Method load_certs

src/iocore/net/SSLUtils.cc:2314–2421

Load certificates to SSL_CTX @static */

   @static
 */
bool
SSLMultiCertConfigLoader::load_certs(SSL_CTX *ctx, const std::vector<std::string> &cert_names_list,
                                     const std::vector<std::string> &key_list, CertLoadData const &data,
                                     const SSLConfigParams *params, const SSLMultiCertConfigParams *sslMultCertSettings)
{
  if (SSLConfigParams::ssl_ocsp_enabled) {
    Dbg(dbg_ctl_ssl_load, "SSL OCSP Stapling is enabled");
    SSL_CTX_set_tlsext_status_cb(ctx, ssl_callback_ocsp_stapling);
  } else {
    Dbg(dbg_ctl_ssl_load, "SSL OCSP Stapling is disabled");
  }

  ink_assert(!cert_names_list.empty());

  for (size_t i = 0; i < cert_names_list.size(); i++) {
    std::string keyPath = (i < key_list.size()) ? key_list[i] : "";
    std::string secret_data;
    std::string secret_key_data;
    params->secrets.getOrLoadSecret(cert_names_list[i], keyPath, secret_data, secret_key_data);
    if (secret_data.empty()) {
      SSLError("failed to load certificate secret for %s with key path %s", cert_names_list[i].c_str(),
               keyPath.empty() ? "[empty key path]" : keyPath.c_str());
      return false;
    }
    scoped_BIO bio(BIO_new_mem_buf(secret_data.data(), secret_data.size()));
    X509      *cert = nullptr;
    if (bio) {
      cert = PEM_read_bio_X509(bio.get(), nullptr, nullptr, nullptr);
    } else {
      SSLError("failed to create bio for certificate secret %s of length %ld", data.cert_names_list[i].c_str(), secret_data.size());
      return false;
    }

    if (!bio || !cert) {
      SSLError("failed to load certificate chain from %s", cert_names_list[i].c_str());
      return false;
    }

    Dbg(dbg_ctl_ssl_load, "for ctx=%p, using certificate %s", ctx, cert_names_list[i].c_str());
    if (!SSL_CTX_use_certificate(ctx, cert)) {
      SSLError("Failed to assign cert from %s to SSL_CTX", cert_names_list[i].c_str());
      X509_free(cert);
      return false;
    }

    // Load up any additional chain certificates
    if (!SSL_CTX_add_extra_chain_cert_bio(ctx, bio.get())) {
      Dbg(dbg_ctl_ssl_load, "couldn't add chain to %p", ctx);
      SSLError("failed to load intermediate certificate chain from %s", cert_names_list[i].c_str());
      return false;
    }

    if (secret_key_data.empty()) {
      Dbg(dbg_ctl_ssl_load, "empty private key for public key %s", cert_names_list[i].c_str());
      secret_key_data = std::move(secret_data);
    }
    if (!SSLPrivateKeyHandler(ctx, keyPath.c_str(), secret_key_data.data(), secret_key_data.size())) {
      SSLError("failed to load certificate: %s of length %ld with key path: %s", cert_names_list[i].c_str(), secret_key_data.size(),