Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: local policy)
Message-ID: <48B6E426.2020609@velox.ch>
Date: Thu, 28 Aug 2008 19:45:10 +0200
From: Kaspar Brand <httpd-dev.2008@velox.ch>
User-Agent: Thunderbird 2.0.0.16 (Windows/20080708)
MIME-Version: 1.0
To: dev@httpd.apache.org
Subject: Re: SNI in 2.2.x (Re: Time for 2.2.10?)
References: <48AA6528.1090301@velox.ch>
 <200808201206.33906.oeriksson@mandriva.com>
 <200808281815.30555.oeriksson@mandriva.com> <48B6DCC0.3010607@velox.ch>
In-Reply-To: <48B6DCC0.3010607@velox.ch>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

I wrote:
> When I added the second condition to the first if statement, I was
> assuming that the default for auth.verify_depth is UNSET as well.
> However, it's initialized to "1" (i.e. SSL_CVERIFY_OPTIONAL)
                                         ^^^^^^^^^^^^^^^^^^^^
Wrong, of course - this macro applies to verify_*mode* (not verify_depth).

> Oden, if you change the line
> 
>      (sc->server->auth.verify_depth != UNSET)) {
> to
>      (sc->server->auth.verify_depth != SSL_CVERIFY_OPTIONAL)) {

Sorry, should consequently be changed to

      (sc->server->auth.verify_depth != 1)) {

Kaspar