Function initialize_SSL

src/interfaces/libpq/fe-secure-openssl.c:789–1342

* Create per-connection SSL object, and load the client certificate, * private key, and trusted CA certs. * * Returns 0 if OK, -1 on failure (with a message in conn->errorMessage). */

 *	Returns 0 if OK, -1 on failure (with a message in conn->errorMessage).
 */
static int
initialize_SSL(PGconn *conn)
{
	SSL_CTX    *SSL_context;
	struct stat buf;
	char		homedir[MAXPGPATH];
	char		fnbuf[MAXPGPATH];
	char		sebuf[PG_STRERROR_R_BUFLEN];
	bool		have_homedir;
	bool		have_cert;
	bool		have_rootcert;
	EVP_PKEY   *pkey = NULL;

	/*
	 * We'll need the home directory if any of the relevant parameters are
	 * defaulted.  If pqGetHomeDirectory fails, act as though none of the
	 * files could be found.
	 */
	if (!(conn->sslcert && strlen(conn->sslcert) > 0) ||
		!(conn->sslkey && strlen(conn->sslkey) > 0) ||
		!(conn->sslrootcert && strlen(conn->sslrootcert) > 0) ||
		!((conn->sslcrl && strlen(conn->sslcrl) > 0) ||
		  (conn->sslcrldir && strlen(conn->sslcrldir) > 0)))
		have_homedir = pqGetHomeDirectory(homedir, sizeof(homedir));
	else						/* won't need it */
		have_homedir = false;

	/*
	 * Create a new SSL_CTX object.
	 *
	 * We used to share a single SSL_CTX between all connections, but it was
	 * complicated if connections used different certificates. So now we
	 * create a separate context for each connection, and accept the overhead.
	 */
	SSL_context = SSL_CTX_new(SSLv23_method());
	if (!SSL_context)
	{
		char	   *err = SSLerrmessage(ERR_get_error());

		appendPQExpBuffer(&conn->errorMessage,
						  libpq_gettext("could not create SSL context: %s\n"),
						  err);
		SSLerrfree(err);
		return -1;
	}

	/*
	 * Delegate the client cert password prompt to the libpq wrapper callback
	 * if any is defined.
	 *
	 * If the application hasn't installed its own and the sslpassword
	 * parameter is non-null, we install ours now to make sure we supply
	 * PGconn->sslpassword to OpenSSL instead of letting it prompt on stdin.
	 *
	 * This will replace OpenSSL's default PEM_def_callback (which prompts on
	 * stdin), but we're only setting it for this SSL context so it's
	 * harmless.
	 */