stream-ssl: Get peer-ca-cert functionality to work.
authorGurucharan Shetty <gshetty@nicira.com>
Wed, 2 Sep 2015 18:38:32 +0000 (11:38 -0700)
committerGurucharan Shetty <gshetty@nicira.com>
Fri, 18 Sep 2015 19:49:42 +0000 (12:49 -0700)
commit1b494f3e2395b8df1df4e3302b423ec3cf77963e
tree7ae5a447c0365f976a9a91ae1a2ceb7b524109a2
parent3d5b9d7843e9cf9ed7cc865ea10701cb186798d5
stream-ssl: Get peer-ca-cert functionality to work.

When --certificate option is provided, we currently use
SSL_CTX_use_certificate_chain_file() function to add
that certificate. If our single certificate file had multiple
certificates (as a chain), all of them would get added and sent
to the remote peer. But once you call
SSL_CTX_use_certificate_chain_file(), any future calls to
SSL_CTX_add_extra_chain_cert() (called when --peer-ca-cert option
is used) had no effect.

Since our man pages and INSTALL.SSL.md say that --certificate
is used to specify one certificate and additional certificates
are sent via --peer-ca-cert, this commit changes
SSL_CTX_use_certificate_chain_file() use to
SSL_CTX_use_certificate_file(). With this, additional certificates
can now be added via --peer-ca-cert option.

The test case added with this commit would fail without the
above changes.

Signed-off-by: Gurucharan Shetty <gshetty@nicira.com>
Acked-by: Ben Pfaff <blp@nicira.com>
lib/stream-ssl.c
tests/ovs-vsctl.at