Hi all.
I rework a bit the mail ssl client certificate patch on two points :
- Drop the AuthVerify header, as it is unhelpful.
- Add a new certificate fingerprint header, feature that was added
recently to http module.
Please find attached a new patch to add the "auth_http_client_cert" setting.
It allow now to configure which part(s) of the certificate will be
sent to the authentication backend script.
Comments, and review are welcomed.
Regards,
Filipe da Silva
2014-04-14 9:33 GMT+02:00 Franck Levionnois <[email protected]>:
> Hello,
>
> I forward Filipe's message, because it doesn't appear in forum's stack.
> I'm ok with the proposal.
>
> Kind Regards.
> Franck Levionnois.
>
>
> 2014-04-07 10:35 GMT+02:00 Filipe Da Silva <[email protected]>:
>
>> Hi,
>>
>> From the mail-auth-http module point of view, the Auth-Verify is a
>> trivial information.
>> Its value mostly depends of the current server configuration ( verify
>> setting ).
>> IMHO, it could be discard.
>>
>> About the various/duplicated headers related to the client
>> certificate, a smart solution
>> could be adding a 'auth_http_client_cert' setting.
>>
>> It could be either a kind of bit-field allowing to select the wanted
>> headers one by one or a log level.
>>
>> Bit-field doesn't seems to be a part of nginx configuration usages.
>> Instead, a short list of keywords could be defined, may be following
>> the OpenSSL display one:
>> http://www.openssl.org/docs/apps/x509.html#DISPLAY_OPTIONS
>>
>> Or, the auth_http_client_cert log levels could be :
>> - none
>> - basic -> just the Certificate Subject
>> - detailed : Subject, Issuer
>> - complete : Subject, Issuer, sha1 hash
>> - full -> whole certificate
>> IMHO, 'detailled' should be the default settings, if not configured.
>>
>> Regards,
>> Filipe da Silva
>>
# HG changeset patch
# Parent cc921a930c4aa0db1dc642ac0ce977e5734e59e5
Mail: Add 'SSL client auth header fields' configuration setting
Added mail configuration directive : auth_http_client_cert
Possible values are: none, cert, subject, issuer, serial, fingerprint.
The 'none' option is exclusive to any other.
diff -r cc921a930c4a src/mail/ngx_mail_auth_http_module.c
--- a/src/mail/ngx_mail_auth_http_module.c Fri Jan 24 16:26:16 2014 +0100
+++ b/src/mail/ngx_mail_auth_http_module.c Mon Jun 16 21:59:52 2014 +0200
@@ -25,6 +25,7 @@ typedef struct {
u_char *file;
ngx_uint_t line;
+ ngx_uint_t cert_fields;
} ngx_mail_auth_http_conf_t;
@@ -83,6 +84,27 @@ static char *ngx_mail_auth_http_header(n
void *conf);
+#define NGX_MAIL_AUTH_HTTP_CERTIFICATE 0x0002
+#define NGX_MAIL_AUTH_HTTP_CERT_SUBJECT 0x0010
+#define NGX_MAIL_AUTH_HTTP_CERT_ISSUER 0x0020
+#define NGX_MAIL_AUTH_HTTP_CERT_SERIAL 0x0040
+#define NGX_MAIL_AUTH_HTTP_CERT_FINGERPRINT 0x0080
+
+#define NGX_MAIL_AUTH_HTTP_CERT_NONE 0x8000
+
+#define NGX_MAIL_AUTH_HTTP_CERT_DEFAULT \
+ (NGX_MAIL_AUTH_HTTP_CERT_SUBJECT | NGX_MAIL_AUTH_HTTP_CERT_ISSUER)
+
+static ngx_conf_bitmask_t ngx_mail_auth_http_client_cert[] = {
+ { ngx_string("none"), NGX_MAIL_AUTH_HTTP_CERT_NONE },
+ { ngx_string("cert"), NGX_MAIL_AUTH_HTTP_CERTIFICATE },
+ { ngx_string("subject"), NGX_MAIL_AUTH_HTTP_CERT_SUBJECT },
+ { ngx_string("issuer"), NGX_MAIL_AUTH_HTTP_CERT_ISSUER },
