Mirrors/libwebsockets
1
0
Fork 0
mirror of https://github.com/warmcat/libwebsockets.git synced 2025-03-09 00:00:04 +01:00
Code Issues Releases Wiki Activity

mbedtls: add support for optional peer certificate

Browse source 
Check for LWS_SERVER_OPTION_PEER_CERT_NOT_REQUIRED...

AG: Fix missing stanza needed to confirm client cert needed at all

Signed-off-by: Petar Paradzik <petar.paradzik@sartura.hr>
This commit is contained in:
Petar Paradzik 2017-10-31 14:37:41 +01:00 • committed by Andy Green
parent 121d5d5940
commit 0060af62c5
1 changed files with 12 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
lib/tls/mbedtls/server.c
View file

@ -25,7 +25,18 @@ int
lws_tls_server_client_cert_verify_config(struct lws_context_creation_info *info,
struct lws_vhost *vh)
{
SSL_CTX_set_verify(vh->ssl_ctx, SSL_VERIFY_PEER, NULL);
int verify_options = SSL_VERIFY_PEER;
/* as a server, are we requiring clients to identify themselves? */
if (!lws_check_opt(info->options,
LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT))
return 0;
if (lws_check_opt(info->options, LWS_SERVER_OPTION_PEER_CERT_NOT_REQUIRED))
verify_options = SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
SSL_CTX_set_verify(vh->ssl_ctx, verify_options, NULL);
return 0;
}