* Read a file that optionally contains the server certificate in PEM * format, possibly followed by a sequence of CA certificates that * should be sent to the peer in the SSL Certificate message. */
| 1267 | * should be sent to the peer in the SSL Certificate message. |
| 1268 | */ |
| 1269 | static int use_certificate_chain( |
| 1270 | SSL_CTX *ctx, char *file, int skipfirst, pem_password_cb *cb) |
| 1271 | { |
| 1272 | BIO *bio; |
| 1273 | X509 *x509; |
| 1274 | unsigned long err; |
| 1275 | int n; |
| 1276 | |
| 1277 | if ((bio = BIO_new(BIO_s_file())) == NULL) |
| 1278 | return -1; |
| 1279 | if (BIO_read_filename(bio, file) <= 0) { |
| 1280 | BIO_free(bio); |
| 1281 | return -1; |
| 1282 | } |
| 1283 | /* optionally skip a leading server certificate */ |
| 1284 | if (skipfirst) { |
| 1285 | if ((x509 = PEM_read_bio_X509(bio, NULL, cb, NULL)) == NULL) { |
| 1286 | BIO_free(bio); |
| 1287 | return -1; |
| 1288 | } |
| 1289 | X509_free(x509); |
| 1290 | } |
| 1291 | /* free a perhaps already configured extra chain */ |
| 1292 | #ifdef OPENSSL_NO_SSL_INTERN |
| 1293 | SSL_CTX_clear_extra_chain_certs(ctx); |
| 1294 | #else |
| 1295 | if (ctx->extra_certs != NULL) { |
| 1296 | sk_X509_pop_free((STACK_OF(X509) *)ctx->extra_certs, X509_free); |
| 1297 | ctx->extra_certs = NULL; |
| 1298 | } |
| 1299 | #endif |
| 1300 | |
| 1301 | /* create new extra chain by loading the certs */ |
| 1302 | n = 0; |
| 1303 | ERR_clear_error(); |
| 1304 | while ((x509 = PEM_read_bio_X509(bio, NULL, cb, NULL)) != NULL) { |
| 1305 | if (!SSL_CTX_add_extra_chain_cert(ctx, x509)) { |
| 1306 | X509_free(x509); |
| 1307 | BIO_free(bio); |
| 1308 | return -1; |
| 1309 | } |
| 1310 | n++; |
| 1311 | } |
| 1312 | /* Make sure that only the error is just an EOF */ |
| 1313 | if ((err = ERR_peek_error()) > 0) { |
| 1314 | if (!( ERR_GET_LIB(err) == ERR_LIB_PEM |
| 1315 | && ERR_GET_REASON(err) == PEM_R_NO_START_LINE)) { |
| 1316 | BIO_free(bio); |
| 1317 | return -1; |
| 1318 | } |
| 1319 | while (ERR_get_error() > 0) ; |
| 1320 | } |
| 1321 | BIO_free(bio); |
| 1322 | return n; |
| 1323 | } |
| 1324 | |
| 1325 | static apr_status_t ssl_init_ctx_cert_chain(server_rec *s, |
| 1326 | apr_pool_t *p, |
no outgoing calls
no test coverage detected