+ { ngx_string("serial"), NGX_MAIL_AUTH_HTTP_CERT_SERIAL },
+ { ngx_string("fingerprint"), NGX_MAIL_AUTH_HTTP_CERT_FINGERPRINT },
+ { ngx_null_string, 0 }
+};
+
static ngx_command_t ngx_mail_auth_http_commands[] = {
{ ngx_string("auth_http"),
@@ -106,6 +128,13 @@ static ngx_command_t ngx_mail_auth_http
0,
NULL },
+ { ngx_string("auth_http_client_cert"),
+ NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_1MORE,
+ ngx_conf_set_bitmask_slot,
+ NGX_MAIL_SRV_CONF_OFFSET,
+ offsetof(ngx_mail_auth_http_conf_t, cert_fields),
+ ngx_mail_auth_http_client_cert },
+
ngx_null_command
};
@@ -1189,30 +1218,52 @@ ngx_mail_auth_http_create_request(ngx_ma
cscf = ngx_mail_get_module_srv_conf(s, ngx_mail_core_module);
#if (NGX_MAIL_SSL)
- if (s->connection->ssl) {
- if (ngx_ssl_get_certificate_oneline(s->connection, pool,
- &client_cert) != NGX_OK) {
- return NULL;
+ if (s->connection->ssl &&
+ !(ahcf->cert_fields & NGX_MAIL_AUTH_HTTP_CERT_NONE)) {
+
+ if (ahcf->cert_fields & NGX_MAIL_AUTH_HTTP_CERTIFICATE) {
+ if (ngx_ssl_get_certificate_oneline(s->connection, pool,
+ &client_cert) != NGX_OK) {
+ return NULL;
+ }
+ } else {
+ client_cert.len = 0;
}
- if (ngx_ssl_get_subject_dn(s->connection, pool,
- &client_subject) != NGX_OK) {
- return NULL;
+ if (ahcf->cert_fields & NGX_MAIL_AUTH_HTTP_CERT_SUBJECT) {
+ if (ngx_ssl_get_subject_dn(s->connection, pool,
+ &client_subject) != NGX_OK) {
+ return NULL;
+ }
+ } else {
+ client_subject.len = 0;
}
- if (ngx_ssl_get_issuer_dn(s->connection, pool,
- &client_issuer) != NGX_OK) {
- return NULL;
+ if (ahcf->cert_fields & NGX_MAIL_AUTH_HTTP_CERT_ISSUER) {
+ if (ngx_ssl_get_issuer_dn(s->connection, pool,
+ &client_issuer) != NGX_OK) {
+ return NULL;
+ }
+ } else {
+ client_issuer.len = 0;
}
- if (ngx_ssl_get_serial_number(s->connection, pool,
- &client_serial) != NGX_OK) {
- return NULL;
+ if (ahcf->cert_fields & NGX_MAIL_AUTH_HTTP_CERT_SERIAL) {
+ if (ngx_ssl_get_serial_number(s->connection, pool,
+ &client_serial) != NGX_OK) {
+ return NULL;
+ }
+ } else {
+ client_serial.len = 0;
}
- if (ngx_ssl_get_fingerprint(s->connection, pool,
- &client_fingerprint) != NGX_OK) {
- return NULL;
+ if (ahcf->cert_fields & NGX_MAIL_AUTH_HTTP_CERT_FINGERPRINT) {
+ if (ngx_ssl_get_fingerprint(s->connection, pool,
+ &client_fingerprint) != NGX_OK) {
+ return NULL;
+ }
+ } else {
+ client_fingerprint.len = 0;
}
} else {
@@ -1469,6 +1520,18 @@ ngx_mail_auth_http_merge_conf(ngx_conf_t
}
}
+ ngx_conf_merge_bitmask_value(conf->cert_fields, prev->cert_fields,
+ (NGX_CONF_BITMASK_SET
+ |NGX_MAIL_AUTH_HTTP_CERT_DEFAULT));
+
+ if ((conf->cert_fields & NGX_MAIL_AUTH_HTTP_CERT_NONE)
+ && conf->cert_fields != NGX_MAIL_AUTH_HTTP_CERT_NONE ) {
+ ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
+ "\"auth_http_client_cert none\" is an exclusive flag"
+ "%s:%ui", conf->file, conf->line);
+ return NGX_CONF_ERROR;
+ }
+
ngx_conf_merge_msec_value(conf->timeout, prev->timeout, 60000);
if (conf->headers == NULL) {
# HG changeset patch
# User Franck Levionnois <flevionnois at gmail.com>
# Date 1390577176 -3600
# Fri Jan 24 16:26:16 2014 +0100
# Node ID d7b8381c200e300c2b6729574f4c2ab537804f56
# Parent bc2ad47a3df6a931c5b335814a7fc0cf614a2e64
Mail: added support for SSL client certificate.
