Skip to content

Doesn't send list of allowed issuers when TLS client authentication is enabled #2250

@blackbird1999

Description

@blackbird1999

The
inline SSLServer::SSLServer(const char *cert_path, const char *private_key_path,
const char *client_ca_cert_file_path,
const char *client_ca_cert_dir_path,
const char *private_key_password);
should include a call to SSL_CTX_set_client_CA_list when client_ca_cert_file_path is provided so that the server will send the client the list of issuer distinguished names that the server will accept for TSL client/certificate authentication.

Something like
if (client_ca_cert_file_path)
{
SSL_CTX_set_client_CA_list(ctx_, SSL_load_client_CA_file(client_ca_cert_file_path));
}
after the call to SSL_CTX_load_verify_locations().

It should also do it for the client_ca_cert_dir_path option, but that's more complicated and annoying.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions