diff options
| author | Todd Short <tshort@akamai.com> | 2015-12-28 15:13:20 +0100 |
|---|---|---|
| committer | Ben Kaduk <kaduk@mit.edu> | 2018-03-09 17:28:04 +0100 |
| commit | 37933acbeafef6db9a5c5681c1b5174cd91494bc (patch) | |
| tree | 68baa103ddb6b721bca122931479a107e4266273 /util | |
| parent | Configurations/50-win-onecore.conf: add Windows 10 OneCore targets. (diff) | |
| download | openssl-37933acbeafef6db9a5c5681c1b5174cd91494bc.tar.xz openssl-37933acbeafef6db9a5c5681c1b5174cd91494bc.zip | |
Add SSL/SSL_CTX_use_cert_and_key()
Add functions that will do the work of assigning certificate, privatekey
and chain certs to an SSL or SSL_CTX. If no privatekey is given, use the
publickey. This will permit the keys to pass validation for both ECDSA
and RSA. If a private key has already been set for the certificate, it
is discarded. A real private key can be set later.
This is an all-or-nothing setting of these parameters. Unlike the
SSL/SSL_CTX_use_certificate() and SSL/SSL_CTX_use_PrivateKey() functions,
the existing cert or privatekey is not modified (i.e. parameters copied).
This permits the existing cert/privatekey to be replaced.
It replaces the sequence of:
* SSL_use_certificate()
* SSL_use_privatekey()
* SSL_set1_chain()
And may actually be faster, as multiple checks are consolidated.
The private key can be NULL, if so an ENGINE module needs to contain the
actual private key that is to be used.
Note that ECDH (using the certificate's ECDSA key) ciphers do not work
without the private key being present, based on how the private key is
used in ECDH. ECDH does not offer PFS; ECDHE ciphers should be used instead.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/1130)
Diffstat (limited to 'util')
| -rw-r--r-- | util/libssl.num | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/util/libssl.num b/util/libssl.num index 48c5eca19d..b299035042 100644 --- a/util/libssl.num +++ b/util/libssl.num @@ -477,3 +477,5 @@ SSL_stateless 477 1_1_1 EXIST::FUNCTION: SSL_verify_client_post_handshake 478 1_1_1 EXIST::FUNCTION: SSL_force_post_handshake_auth 479 1_1_1 EXIST::FUNCTION: SSL_export_keying_material_early 480 1_1_1 EXIST::FUNCTION: +SSL_CTX_use_cert_and_key 481 1_1_1 EXIST::FUNCTION: +SSL_use_cert_and_key 482 1_1_1 EXIST::FUNCTION: |