| 1476 | #endif |
| 1477 | |
| 1478 | static apr_status_t ssl_init_server_certs(server_rec *s, |
| 1479 | apr_pool_t *p, |
| 1480 | apr_pool_t *ptemp, |
| 1481 | modssl_ctx_t *mctx, |
| 1482 | apr_array_header_t *pphrases) |
| 1483 | { |
| 1484 | SSLModConfigRec *mc = myModConfig(s); |
| 1485 | const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile; |
| 1486 | int i; |
| 1487 | EVP_PKEY *pkey; |
| 1488 | int custom_dh_done = 0; |
| 1489 | #ifdef HAVE_ECC |
| 1490 | EC_GROUP *ecgroup = NULL; |
| 1491 | int curve_nid = 0; |
| 1492 | #endif |
| 1493 | |
| 1494 | /* no OpenSSL default prompts for any of the SSL_CTX_use_* calls, please */ |
| 1495 | SSL_CTX_set_default_passwd_cb(mctx->ssl_ctx, ssl_no_passwd_prompt_cb); |
| 1496 | |
| 1497 | /* Iterate over the SSLCertificateFile array */ |
| 1498 | for (i = 0; (i < mctx->pks->cert_files->nelts) && |
| 1499 | (certfile = APR_ARRAY_IDX(mctx->pks->cert_files, i, |
| 1500 | const char *)); |
| 1501 | i++) { |
| 1502 | X509 *cert = NULL; |
| 1503 | const char *engine_certfile = NULL; |
| 1504 | |
| 1505 | key_id = apr_psprintf(ptemp, "%s:%d", vhost_id, i); |
| 1506 | |
| 1507 | ERR_clear_error(); |
| 1508 | |
| 1509 | /* first the certificate (public key) */ |
| 1510 | if (modssl_is_engine_id(certfile)) { |
| 1511 | engine_certfile = certfile; |
| 1512 | } |
| 1513 | else if (mctx->cert_chain) { |
| 1514 | if ((SSL_CTX_use_certificate_file(mctx->ssl_ctx, certfile, |
| 1515 | SSL_FILETYPE_PEM) < 1)) { |
| 1516 | ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02561) |
| 1517 | "Failed to configure certificate %s, check %s", |
| 1518 | key_id, certfile); |
| 1519 | ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); |
| 1520 | return APR_EGENERAL; |
| 1521 | } |
| 1522 | } else { |
| 1523 | if ((SSL_CTX_use_certificate_chain_file(mctx->ssl_ctx, |
| 1524 | certfile) < 1)) { |
| 1525 | ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02562) |
| 1526 | "Failed to configure certificate %s (with chain)," |
| 1527 | " check %s", key_id, certfile); |
| 1528 | ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); |
| 1529 | return APR_EGENERAL; |
| 1530 | } |
| 1531 | } |
| 1532 | |
| 1533 | /* and second, the private key */ |
| 1534 | if (i < mctx->pks->key_files->nelts) { |
| 1535 | keyfile = APR_ARRAY_IDX(mctx->pks->key_files, i, const char *); |
no test coverage detected