Tree: bcec2fecbd

Commit Graph

1 Commits (bcec2fecbdb3e86fceff5c66678e4443666f78b9)

Author	SHA1	Message	Date
Shigeki Ohtsu	3beb880716	crypto: add cert check to CNNIC Whitelist When client connect to the server with certification issued by either CNNIC Root CA or CNNIC EV Root CA, check hash of server certification in the list of CNNICHashWhitelist.inc. If it's not, CERT_REVOKED error returns. See for details in https://blog.mozilla.org/security/2015/04/02/distrusting-new-cnnic-certificates/ PR-URL: https://github.com/nodejs/io.js/pull/1895 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>	10 years ago
Fedor Indutny	550c2638c0	tls: use `SSL_set_cert_cb` for async SNI/OCSP Do not enable ClientHello parser for async SNI/OCSP. Use new OpenSSL-1.0.2's API `SSL_set_cert_cb` to pause the handshake process and load the cert/OCSP response asynchronously. Hopefuly this will make whole async SNI/OCSP process much faster and will eventually let us remove the ClientHello parser itself (which is currently used only for async session, see #1462 for the discussion of removing it). NOTE: Ported our code to `SSL_CTX_add1_chain_cert` to use `SSL_CTX_get0_chain_certs` in `CertCbDone`. Test provided for this feature. Fix: https://github.com/iojs/io.js/issues/1423 PR-URL: https://github.com/iojs/io.js/pull/1464 Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>	10 years ago
Ryan Dahl	778fb859c6	New keys, agent1-cert.pem was expired	14 years ago
Ryan Dahl	ee5366a410	Fix CNs for agent keys; can't be the same as CA's CN Also add makefile for easy tweaking.	14 years ago