tree e0975d9ad96e39ee0b7bcbc8dbee9ba15b4afacf
parent b4354087ee4865c8c19072fa82f26a2409d635cc
author Emeric Brun <ebrun@exceliance.fr> 1348230681 +0200
committer Willy Tarreau <w@1wt.eu> 1349159570 +0200
encoding latin1

MINOR: ssl: add ignore verify errors options

Allow to ignore some verify errors and to let them pass the handshake.

Add option 'crt-ignore-err <list>'
Ignore verify errors at depth == 0 (client certificate)
<list> is string 'all' or a comma separated list of verify error IDs
(see http://www.openssl.org/docs/apps/verify.html)

Add option 'ca-ignore-err <list>'
Same as 'crt-ignore-err' for all depths > 0 (CA chain certs)

Ex ignore all errors on CA and expired or not-yet-valid errors
on client certificate:

bind 0.0.0.0:443 ssl crt crt.pem verify required
 cafile ca.pem ca-ignore-err all crt-ignore-err 10,9