Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement SSL_CONF_cmd Certificate and PrivateKey commands #32

Merged
merged 1 commit into from
Jun 26, 2024

Conversation

cpu
Copy link
Member

@cpu cpu commented Jun 25, 2024

This branch follows #29, #31 extending the existing SSL_CONF_xxx API to support the "Certificate" and "PrivateKey" sub-commands. See man 3 SSL_CONF_cmd for more information.

We diverge slightly from the upstream here by re-using the existing SSL_CTX_use_certificate_chain_file and SSL_CTX_use_PrivateKey_file logic. In the case of SSL_CTX_use_certificate_chain_file this means pulling out a use_cert_chain_file helper with the existing logic so it can be reused. Taking this approach requires the minimum amount of fuss to support these configuration commands, but means we error earlier in the case of the cert file/private key being bogus. This seems better to me than putting in more extra design work just to delay erroring! Relatedly, we don't have all the pieces needed to support setting a certificate chain by PEM input path for a SSL, just a SSL_CTX, so we skip implementing Certificate after SSL_CONF_CTX_set_ssl - in practice Nginx only uses SSL_CONF_CTX_set_ssl_ctx so we can punt here for the time being.

An integration test using Nginx's ssl_conf_command directive to override the normal ssl_certificate and ssl_certificate_key directives using the Certificate and PrivateKey commands demonstrates the end-to-end implementation working w/ Nginx 1.24+.

Updates #22

@cpu cpu force-pushed the cpu-ssl-conf-cert-and-key branch from 57024f4 to ade5191 Compare June 26, 2024 13:28
@cpu cpu merged commit 36a50bc into rustls:main Jun 26, 2024
14 checks passed
@cpu cpu deleted the cpu-ssl-conf-cert-and-key branch June 26, 2024 13:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants