| 1192 | } |
| 1193 | |
| 1194 | static apr_status_t ssl_init_ctx_crl(server_rec *s, |
| 1195 | apr_pool_t *p, |
| 1196 | apr_pool_t *ptemp, |
| 1197 | modssl_ctx_t *mctx) |
| 1198 | { |
| 1199 | X509_STORE *store = SSL_CTX_get_cert_store(mctx->ssl_ctx); |
| 1200 | unsigned long crlflags = 0; |
| 1201 | char *cfgp = mctx->pkp ? "SSLProxy" : "SSL"; |
| 1202 | int crl_check_mode; |
| 1203 | |
| 1204 | if (mctx->ocsp_mask == UNSET) { |
| 1205 | mctx->ocsp_mask = SSL_OCSPCHECK_NONE; |
| 1206 | } |
| 1207 | |
| 1208 | if (mctx->crl_check_mask == UNSET) { |
| 1209 | mctx->crl_check_mask = SSL_CRLCHECK_NONE; |
| 1210 | } |
| 1211 | crl_check_mode = mctx->crl_check_mask & ~SSL_CRLCHECK_FLAGS; |
| 1212 | |
| 1213 | /* |
| 1214 | * Configure Certificate Revocation List (CRL) Details |
| 1215 | */ |
| 1216 | |
| 1217 | if (!(mctx->crl_file || mctx->crl_path)) { |
| 1218 | if (crl_check_mode == SSL_CRLCHECK_LEAF || |
| 1219 | crl_check_mode == SSL_CRLCHECK_CHAIN) { |
| 1220 | ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01899) |
| 1221 | "Host %s: CRL checking has been enabled, but " |
| 1222 | "neither %sCARevocationFile nor %sCARevocationPath " |
| 1223 | "is configured", mctx->sc->vhost_id, cfgp, cfgp); |
| 1224 | return ssl_die(s); |
| 1225 | } |
| 1226 | return APR_SUCCESS; |
| 1227 | } |
| 1228 | |
| 1229 | ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01900) |
| 1230 | "Configuring certificate revocation facility"); |
| 1231 | |
| 1232 | if (!store || !modssl_X509_STORE_load_locations(store, mctx->crl_file, |
| 1233 | mctx->crl_path)) { |
| 1234 | ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01901) |
| 1235 | "Host %s: unable to configure X.509 CRL storage " |
| 1236 | "for certificate revocation", mctx->sc->vhost_id); |
| 1237 | ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); |
| 1238 | return ssl_die(s); |
| 1239 | } |
| 1240 | |
| 1241 | switch (crl_check_mode) { |
| 1242 | case SSL_CRLCHECK_LEAF: |
| 1243 | crlflags = X509_V_FLAG_CRL_CHECK; |
| 1244 | break; |
| 1245 | case SSL_CRLCHECK_CHAIN: |
| 1246 | crlflags = X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL; |
| 1247 | break; |
| 1248 | default: |
| 1249 | crlflags = 0; |
| 1250 | } |
| 1251 |
no test coverage detected