[
https://issues.apache.org/jira/browse/PROTON-2594?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18118634#comment-18118634
]
ASF subversion and git services commented on PROTON-2594:
---------------------------------------------------------
Commit 93ecd4448cb75387face9b0678b35f3cec77afc0 in qpid-proton's branch
refs/heads/main from Andrew Stitcher
[ https://gitbox.apache.org/repos/asf?p=qpid-proton.git;h=93ecd4448 ]
PROTON-2973: Do not dereference a NULL credential path
pn_ssl_domain_set_credentials() tests each of its two credential arguments with
is_pkcs11_uri(), which calls strncmp() on them unconditionally. Both arguments
can legitimately be NULL: the private key is documented as optional.
Before PKCS#11 support the NULL reached SSL_CTX_use_PrivateKey_file(), which
rejects it and leaves the function returning -4. The new check was simply
inserted ahead of the call that absorbed it. Restore that behaviour by treating
a NULL path as what it is - not a PKCS#11 URI - which covers the certificate
argument at the same time.
[Caused by PROTON-2594]
Assisted-By: Claude Opus 5 <[email protected]>
> Use of HSM for crypto opterations with the private key of a TLS certificate
> ---------------------------------------------------------------------------
>
> Key: PROTON-2594
> URL: https://issues.apache.org/jira/browse/PROTON-2594
> Project: Qpid Proton
> Issue Type: New Feature
> Components: cpp-binding, proton-c
> Reporter: Franz Hollerer
> Assignee: Clifford Jansen
> Priority: Major
> Fix For: proton-c-0.40.0
>
> Attachments: pn2594.c
>
>
> We use a Hardware Security Module with PKCS#11 Interface (to be more
> specific: OP-TEE) as key store. This key store holds the public and private
> key for a TLS certificate for the purpose of client authentication.
> Is there a way to instruct proton-qpid to use the HSM for cryptographic
> operations with the private key?
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
