Hi there, I tried to setup my first repository on a remote server today and I had quite a few problems with Fossil and SSL.
First I had doubts about binary integrity, because it was way larger than usual, but hashs seemed to match so I tried and then I had this error: Server: https://[email protected]/garradin/ Bytes Cards Artifacts Deltas Sent: 279 4 0 0 waiting for server...fossil: relocation error: /lib/libnss_mdns4_minimal.so.2: symbol strlen, version GLIBC_2.0 not defined in file libc.so.6 with link time reference Strange... Then I tried to compile my own fossil binary and this is what happened: Server: https://[email protected]/garradin/ Bytes Cards Artifacts Deltas Sent: 279 4 0 0 waiting for server... SSL verification failed: certificate has expired Certificate received: commonName = kd2.org ... Wait, what? OK so I figured it out, my webserver uses SNI (great feature, see http://en.wikipedia.org/wiki/Server_Name_Indication ) to match the hostname to the right vhost. So if the certificate CN seen by the client is not fossil.kd2.org but kd2.org it means that the client doesn't have SNI and hits the default vhost with the default certificate. So it appears that Fossil doesn't support SNI. I did a small patch in src/http_ssl.c and it seems to work, but maybe it's not the best code for that purpose as I usually don't work in C: 214a215 > SSL_set_tlsext_host_name(ssl, g.urlName); Thanks. -- bohwaz _______________________________________________ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