Add support for SSL Mutual Authentification like in http module.
Added mail configuration directives (like http):
ssl_verify_client, ssl_verify_depth, ssl_client_certificate,
ssl_trusted_certificate, ssl_crl.
Added headers:
Auth-Certificate, Auth-Issuer-DN, Auth-Subject-DN, Auth-Serial,
Auth-Cert-Fingerprint.
diff -r bc2ad47a3df6 src/mail/ngx_mail_auth_http_module.c
--- a/src/mail/ngx_mail_auth_http_module.c Sun Jun 08 12:36:26 2014 +0200
+++ b/src/mail/ngx_mail_auth_http_module.c Sun Jun 08 12:37:37 2014 +0200
@@ -1135,6 +1135,35 @@ ngx_mail_auth_http_dummy_handler(ngx_eve
"mail auth http dummy handler");
}
+#if (NGX_MAIL_SSL)
+
+static ngx_int_t
+ngx_ssl_get_certificate_oneline(ngx_connection_t *c, ngx_pool_t *pool,
+ ngx_str_t *b64_cert)
+{
+ ngx_str_t pem_cert;
+ if (ngx_ssl_get_raw_certificate(c, pool, &pem_cert) != NGX_OK) {
+ return NGX_ERROR;
+ }
+
+ if (pem_cert.len == 0) {
+ b64_cert->len = 0;
+ return NGX_OK;
+ }
+
+ b64_cert->len = ngx_base64_encoded_length(pem_cert.len);
+ b64_cert->data = ngx_palloc(pool, b64_cert->len);
+ if (b64_cert->data == NULL) {
+ b64_cert->len = 0;
+ return NGX_ERROR;
+ }
+ ngx_encode_base64(b64_cert, &pem_cert);
+
+ return NGX_OK;
+}
+
+#endif
+
static ngx_buf_t *
ngx_mail_auth_http_create_request(ngx_mail_session_t *s, ngx_pool_t *pool,
@@ -1143,6 +1172,10 @@ ngx_mail_auth_http_create_request(ngx_ma
size_t len;
ngx_buf_t *b;
ngx_str_t login, passwd;
+#if (NGX_MAIL_SSL)
+ ngx_str_t client_cert, client_subject, client_issuer,
+ client_serial, client_fingerprint;
+#endif
ngx_mail_core_srv_conf_t *cscf;
if (ngx_mail_auth_http_escape(pool, &s->login, &login) != NGX_OK) {
@@ -1155,6 +1188,42 @@ ngx_mail_auth_http_create_request(ngx_ma
cscf = ngx_mail_get_module_srv_conf(s, ngx_mail_core_module);
+#if (NGX_MAIL_SSL)
+ if (s->connection->ssl) {
+ if (ngx_ssl_get_certificate_oneline(s->connection, pool,
+ &client_cert) != NGX_OK) {
+ return NULL;
+ }
+
+ if (ngx_ssl_get_subject_dn(s->connection, pool,
+ &client_subject) != NGX_OK) {
+ return NULL;
+ }
+
+ if (ngx_ssl_get_issuer_dn(s->connection, pool,
+ &client_issuer) != NGX_OK) {
+ return NULL;
+ }
+
+ if (ngx_ssl_get_serial_number(s->connection, pool,
+ &client_serial) != NGX_OK) {
+ return NULL;
+ }
+
+ if (ngx_ssl_get_fingerprint(s->connection, pool,
+ &client_fingerprint) != NGX_OK) {
+ return NULL;
+ }
+
+ } else {
+ client_cert.len = 0;
+ client_subject.len = 0;
+ client_issuer.len = 0;
+ client_serial.len = 0;
+ client_fingerprint.len = 0;
+ }
+#endif
+
len = sizeof("GET ") - 1 + ahcf->uri.len + sizeof(" HTTP/1.0" CRLF) - 1
+ sizeof("Host: ") - 1 + ahcf->host_header.len + sizeof(CRLF) - 1
