diff options
-rw-r--r-- | ssl.c | 29 | ||||
-rw-r--r-- | ssl_backend.h | 11 | ||||
-rw-r--r-- | ssl_openssl.c | 17 |
3 files changed, 37 insertions, 20 deletions
@@ -1993,32 +1993,22 @@ init_ssl (const struct options *options, struct tls_root_ctx *new_ctx) options->pkcs12_file_inline, !options->ca_file)) goto err; } - else - { - /* Use seperate PEM files for key, cert and CA certs */ - #ifdef ENABLE_PKCS11 - if (options->pkcs11_providers[0]) - { - /* Load Certificate and Private Key */ - if (!SSL_CTX_use_pkcs11 (ctx, options->pkcs11_id_management, options->pkcs11_id)) - { - msg (M_WARN, "Cannot load certificate \"%s\" using PKCS#11 interface", options->pkcs11_id); - goto err; - } - } - else + else if (options->pkcs11_providers[0]) + { + if (0 != tls_ctx_load_pkcs11(new_ctx, options->pkcs11_id_management, options->pkcs11_id)) + goto err; + } #endif - #ifdef WIN32 - if (options->cryptoapi_cert) - { + else if (options->cryptoapi_cert) + { /* Load Certificate and Private Key */ if (!SSL_CTX_use_CryptoAPI_certificate (ctx, options->cryptoapi_cert)) msg (M_SSLERR, "Cannot load certificate \"%s\" from Microsoft Certificate Store", options->cryptoapi_cert); - } - else + } + else #endif { X509 *my_cert = NULL; @@ -2088,7 +2078,6 @@ init_ssl (const struct options *options, struct tls_root_ctx *new_ctx) msg (M_SSLERR, "Private key does not match the certificate"); } } - } if (options->ca_file || options->ca_path) { diff --git a/ssl_backend.h b/ssl_backend.h index 1bce80d..027026b 100644 --- a/ssl_backend.h +++ b/ssl_backend.h @@ -150,6 +150,17 @@ int tls_ctx_load_pkcs12(struct tls_root_ctx *ctx, const char *pkcs12_file, bool load_ca_file ); +/* + * Load PKCS #11 information for key and cert, and add to library-specific TLS + * context. + * + * TODO: document + */ +#ifdef ENABLE_PKCS11 +int tls_ctx_load_pkcs11(struct tls_root_ctx *ctx, + bool pkcs11_id_management, const char *pkcs11_id); +#endif /* ENABLE_PKCS11 */ + /** * Show the TLS ciphers that are available for us to use in the OpenSSL * library. diff --git a/ssl_openssl.c b/ssl_openssl.c index 1ba73ef..8f5fa98 100644 --- a/ssl_openssl.c +++ b/ssl_openssl.c @@ -313,6 +313,23 @@ tls_ctx_load_pkcs12(struct tls_root_ctx *ctx, const char *pkcs12_file, return 0; } +#ifdef ENABLE_PKCS11 +int +tls_ctx_load_pkcs11(struct tls_root_ctx *ctx, bool pkcs11_id_management, + const char *pkcs11_id) +{ + ASSERT(NULL != ctx); + + /* Load Certificate and Private Key */ + if (!SSL_CTX_use_pkcs11 (ctx->ctx, pkcs11_id_management, pkcs11_id)) + { + msg (M_WARN, "Cannot load certificate \"%s\" using PKCS#11 interface", pkcs11_id); + return 1; + } + return 0; +} +#endif /* ENABLE_PKCS11 */ + void show_available_tls_ciphers () { |