romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 01:33:31 +03:00
Code Issues Projects Releases Packages Wiki Activity

- Sam Listopad provided a patch in feature-request #1900014

Browse source 
http://curl.haxx.se/bug/feature.cgi?id=1900014 that makes libcurl (built to
  use OpenSSL) support a full chain of certificates in a given PKCS12
  certificate.
This commit is contained in:
Daniel Stenberg 2008-02-23 12:27:45 +00:00
parent 9dd3e4d481
commit 6982ed4db7
3 changed files with 42 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

35
lib/ssluse.c
View file

@ -364,6 +364,8 @@ int cert_stuff(struct connectdata *conn,
FILE *f;
PKCS12 *p12;
EVP_PKEY *pri;
STACK_OF(X509) *ca = NULL;
int i;
f = fopen(cert_file,"rb");
if(!f) {
@ -373,10 +375,15 @@ int cert_stuff(struct connectdata *conn,
p12 = d2i_PKCS12_fp(f, NULL);
fclose(f);
if(!p12) {
failf(data, "error reading PKCS12 file '%s'", cert_file );
return 0;
}
PKCS12_PBE_add();
if(!PKCS12_parse(p12, data->set.str[STRING_KEY_PASSWD], &pri, &x509,
NULL)) {
&ca)) {
failf(data,
"could not parse PKCS12 file, check password, OpenSSL error %s",
ERR_error_string(ERR_get_error(), NULL) );
@ -401,6 +408,32 @@ int cert_stuff(struct connectdata *conn,
return 0;
}
if (!SSL_CTX_check_private_key (ctx)) {
failf(data, "private key from PKCS12 file '%s' "
"does not match certificate in same file", cert_file);
EVP_PKEY_free(pri);
X509_free(x509);
return 0;
}
/* Set Certificate Verification chain */
if (ca && sk_num(ca)) {
for (i = 0; i < sk_X509_num(ca); i++) {
if (!SSL_CTX_add_extra_chain_cert(ctx,sk_X509_value(ca, i))) {
failf(data, "cannot add certificate to certificate chain");
EVP_PKEY_free(pri);
X509_free(x509);
return 0;
}
if (!SSL_CTX_add_client_CA(ctx, sk_X509_value(ca, i))) {
failf(data, "cannot add certificate to client CA list",
cert_file);
EVP_PKEY_free(pri);
X509_free(x509);
return 0;
}
}
}
EVP_PKEY_free(pri);
X509_free(x509);
cert_done = 1;