pgpool2.git / summary / log / commit / refs
commit 85e7862ddc6ee16ed98d29a6ac560c03bcd94fb4
Author: Muhammad Usama <m.usama@gmail.com>
Date: Wed Mar 18 10:21:31 2015 +0000
Support SSL certificate chains in the certificate file for incoming frontend connections.
src/utils/pool_ssl.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/src/utils/pool_ssl.c b/src/utils/pool_ssl.c
index fb0222888..2404e4674 100644
--- a/src/utils/pool_ssl.c
+++ b/src/utils/pool_ssl.c
@@ -257,15 +257,14 @@ static int init_ssl_ctx(POOL_CONNECTION *cp, enum ssl_conn_type conntype) {
SSL_RETURN_ERROR_IF( (! cp->ssl_ctx), "SSL_CTX_new" );
if ( conntype == ssl_conn_serverclient) {
- error = SSL_CTX_use_certificate_file(cp->ssl_ctx,
- pool_config->ssl_cert,
- SSL_FILETYPE_PEM);
- SSL_RETURN_ERROR_IF( (error <= 0), "Loading SSL certificate");
+ error = SSL_CTX_use_certificate_chain_file(cp->ssl_ctx,
+ pool_config->ssl_cert);
+ SSL_RETURN_ERROR_IF( (error != 1), "Loading SSL certificate");
error = SSL_CTX_use_PrivateKey_file(cp->ssl_ctx,
pool_config->ssl_key,
SSL_FILETYPE_PEM);
- SSL_RETURN_ERROR_IF( (error <= 0), "Loading SSL private key");
+ SSL_RETURN_ERROR_IF( (error != 1), "Loading SSL private key");
} else {
/* set extra verification if ssl_ca_cert or ssl_ca_cert_dir are set */
if (strlen(pool_config->ssl_ca_cert))
@@ -274,10 +273,10 @@ static int init_ssl_ctx(POOL_CONNECTION *cp, enum ssl_conn_type conntype) {
cacert_dir = pool_config->ssl_ca_cert_dir;
if ( cacert || cacert_dir ) {
- error = (!SSL_CTX_load_verify_locations(cp->ssl_ctx,
+ error = SSL_CTX_load_verify_locations(cp->ssl_ctx,
cacert,
- cacert_dir));
- SSL_RETURN_ERROR_IF(error, "SSL verification setup");
+ cacert_dir);
+ SSL_RETURN_ERROR_IF((error != 1), "SSL verification setup");
SSL_CTX_set_verify(cp->ssl_ctx, SSL_VERIFY_PEER, NULL);
}
}
[parent: a981719058a6]