lukechilds/node - node - Gitea: Git with a cup of tea

Commit Graph

Author	SHA1	Message	Date
Shigeki Ohtsu	3beb880716	crypto: add cert check to CNNIC Whitelist When client connect to the server with certification issued by either CNNIC Root CA or CNNIC EV Root CA, check hash of server certification in the list of CNNICHashWhitelist.inc. If it's not, CERT_REVOKED error returns. See for details in https://blog.mozilla.org/security/2015/04/02/distrusting-new-cnnic-certificates/ PR-URL: https://github.com/nodejs/io.js/pull/1895 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>	10 years ago
Fedor Indutny	550c2638c0	tls: use `SSL_set_cert_cb` for async SNI/OCSP Do not enable ClientHello parser for async SNI/OCSP. Use new OpenSSL-1.0.2's API `SSL_set_cert_cb` to pause the handshake process and load the cert/OCSP response asynchronously. Hopefuly this will make whole async SNI/OCSP process much faster and will eventually let us remove the ClientHello parser itself (which is currently used only for async session, see #1462 for the discussion of removing it). NOTE: Ported our code to `SSL_CTX_add1_chain_cert` to use `SSL_CTX_get0_chain_certs` in `CertCbDone`. Test provided for this feature. Fix: https://github.com/iojs/io.js/issues/1423 PR-URL: https://github.com/iojs/io.js/pull/1464 Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>	10 years ago
Shigeki Ohtsu	3a69b7689b	benchmark: add rsa/aes-gcm performance test PR-URL: https://github.com/iojs/io.js/pull/1325 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>	10 years ago
Fedor Indutny	687dfc9875	crypto: separate altname extensions with ", " In newly introduced `SafeX509ExtPrint` I forgot to insert separators between extensions, which lead to the "DNS:...DNS:..." thing for npm. Fix: iojs/io.js#105 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> PR-URL: https://github.com/iojs/io.js/pull/113.patch	10 years ago
Fedor Indutny	1bb0aeb8f2	crypto: escape DNS altname Vulnerability credit goes to: Calvin Liang conradjliang@hotmail.com Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> PR-URL: ...private	10 years ago
Adam Lippai	11d57a535c	tls: fix encoding in certificate-related functions Strings are treated as UTF8 instead of one-byte strings when names are processed and when OpenSSL's ..._print functions are used. This commit fixes simple/test-tls-peer-certificate-encoding test. fix #8366	10 years ago
Shigeki Ohtsu	0dfedb7127	tls, crypto: add DHE support In case of an invalid DH parameter file, it is sliently discarded. To use auto DH parameter in a server and DHE key length check in a client, we need to wait for the next release of OpenSSL-1.0.2. Reviewed-By: Fedor Indutny <fedor@indutny.com>	10 years ago
Fedor Indutny	93390ffc20	test: fix test-tls-server-verify fix #7963	10 years ago
Fedor Indutny	b3ef289ffb	tls: support OCSP on client and server	11 years ago
Fedor Indutny	cc4b6e6e58	crypto: clear error in GetPeerCertificate fix #6945	11 years ago
Erik Dubbelboer	bb909ad642	tls: add ECDH ciphers support Switch test fixtures to 1024 bit keys.	11 years ago
Michael Thomas	4e4860579e	test: rebuild keys without asking for password	13 years ago
Lal Jérémy	ef046bf4f6	test: generate 1024-bit keys, pacify openssl 1.0.1	13 years ago
Ryan Dahl	2e40328c82	Extend OpenSSL expiration dates	14 years ago
Theo Schlossnagle	01a864a29d	TLS: CRL support Needs more tests.	14 years ago
Ryan Dahl	778fb859c6	New keys, agent1-cert.pem was expired	14 years ago
Greg Hughes	6c32e155d3	Add ext_key_usage to getPeerCertificate	14 years ago
Ryan Dahl	907e569980	Fix expired keys	14 years ago
Ryan Dahl	5d60b06b76	Add 'make test' to test/fixtures/keys/Makefile	14 years ago
Ryan Dahl	ee5366a410	Fix CNs for agent keys; can't be the same as CA's CN Also add makefile for easy tweaking.	14 years ago
Ryan Dahl	5b8c62f7d1	Add broken, but detailed TLS verify test Plus a bunch of keys.	14 years ago

20 Commits (b3cbd133400a73a54ca8eab5165efe866b26b4c5)