Mercurial > hg > nginx

diff src/event/ngx_event_openssl.c @ 5365:6c35a1f428f2

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
SSL: clear error queue after SSL_CTX_load_verify_locations(). The SSL_CTX_load_verify_locations() may leave errors in the error queue while returning success (e.g. if there are duplicate certificates in the file specified), resulting in "ignoring stale global SSL error" alerts later at runtime.
author Maxim Dounin <mdounin@mdounin.ru>
date Wed, 04 Sep 2013 21:17:02 +0400
parents 314c3d7cc3a5
children a73678f5f96f
line wrap: on
line diff
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -363,6 +363,13 @@ ngx_ssl_client_certificate(ngx_conf_t *c
         return NGX_ERROR;
     }
 
+    /*
+     * SSL_CTX_load_verify_locations() may leave errors in the error queue
+     * while returning success
+     */
+
+    ERR_clear_error();
+
     list = SSL_load_client_CA_file((char *) cert->data);
 
     if (list == NULL) {
@@ -407,6 +414,13 @@ ngx_ssl_trusted_certificate(ngx_conf_t *
         return NGX_ERROR;
     }
 
+    /*
+     * SSL_CTX_load_verify_locations() may leave errors in the error queue
+     * while returning success
+     */
+
+    ERR_clear_error();
+
     return NGX_OK;
 }