+ sizeof("Auth-Method: ") - 1
@@ -1163,6 +1232,18 @@ ngx_mail_auth_http_create_request(ngx_ma
+ sizeof("Auth-User: ") - 1 + login.len + sizeof(CRLF) - 1
+ sizeof("Auth-Pass: ") - 1 + passwd.len + sizeof(CRLF) - 1
+ sizeof("Auth-Salt: ") - 1 + s->salt.len
+#if (NGX_MAIL_SSL)
+ + sizeof("Auth-Certificate: ") - 1 + client_cert.len
+ + sizeof(CRLF) - 1
+ + sizeof("Auth-Cert-SubjectDN: ") - 1 + client_subject.len
+ + sizeof(CRLF) - 1
+ + sizeof("Auth-Cert-IssuerDN: ") - 1 + client_issuer.len
+ + sizeof(CRLF) - 1
+ + sizeof("Auth-Cert-Serial: ") - 1 + client_serial.len
+ + sizeof(CRLF) - 1
+ + sizeof("Auth-Cert-Fingerprint: ") - 1 + client_fingerprint.len
+ + sizeof(CRLF) - 1
+#endif
+ sizeof("Auth-Protocol: ") - 1 + cscf->protocol->name.len
+ sizeof(CRLF) - 1
+ sizeof("Auth-Login-Attempt: ") - 1 + NGX_INT_T_LEN
@@ -1213,6 +1294,45 @@ ngx_mail_auth_http_create_request(ngx_ma
s->passwd.data = NULL;
}
+#if (NGX_MAIL_SSL)
+ if (client_cert.len) {
+ b->last = ngx_cpymem(b->last, "Auth-Certificate: ",
+ sizeof("Auth-Certificate: ") - 1);
+ b->last = ngx_copy(b->last, client_cert.data, client_cert.len);
+ *b->last++ = CR; *b->last++ = LF;
+ }
+
+ if (client_subject.len) {
+ b->last = ngx_cpymem(b->last, "Auth-Cert-SubjectDN: ",
+ sizeof("Auth-Cert-SubjectDN: ") - 1);
+ b->last = ngx_copy(b->last, client_subject.data, client_subject.len);
+ *b->last++ = CR; *b->last++ = LF;
+ }
+
+ if (client_issuer.len) {
+ b->last = ngx_cpymem(b->last, "Auth-Cert-IssuerDN: ",
+ sizeof("Auth-Cert-IssuerDN: ") - 1);
+ b->last = ngx_copy(b->last, client_issuer.data, client_issuer.len);
+ *b->last++ = CR; *b->last++ = LF;
+ }
+
+ if (client_serial.len) {
+ b->last = ngx_cpymem(b->last, "Auth-Cert-Serial: ",
+ sizeof("Auth-Cert-Serial: ") - 1);
+ b->last = ngx_copy(b->last, client_serial.data, client_serial.len);
+ *b->last++ = CR; *b->last++ = LF;
+ }
+
+ if (client_fingerprint.len) {
+ b->last = ngx_cpymem(b->last, "Auth-Cert-Fingerprint: ",
+ sizeof("Auth-Cert-Fingerprint: ") - 1);
+ b->last = ngx_copy(b->last,
+ client_fingerprint.data, client_fingerprint.len);
+ *b->last++ = CR; *b->last++ = LF;
+ }
+
+#endif
+
b->last = ngx_cpymem(b->last, "Auth-Protocol: ",
sizeof("Auth-Protocol: ") - 1);
b->last = ngx_cpymem(b->last, cscf->protocol->name.data,
diff -r bc2ad47a3df6 src/mail/ngx_mail_handler.c
--- a/src/mail/ngx_mail_handler.c Sun Jun 08 12:36:26 2014 +0200
+++ b/src/mail/ngx_mail_handler.c Sun Jun 08 12:37:37 2014 +0200
@@ -240,11 +240,61 @@ ngx_mail_ssl_handshake_handler(ngx_conne
{
ngx_mail_session_t *s;
ngx_mail_core_srv_conf_t *cscf;
+#if (NGX_MAIL_SSL)
+ ngx_mail_ssl_conf_t *sslcf;
