Function SSLCreateClientContext

src/iocore/net/SSLClientUtils.cc:275–327

}

SSL_CTX *
SSLCreateClientContext(const struct SSLConfigParams *params, const char *ca_bundle_path, const char *ca_bundle_file,
                       const char *cert_path, const char *key_path)
{
  std::unique_ptr<SSL_CTX, decltype(&SSL_CTX_free)> ctx(nullptr, &SSL_CTX_free);

  if (nullptr == params || nullptr == cert_path) {
    return nullptr;
  }

  ctx.reset(SSLInitClientContext(params));

  if (!ctx) {
    return nullptr;
  }

  if (!SSL_CTX_use_certificate_chain_file(ctx.get(), cert_path)) {
    SSLError("SSLCreateClientContext(): failed to load client certificate: %s",
             (!cert_path || cert_path[0] == '\0') ? "[empty file name]" : cert_path);
    return nullptr;
  }

  if (!key_path || key_path[0] == '\0') {
    key_path = cert_path;
  }

  if (!SSL_CTX_use_PrivateKey_file(ctx.get(), key_path, SSL_FILETYPE_PEM)) {
    SSLError("SSLCreateClientContext(): failed to load client private key: %s",
             (!key_path || key_path[0] == '\0') ? "[empty file]" : key_path);
    return nullptr;
  }

  if (!SSL_CTX_check_private_key(ctx.get())) {
    SSLError("SSLCreateClientContext(): client private key: %s does not match client certificate: %s",
             (!key_path || key_path[0] == '\0') ? "[empty file]" : key_path,
             (!cert_path || cert_path[0] == '\0') ? "[empty file]" : cert_path);
    return nullptr;
  }

  if (ca_bundle_file || ca_bundle_path) {
    if (!SSL_CTX_load_verify_locations(ctx.get(), ca_bundle_file, ca_bundle_path)) {
      SSLError("SSLCreateClientContext(): Invalid CA Certificate file: %s or CA Certificate path: %s",
               (!ca_bundle_file || ca_bundle_file[0] == '\0') ? "[empty file name]" : ca_bundle_file,
               (!ca_bundle_path || ca_bundle_path[0] == '\0') ? "[empty path]" : ca_bundle_path);
      SSLError("SSLCreateClientContext(): Invalid client CA cert file/CA path.");
      return nullptr;
    }
  } else if (!SSL_CTX_set_default_verify_paths(ctx.get())) {
    SSLError("SSLCreateClientContext(): failed to set the default verify paths.");
    return nullptr;
  }
  return ctx.release();
}