tree 6676092385623f9c4299e5021c03185fd2018bc9
parent ad92a9a7be1e249234143fb0c56ed51f7a446841
author Willy Tarreau <w@1wt.eu> 1501092596 +0200
committer Willy Tarreau <w@1wt.eu> 1501235416 +0200
encoding latin1

MINOR: ssl: add a new error codes for wrong server certificates

If a server presents an unexpected certificate to haproxy, that is, a
certificate that doesn't match the expected name as configured in
verifyhost or as requested using SNI, we want to store that precious
information. Fortunately we have access to the connection in the
verification callback so it's possible to store an error code there.

For this purpose we use CO_ER_SSL_MISMATCH_SNI (for when the cert name
didn't match the one requested using SNI) and CO_ER_SSL_MISMATCH for
when it doesn't match verifyhost.