Mercurial > hg > nginx

comparison src/event/ngx_event_openssl.c @ 7672:3dcb1aba894a

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
SSL: fixed unexpected certificate requests (ticket #2008). Using SSL_CTX_set_verify(SSL_VERIFY_PEER) implies that OpenSSL will send a certificate request during an SSL handshake, leading to unexpected certificate requests from browsers as long as there are any client certificates installed. Given that ngx_ssl_trusted_certificate() is called unconditionally by the ngx_http_ssl_module, this affected all HTTPS servers. Broken by 699f6e55bbb4 (not released yet). Fix is to set verify callback in the ngx_ssl_trusted_certificate() function without changing the verify mode.
author Maxim Dounin <mdounin@mdounin.ru>
date Mon, 29 Jun 2020 17:15:51 +0300
parents 699f6e55bbb4
children 09fb2135a589 001ec7fce567
comparison
equal deleted inserted replaced
7671:7e0719fb528b 7672:3dcb1aba894a
918 918
919 ngx_int_t 919 ngx_int_t
920 ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, 920 ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
921 ngx_int_t depth) 921 ngx_int_t depth)
922 { 922 {
923 SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback); 923 SSL_CTX_set_verify(ssl->ctx, SSL_CTX_get_verify_mode(ssl->ctx),
924 ngx_ssl_verify_callback);
924 925
925 SSL_CTX_set_verify_depth(ssl->ctx, depth); 926 SSL_CTX_set_verify_depth(ssl->ctx, depth);
926 927
927 if (cert->len == 0) { 928 if (cert->len == 0) {
928 return NGX_OK; 929 return NGX_OK;