BUG/MEDIUM: ssl: Fix regression about certificates generation
Since the commit f6b37c67 ["BUG/MEDIUM: ssl: in bind line, ssl-options after
'crt' are ignored."], the certificates generation is broken.
To generate a certificate, we retrieved the private key of the default
certificate using the SSL object. But since the commit f6b37c67, the SSL object
is created with a dummy certificate (initial_ctx).
So to fix the bug, we use directly the default certificate in the bind_conf
structure. We use SSL_CTX_get0_privatekey function to do so. Because this
function does not exist for OpenSSL < 1.0.2 and for LibreSSL, it has been added
in openssl-compat.h with the right #ifdef.
diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index b4d4e14..d81dd70 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -1586,8 +1586,8 @@
unsigned int i;
int key_type;
- /* Get the private key of the defautl certificate and use it */
- if (!(pkey = SSL_get_privatekey(ssl)))
+ /* Get the private key of the default certificate and use it */
+ if (!(pkey = SSL_CTX_get0_privatekey(bind_conf->default_ctx)))
goto mkcert_error;
/* Create the certificate */