 336 | LOG(ERROR) << "Fail to load " << private_key << ": " |
| 337 | << SSLError(ERR_get_error()); |
| 338 | return -1; |
| 339 | } |
| 340 | |
| 341 | } else { |
| 342 | if (SSL_CTX_use_PrivateKey_file( |
| 343 | ctx, private_key.c_str(), SSL_FILETYPE_PEM) != 1) { |
| 344 | LOG(ERROR) << "Fail to load " << private_key << ": " |
| 345 | << SSLError(ERR_get_error()); |
| 346 | return -1; |
| 347 | } |
| 348 | } |
| 349 | |
| 350 | // Open & Read certificate |
| 351 | std::unique_ptr<BIO, FreeBIO> cbio; |
| 352 | if (IsPemString(certificate)) { |
| 353 | cbio.reset(BIO_new_mem_buf((void*)certificate.c_str(), -1)); |
| 354 | } else { |
| 355 | cbio.reset(BIO_new(BIO_s_file())); |
| 356 | if (BIO_read_filename(cbio.get(), certificate.c_str()) <= 0) { |
| 357 | LOG(ERROR) << "Fail to read " << certificate << ": " |
| 358 | << SSLError(ERR_get_error()); |
| 359 | return -1; |
| 360 | } |
| 361 | } |
| 362 | std::unique_ptr<X509, FreeX509> x( |
| 363 | PEM_read_bio_X509_AUX(cbio.get(), NULL, 0, NULL)); |
| 364 | if (!x) { |
| 365 | LOG(ERROR) << "Fail to parse " << certificate << ": " |
| 366 | << SSLError(ERR_get_error()); |
| 367 | return -1; |
| 368 | } |
| 369 | |
| 370 | // Load the main certificate |
| 371 | if (SSL_CTX_use_certificate(ctx, x.get()) != 1) { |
| 372 | LOG(ERROR) << "Fail to load " << certificate << ": " |
| 373 | << SSLError(ERR_get_error()); |
| 374 | return -1; |
| 375 | } |
| 376 | |
| 377 | // Load the certificate chain |
| 378 | #if (OPENSSL_VERSION_NUMBER >= 0x10002000L) |
| 379 | SSL_CTX_clear_chain_certs(ctx); |
| 380 | #else |
| 381 | if (ctx->extra_certs != NULL) { |
| 382 | sk_X509_pop_free(ctx->extra_certs, X509_free); |
no test coverage detected