| 1416 | } |
| 1417 | |
| 1418 | static void ssl_check_public_cert(server_rec *s, |
| 1419 | apr_pool_t *ptemp, |
| 1420 | X509 *cert, |
| 1421 | const char *key_id) |
| 1422 | { |
| 1423 | int is_ca, pathlen; |
| 1424 | |
| 1425 | if (!cert) { |
| 1426 | return; |
| 1427 | } |
| 1428 | |
| 1429 | /* |
| 1430 | * Some information about the certificate(s) |
| 1431 | */ |
| 1432 | |
| 1433 | if (modssl_X509_getBC(cert, &is_ca, &pathlen)) { |
| 1434 | if (is_ca) { |
| 1435 | ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s, APLOGNO(01906) |
| 1436 | "%s server certificate is a CA certificate " |
| 1437 | "(BasicConstraints: CA == TRUE !?)", key_id); |
| 1438 | } |
| 1439 | |
| 1440 | if (pathlen > 0) { |
| 1441 | ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s, APLOGNO(01907) |
| 1442 | "%s server certificate is not a leaf certificate " |
| 1443 | "(BasicConstraints: pathlen == %d > 0 !?)", |
| 1444 | key_id, pathlen); |
| 1445 | } |
| 1446 | } |
| 1447 | |
| 1448 | if (modssl_X509_match_name(ptemp, cert, (const char *)s->server_hostname, |
| 1449 | TRUE, s) == FALSE) { |
| 1450 | ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s, APLOGNO(01909) |
| 1451 | "%s server certificate does NOT include an ID " |
| 1452 | "which matches the server name", key_id); |
| 1453 | } |
| 1454 | } |
| 1455 | |
| 1456 | /* prevent OpenSSL from showing its "Enter PEM pass phrase:" prompt */ |
| 1457 | static int ssl_no_passwd_prompt_cb(char *buf, int size, int rwflag, |
no test coverage detected