diff options
| author | Maxim Dounin <mdounin@mdounin.ru> | 2012-11-13 10:42:16 +0000 |
|---|---|---|
| committer | Maxim Dounin <mdounin@mdounin.ru> | 2012-11-13 10:42:16 +0000 |
| commit | 71b6604e4465b6aac478f04c3608a6be5c6500e6 (patch) | |
| tree | 69d9583a55a99dabd167e17cae48df4baa9cc42c /src/http/ngx_http_request.c | |
| parent | 0e6c7b0614eafd628c2abe93e5418599a025b552 (diff) | |
| download | nginx-71b6604e4465b6aac478f04c3608a6be5c6500e6.tar.gz nginx-71b6604e4465b6aac478f04c3608a6be5c6500e6.tar.bz2 | |
Merge of r4885: ssl_verify_client optional_no_ca.
SSL: the "ssl_verify_client" directive parameter "optional_no_ca".
This parameter allows to don't require certificate to be signed by
a trusted CA, e.g. if CA certificate isn't known in advance, like in
WebID protocol.
Note that it doesn't add any security unless the certificate is actually
checked to be trusted by some external means (e.g. by a backend).
Patch by Mike Kazantsev, Eric O'Connor.
Diffstat (limited to '')
| -rw-r--r-- | src/http/ngx_http_request.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c index c104db1c0..479b106cf 100644 --- a/src/http/ngx_http_request.c +++ b/src/http/ngx_http_request.c @@ -1634,7 +1634,9 @@ ngx_http_process_request(ngx_http_request_t *r) if (sscf->verify) { rc = SSL_get_verify_result(c->ssl->connection); - if (rc != X509_V_OK) { + if (rc != X509_V_OK + && (sscf->verify != 3 || !ngx_ssl_verify_error_optional(rc))) + { ngx_log_error(NGX_LOG_INFO, c->log, 0, "client SSL certificate verify error: (%l:%s)", rc, X509_verify_cert_error_string(rc)); |