| 1323 | } |
| 1324 | |
| 1325 | static apr_status_t ssl_init_ctx_cert_chain(server_rec *s, |
| 1326 | apr_pool_t *p, |
| 1327 | apr_pool_t *ptemp, |
| 1328 | modssl_ctx_t *mctx) |
| 1329 | { |
| 1330 | BOOL skip_first = FALSE; |
| 1331 | int i, n; |
| 1332 | const char *chain = mctx->cert_chain; |
| 1333 | |
| 1334 | /* |
| 1335 | * Optionally configure extra server certificate chain certificates. |
| 1336 | * This is usually done by OpenSSL automatically when one of the |
| 1337 | * server cert issuers are found under SSLCACertificatePath or in |
| 1338 | * SSLCACertificateFile. But because these are intended for client |
| 1339 | * authentication it can conflict. For instance when you use a |
| 1340 | * Global ID server certificate you've to send out the intermediate |
| 1341 | * CA certificate, too. When you would just configure this with |
| 1342 | * SSLCACertificateFile and also use client authentication mod_ssl |
| 1343 | * would accept all clients also issued by this CA. Obviously this |
| 1344 | * isn't what we want in this situation. So this feature here exists |
| 1345 | * to allow one to explicitly configure CA certificates which are |
| 1346 | * used only for the server certificate chain. |
| 1347 | */ |
| 1348 | if (!chain) { |
| 1349 | return APR_SUCCESS; |
| 1350 | } |
| 1351 | |
| 1352 | for (i = 0; (i < mctx->pks->cert_files->nelts) && |
| 1353 | APR_ARRAY_IDX(mctx->pks->cert_files, i, const char *); i++) { |
| 1354 | if (strEQ(APR_ARRAY_IDX(mctx->pks->cert_files, i, const char *), chain)) { |
| 1355 | skip_first = TRUE; |
| 1356 | break; |
| 1357 | } |
| 1358 | } |
| 1359 | |
| 1360 | n = use_certificate_chain(mctx->ssl_ctx, (char *)chain, skip_first, NULL); |
| 1361 | if (n < 0) { |
| 1362 | ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01903) |
| 1363 | "Failed to configure CA certificate chain!"); |
| 1364 | return ssl_die(s); |
| 1365 | } |
| 1366 | |
| 1367 | ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01904) |
| 1368 | "Configuring server certificate chain " |
| 1369 | "(%d CA certificate%s)", |
| 1370 | n, n == 1 ? "" : "s"); |
| 1371 | |
| 1372 | return APR_SUCCESS; |
| 1373 | } |
| 1374 | |
| 1375 | static apr_status_t ssl_init_ctx(server_rec *s, |
| 1376 | apr_pool_t *p, |
no test coverage detected