Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitc3bf3bf

Browse files
committed
Tell openssl to include the names of the root certs the server trusts in
requests for client certs. This lets a client with a keystore select theappropriate client certificate to send. In particular, this is necessaryto get Java clients to work in all but the most trivial configurations.Per discussion of bug #5468.Craig Ringer
1 parent615704a commitc3bf3bf

File tree

1 file changed

+11
-2
lines changed

1 file changed

+11
-2
lines changed

‎src/backend/libpq/be-secure.c

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*
1212
*
1313
* IDENTIFICATION
14-
* $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.99 2010/02/2602:00:42 momjian Exp $
14+
* $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.100 2010/05/2615:52:37 tgl Exp $
1515
*
1616
* Since the server static private key ($DataDir/server.key)
1717
* will normally be stored unencrypted so that the database
@@ -721,6 +721,7 @@ static void
721721
initialize_SSL(void)
722722
{
723723
structstatbuf;
724+
STACK_OF(X509_NAME)*root_cert_list=NULL;
724725

725726
if (!SSL_context)
726727
{
@@ -810,7 +811,8 @@ initialize_SSL(void)
810811
ROOT_CERT_FILE)));
811812
}
812813
}
813-
elseif (SSL_CTX_load_verify_locations(SSL_context,ROOT_CERT_FILE,NULL)!=1)
814+
elseif (SSL_CTX_load_verify_locations(SSL_context,ROOT_CERT_FILE,NULL)!=1||
815+
(root_cert_list=SSL_load_client_CA_file(ROOT_CERT_FILE))==NULL)
814816
{
815817
/*
816818
* File was there, but we could not load it. This means the file is
@@ -866,6 +868,13 @@ initialize_SSL(void)
866868

867869
ssl_loaded_verify_locations= true;
868870
}
871+
872+
/*
873+
* Tell OpenSSL to send the list of root certs we trust to clients in
874+
* CertificateRequests. This lets a client with a keystore select the
875+
* appropriate client certificate to send to us.
876+
*/
877+
SSL_CTX_set_client_CA_list(SSL_context,root_cert_list);
869878
}
870879
}
871880

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp