Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of DRuggeri@primary.net
 designates 216.87.38.199 as permitted sender)
Message-ID: <4E623321.5080105@primary.net>
Date: Sat, 03 Sep 2011 09:01:05 -0500
From: Daniel Ruggeri <DRuggeri@primary.net>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
 rv:6.0.1) Gecko/20110830 Thunderbird/6.0.1
MIME-Version: 1.0
To: dev@httpd.apache.org
Subject: Re: svn commit: r1160863 - in /httpd/httpd/trunk:
 docs/manual/mod/modules/ssl/
References: <20110823193508.9E41A2388A02@eris.apache.org>
 <4E61C3CE.4020500@velox.ch>
In-Reply-To: <4E61C3CE.4020500@velox.ch>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

On 9/3/2011 1:06 AM, Kaspar Brand wrote:
> Nit: could you replace "intermediary" by "intermediate" in all log
> messages and comments? The former isn't really an X.509/PKIX term. (In
> the above message, I suggest saying "intermediate CA certificates".)
No problem.

> I think it's preferrable to let OpenSSL build the chain (instead of
> doing it ourselves). There's no readily available function for this,
> unfortunately, but could you try something along the lines in OpenSSL's
> s3_both.c:ssl3_output_cert_chain()? See
>
>   http://cvs.openssl.org/chngview?cn=18326
>
> I.e., use X509_verify_cert(), ignore its result, but grab the chain from
> the X509_STORE_CTX afterwards. (And when you're done, it's probably
> wise to call ERR_clear_error, see http://cvs.openssl.org/chngview?cn=19472).
I searched for a function to do exactly this and came up empty. Thank
you very much for bringing this to my attention! I'll definitely update
the patch with this because the method I'm using is certainly a
sticks-and-stones approach.

-- 
--
Daniel Ruggeri