Skip to content

Using SNI switching does not work if client verification is used in one of the "virtual" servers #234

@johanhedin

Description

@johanhedin

This issue is most easily described from uWebSockets point of view. When using addServerName like:

auto app = uWS::SSLApp({
    .key_file_name = "srv1.key",
    .cert_file_name = "srv1.crt"
}).addServerName("server2.example.com", {
    .key_file_name = "srv2.key",
    .cert_file_name = "srv2.crt",
    .ca_file_name = "client-ca.crt"
})
//snip
.domain("server2.example.com") 
//snip

client verification for server2 is not set up correctly. PR #224 adds the necessary SSL_set_verify() for this to work. This is also how it is done (-ish) in httpds equivalent function in mod_ssl: https://github.com/apache/httpd/blob/4a9cd1fccf8e79eda2132d65166af6e87e4f5fe9/modules/ssl/ssl_engine_kernel.c#L2591.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions