tree b38f3afb2cebe2e065c1d41ad01cae44a31861de
parent 37950c8d271ea7191f958299f79e4306f6db8506
author Emmanuel Hocdet <manu@gandi.net> 1582902034 +0100
committer William Lallemand <wlallemand@haproxy.org> 1585223633 +0100

MINOR: ssl: skip self issued CA in cert chain for ssl_ctx

First: self issued CA, aka root CA, is the enchor for chain validation,
no need to send it, client must have it. HAProxy can skip it in ssl_ctx.
Second: the main motivation to skip root CA in ssl_ctx is to be able to
provide it in the chain without drawback. Use case is to provide issuer
for ocsp without the need for .issuer and be able to share it in
issuers-chain-path. This concerns all certificates without intermediate
certificates. It's useless for BoringSSL, .issuer is ignored because ocsp
bits doesn't need it.