From e60430a826f10cca7deaa24491589befef9b591d Mon Sep 17 00:00:00 2001 From: Vladimir Didenko Date: Tue, 5 May 2015 16:20:59 +0300 Subject: [PATCH 1/2] Fix client certificate validation. Log validation errors --- core/ssl.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/core/ssl.c b/core/ssl.c index 61768c79..eebe98c6 100644 --- a/core/ssl.c +++ b/core/ssl.c @@ -30,7 +30,18 @@ void uwsgi_ssl_info_cb(SSL const *ssl, int where, int ret) { } int uwsgi_ssl_verify_callback(int ok, X509_STORE_CTX * x509_store) { - return 1; + char buf[256]; + X509 *err_cert; + int depth; + int err; + depth = X509_STORE_CTX_get_error_depth(x509_store); + err_cert = X509_STORE_CTX_get_current_cert(x509_store); + X509_NAME_oneline(X509_get_subject_name(err_cert), buf, 256); + err = X509_STORE_CTX_get_error(x509_store); + if (!ok) { + uwsgi_log("[uwsgi-ssl] client certificate verify error: num=%d:%s:depth=%d:%s\n", err, X509_verify_cert_error_string(err), depth, buf); + } + return ok; } int uwsgi_ssl_session_new_cb(SSL *ssl, SSL_SESSION *sess) { From c444baef225de3c28f1163495ed595be80270c9e Mon Sep 17 00:00:00 2001 From: Vladimir Didenko Date: Tue, 5 May 2015 19:15:44 +0300 Subject: [PATCH 2/2] Extract verification details only in error case --- core/ssl.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/core/ssl.c b/core/ssl.c index eebe98c6..6883919d 100644 --- a/core/ssl.c +++ b/core/ssl.c @@ -30,15 +30,15 @@ void uwsgi_ssl_info_cb(SSL const *ssl, int where, int ret) { } int uwsgi_ssl_verify_callback(int ok, X509_STORE_CTX * x509_store) { - char buf[256]; - X509 *err_cert; - int depth; - int err; - depth = X509_STORE_CTX_get_error_depth(x509_store); - err_cert = X509_STORE_CTX_get_current_cert(x509_store); - X509_NAME_oneline(X509_get_subject_name(err_cert), buf, 256); - err = X509_STORE_CTX_get_error(x509_store); if (!ok) { + char buf[256]; + X509 *err_cert; + int depth; + int err; + depth = X509_STORE_CTX_get_error_depth(x509_store); + err_cert = X509_STORE_CTX_get_current_cert(x509_store); + X509_NAME_oneline(X509_get_subject_name(err_cert), buf, 256); + err = X509_STORE_CTX_get_error(x509_store); uwsgi_log("[uwsgi-ssl] client certificate verify error: num=%d:%s:depth=%d:%s\n", err, X509_verify_cert_error_string(err), depth, buf); } return ok;