tree 419086085348cb1ad530ec87606f36b662bad920
parent 0ea2c4f9af92218198b31324997508fb9dae83e6
author Remi Tricot-Le Breton <rlebreton@haproxy.com> 1626193702 +0200
committer Christopher Faulet <cfaulet@haproxy.com> 1626347842 +0200

BUG/MINOR: ssl: Default-server configuration ignored by server

When a default-server line specified a client certificate to use, the
frontend would not take it into account and create an empty SSL context,
which would raise an error on the backend side ("peer did not return a
certificate").

This bug was introduced by d817dc733eacfd7cf5bb0bbc6128f44644db078e in
which the SSL contexts are created earlier than before (during the
default-server line parsing) without setting it in the corresponding
server structures. It then made the server create an empty SSL context
in ssl_sock_prepare_srv_ctx because it thought it needed one.

It was raised on redmine, in Bug #3906.

It can be backported to 2.4.

(cherry picked from commit 0498fa4059c545d9c066db094dff154174e15bca)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>