tree 96531ab681a13ed0784e543191a32d79e2ce8271
parent 83a2c3d4d71fc23b9c513b456d33cc7488dff99f
author Willy Tarreau <w@1wt.eu> 1459962158 +0200
committer Willy Tarreau <w@1wt.eu> 1459962158 +0200
encoding latin1

BUG/MEDIUM: ssl: rewind the BIO when reading certificates

Emeric found that some certificate files that were valid with the old method
(the one with the explicit name involving SSL_CTX_use_PrivateKey_file()) do
not work anymore with the new one (the one trying to load multiple cert types
using PEM_read_bio_PrivateKey()). With the last one, the private key couldn't
be loaded.

The difference was related to the ordering in the PEM file was different. The
old method would always work. The new method only works if the private key is
at the top, or if it appears as an "EC" private key. The cause in fact is that
we never rewind the BIO between the various calls. So this patch moves the
loading of the private key as the first step, then it rewinds the BIO, and
then it loads the cert and the chain. With this everything works.

No backport is needed, this issue came with the recent addition of the
multi-cert support.