Jan Vcelak
e8ac17e17c
ITS#6998 MozNSS: when cert not required, ignore issuer expiration
...
When server certificate is not required in a TLS session (e.g.
TLS_REQCERT is set to 'never'), ignore expired issuer certificate error
and do not terminate the connection.
2011-07-21 11:59:06 -07:00
Rich Megginson
d944920fd3
ITS#6980 free the result of SSL_PeerCertificate
...
In tlsm_auth_cert_handler, we get the peer's cert from the socket using
SSL_PeerCertificate. This value is allocated and/or cached. We must
destroy it using CERT_DestroyCertificate.
2011-06-29 16:56:26 -07:00
Rich Megginson
5e467e4899
ITS#6862 MozNSS - workaround PR_SetEnv bug
2011-06-21 15:58:49 -07:00
Rich Megginson
d78cf81648
ITS#6975 MozNSS - allow cacertdir in most cases
...
OpenLDAP built with OpenSSL allows most any value of cacertdir - directory
is a file, directory does not contain any CA certs, directory does not
exist - users expect if they specify TLS_REQCERT=never, no matter what
the TLS_CACERTDIR setting is, TLS/SSL will just work.
TLS_CACERT, on the other hand, is a hard error. Even if TLS_REQCERT=never,
if TLS_CACERT is specified and is not a valid CA cert file, TLS/SSL will
fail. This patch makes CACERT errors hard errors, and makes CACERTDIR
errors "soft" errors. The code checks CACERT first and, even though
the function will return an error, checks CACERTDIR anyway so that if the
user sets TRACE mode they will get CACERTDIR processing messages.
2011-06-21 15:56:55 -07:00
Howard Chu
31a8460417
ITS#6863, fix crashes in ITS#6714 patch. From Jan Vcelak @ Red Hat
2011-03-16 18:23:26 +00:00
Howard Chu
bbecfa740d
ITS#6811, more for #6802 PKCS11 fork() handling from Rich Megginson @ Red Hat
2011-01-29 20:40:20 +00:00
Howard Chu
2d545befdd
Cleanup version checking
2011-01-27 21:43:22 +00:00
Howard Chu
d27f458b37
ITS#6802 restart modules for fork() - from Rich Megginson @ Red Hat
2011-01-27 21:38:40 +00:00
Howard Chu
ba70ec8b2c
ITS#6791 fix cert usage types/values - from Rich Megginson @ Red Hat
2011-01-27 21:34:35 +00:00
Howard Chu
5224536a8e
ITS#6790 fix default cipher suites - from Rich Megginson @ Red Hat
2011-01-27 21:32:39 +00:00
Kurt Zeilenga
966cef8c9a
Happy New Year
2011-01-05 00:42:37 +00:00
Howard Chu
f697a3ffed
ITS#6742 from Rich Megginson @ Red Hat
2010-12-24 00:29:31 +00:00
Howard Chu
439030a16d
ITS#6714 non-blocking support from Richard Megginson @ Red Hat
2010-12-11 04:57:10 +00:00
Hallvard Furuseth
16b7df8397
ITS#6625 Remove some LDAP_R_COMPILEs
2010-12-06 11:31:58 +00:00
Howard Chu
1ed2d0a485
ITS#6706 from Rich Megginson @ Red Hat - improve diagnostic messages
2010-11-15 20:47:24 +00:00
Howard Chu
750f7f895b
ITS#6705 from Rich Megginson @ Red Hat - only use .0 files in cacertdir
2010-11-15 20:45:47 +00:00
Howard Chu
4c31652ee8
ITS#6704 from Rich Megginson @ Red Hat - use both cacert and cacertdir
2010-11-15 20:44:32 +00:00
Howard Chu
208308d4dd
ITS#6703 from Rich Megginson @ Red Hat - reject non-files for cert/key pem files
2010-11-15 20:43:53 +00:00
Howard Chu
f26b5b6692
ITS#6689 from Rich Megginson @ Red Hat
2010-10-29 10:30:30 +00:00
Howard Chu
71f062afee
ITS#6595 remove unneeded token init code. From Rich Megginson @ RedHat.
2010-07-21 22:57:01 +00:00
Howard Chu
e0cac8a048
ITS#6589 allow self-signed server certs, from Rich Megginson @ RedHat.com
2010-07-14 23:11:34 +00:00
Kurt Zeilenga
3dadeb3efe
happy belated New Year
2010-04-13 22:17:29 +00:00
Howard Chu
68b292d869
Cleanup prev commit
2010-04-12 20:21:13 +00:00
Howard Chu
1dbefa75be
ITS#6432 updated MozNSS context and PEM support
2010-04-12 02:44:28 +00:00
Ralf Haferkamp
8fcdc29405
In case of certificate verification failures include failure reason
...
into the error message (openssl only)
2009-09-30 16:25:23 +00:00
Howard Chu
2ba0e44ad1
ITS#6278 PEM support for MozNSS from rmeggins@redhat.com, with header cleanups
2009-08-29 03:41:53 +00:00
Howard Chu
d479db53e0
Minor cleanup
2009-07-31 03:26:03 +00:00
Howard Chu
403ee0b62e
Fix, reqcert == ALLOW should ignore cert verification failures
2009-07-31 01:51:34 +00:00
Howard Chu
3f2101198b
ITS#6239 use our own hostname checking for MozNSS
2009-07-31 01:32:51 +00:00
Howard Chu
8680c13c5f
Cleanup ciphernum
2009-07-03 02:06:24 +00:00
Howard Chu
d95bc8d2d8
Acknowledge richm
2009-07-02 23:19:44 +00:00
Howard Chu
4b8485c47a
ITS#5696 Additional MozNSS support from rmeggins@redhat.com
2009-07-02 23:10:23 +00:00
Howard Chu
64884e7c6c
Don't call NSS_Shutdown if someone else init'd the library
2009-02-25 10:14:00 +00:00
Howard Chu
b886c2ad8a
ITS#5937 fix ancient IPv6 typo
2009-02-10 13:27:22 +00:00
Howard Chu
4dff3e6807
Switch to using modular TLS code, single-implementation version
2009-01-26 02:06:45 +00:00
Kurt Zeilenga
4af9eb9715
Update copyright notices
2009-01-22 00:40:04 +00:00
Howard Chu
a225b02f17
Modular TLS support, proof of concept. tls2.c would replace tls.c,
...
but I'm leaving tls.c intact for now.
2008-08-13 16:18:51 +00:00
