|
|
|
@ -219,10 +219,15 @@ verify_callback(int preverify_ok, X509_STORE_CTX *ctx) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
if (preverify_ok) { |
|
|
|
|
return preverify_ok; |
|
|
|
|
return preverify_ok; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
#if OPENSSL_VERSION_NUMBER >= 0x10002000L |
|
|
|
|
err_cert = X509_STORE_CTX_get_current_cert(ctx); |
|
|
|
|
#else |
|
|
|
|
err_cert = ctx->current_cert; |
|
|
|
|
#endif |
|
|
|
|
if (NULL == err_cert) return !hctx->conf.ssl_verifyclient_enforce; |
|
|
|
|
X509_NAME_oneline(X509_get_subject_name(err_cert), buf, sizeof(buf)); |
|
|
|
|
log_error_write(srv, __FILE__, __LINE__, "SDSSSDSS", |
|
|
|
|
"SSL: verify error:num=", err, ":", |
|
|
|
@ -235,8 +240,7 @@ verify_callback(int preverify_ok, X509_STORE_CTX *ctx) |
|
|
|
|
*/ |
|
|
|
|
if (!preverify_ok && (err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY || |
|
|
|
|
err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT)) { |
|
|
|
|
X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert), buf, |
|
|
|
|
sizeof(buf)); |
|
|
|
|
X509_NAME_oneline(X509_get_issuer_name(err_cert), buf, sizeof(buf)); |
|
|
|
|
log_error_write(srv, __FILE__, __LINE__, "SS", "SSL: issuer=", buf); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
@ -574,7 +578,7 @@ network_init_ssl (server *srv, void *p_d) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
if (NULL == s->ssl_ca_file_cert_names |
|
|
|
|
&& !buffer_string_is_empty(s->ssl_ca_file)) { |
|
|
|
|
&& !buffer_string_is_empty(s->ssl_ca_file)) { |
|
|
|
|
s->ssl_ca_file_cert_names = |
|
|
|
|
SSL_load_client_CA_file(s->ssl_ca_file->ptr); |
|
|
|
|
if (NULL == s->ssl_ca_file_cert_names) { |
|
|
|
|