Method initialize

src/iocore/net/SSLConfig.cc:342–650

}

void
SSLConfigParams::initialize()
{
  char *serverCertRelativePath          = nullptr;
  char *ssl_server_private_key_path     = nullptr;
  char *CACertRelativePath              = nullptr;
  char *ssl_client_cert_filename        = nullptr;
  char *ssl_client_cert_path            = nullptr;
  char *ssl_client_private_key_filename = nullptr;
  char *ssl_client_private_key_path     = nullptr;
  char *clientCACertRelativePath        = nullptr;
  char *ssl_server_ca_cert_filename     = nullptr;
  char *ssl_client_ca_cert_filename     = nullptr;
  char *ssl_ocsp_response_path          = nullptr;

  cleanup();

  //+++++++++++++++++++++++++ Server part +++++++++++++++++++++++++++++++++
  verify_depth = 7;

  REC_ReadConfigInt32(clientCertLevel, "proxy.config.ssl.client.certification_level");
  REC_ReadConfigStringAlloc(cipherSuite, "proxy.config.ssl.server.cipher_suite");
  REC_ReadConfigStringAlloc(client_cipherSuite, "proxy.config.ssl.client.cipher_suite");
  REC_ReadConfigStringAlloc(server_tls13_cipher_suites, "proxy.config.ssl.server.TLSv1_3.cipher_suites");
  REC_ReadConfigStringAlloc(client_tls13_cipher_suites, "proxy.config.ssl.client.TLSv1_3.cipher_suites");

  dhparamsFile = ats_stringdup(RecConfigReadConfigPath("proxy.config.ssl.server.dhparams_file"));

  int option = 0;

  REC_ReadConfigInteger(client_tls_ver_min, "proxy.config.ssl.client.version.min");
  REC_ReadConfigInteger(client_tls_ver_max, "proxy.config.ssl.client.version.max");
  if (client_tls_ver_min < 0 || client_tls_ver_max < 0) {
    REC_ReadConfigInteger(option, "proxy.config.ssl.client.TLSv1");
    if (!option) {
      ssl_client_ctx_options |= SSL_OP_NO_TLSv1;
    } else {
      // This is disabled by default. It's used if it's enabled.
      Warning("proxy.config.ssl.client.TLSv1 is deprecated. Use proxy.config.ssl.client.version.min and "
              "proxy.config.ssl.client.version.max instead.");
    }

    REC_ReadConfigInteger(option, "proxy.config.ssl.client.TLSv1_1");
    if (!option) {
      ssl_client_ctx_options |= SSL_OP_NO_TLSv1_1;
    } else {
      // This is disabled by default. It's used if it's enabled.
      Warning("proxy.config.ssl.client.TLSv1_1 is deprecated. Use proxy.config.ssl.client.version.min and "
              "proxy.config.ssl.client.version.max instead.");
    }

    REC_ReadConfigInteger(option, "proxy.config.ssl.client.TLSv1_2");
    if (!option) {
      ssl_client_ctx_options |= SSL_OP_NO_TLSv1_2;
      // This is enabled by default. It's used if it's disabled.
      Warning("proxy.config.ssl.client.TLSv1_2 is deprecated. Use proxy.config.ssl.client.version.min and "
              "proxy.config.ssl.client.version.max instead.");
    }