+#endif
+
+ ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0,
+ "ngx_mail_ssl_handshake_handler handshaked: %d",
+ c->ssl->handshaked);
if (c->ssl->handshaked) {
s = c->data;
+#if (NGX_MAIL_SSL)
+
+ sslcf = ngx_mail_get_module_srv_conf(s, ngx_mail_ssl_module);
+ if (sslcf->verify) {
+ long rc;
+
+ rc = SSL_get_verify_result(c->ssl->connection);
+
+ if (rc != X509_V_OK
+ && (sslcf->verify != 3 || !ngx_ssl_verify_error_optional(rc)))
+ {
+ ngx_log_error(NGX_LOG_INFO, c->log, 0,
+ "client SSL certificate verify error: (%l:%s)",
+ rc, X509_verify_cert_error_string(rc));
+
+ ngx_ssl_remove_cached_session(sslcf->ssl.ctx,
+ (SSL_get0_session(c->ssl->connection)));
+
+ ngx_mail_close_connection(c);
+ return;
+ }
+
+ if (sslcf->verify == 1) {
+ X509 *cert;
+ cert = SSL_get_peer_certificate(c->ssl->connection);
+
+ if (cert == NULL) {
+ ngx_log_error(NGX_LOG_INFO, c->log, 0,
+ "client sent no required SSL certificate");
+
+ ngx_ssl_remove_cached_session(sslcf->ssl.ctx,
+ (SSL_get0_session(c->ssl->connection)));
+
+ ngx_mail_close_connection(c);
+ return;
+ }
+
+ X509_free(cert);
+ }
+ }
+
+#endif
+
if (s->starttls) {
cscf = ngx_mail_get_module_srv_conf(s, ngx_mail_core_module);
diff -r bc2ad47a3df6 src/mail/ngx_mail_ssl_module.c
--- a/src/mail/ngx_mail_ssl_module.c Sun Jun 08 12:36:26 2014 +0200
+++ b/src/mail/ngx_mail_ssl_module.c Sun Jun 08 12:37:37 2014 +0200
@@ -43,6 +43,14 @@ static ngx_conf_bitmask_t ngx_mail_ssl_
{ ngx_null_string, 0 }
};
+static ngx_conf_enum_t ngx_mail_ssl_verify[] = {
+ { ngx_string("off"), 0 },
+ { ngx_string("on"), 1 },
+ { ngx_string("optional"), 2 },
+ { ngx_string("optional_no_ca"), 3 },
+ { ngx_null_string, 0 }
+};
+
static ngx_command_t ngx_mail_ssl_commands[] = {
@@ -102,6 +110,34 @@ static ngx_command_t ngx_mail_ssl_comma
offsetof(ngx_mail_ssl_conf_t, ciphers),
NULL },
+ { ngx_string("ssl_verify_client"),
+ NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1,
+ ngx_conf_set_enum_slot,
+ NGX_MAIL_SRV_CONF_OFFSET,
+ offsetof(ngx_mail_ssl_conf_t, verify),
+ &ngx_mail_ssl_verify },
+
+ { ngx_string("ssl_verify_depth"),
+ NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1,
+ ngx_conf_set_num_slot,
+ NGX_MAIL_SRV_CONF_OFFSET,
+ offsetof(ngx_mail_ssl_conf_t, verify_depth),
+ NULL },
+
+ { ngx_string("ssl_client_certificate"),
+ NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1,
+ ngx_conf_set_str_slot,
+ NGX_MAIL_SRV_CONF_OFFSET,
+ offsetof(ngx_mail_ssl_conf_t, client_certificate),
+ NULL },
+
+ { ngx_string("ssl_trusted_certificate"),
+ NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1,
+ ngx_conf_set_str_slot,
+ NGX_MAIL_SRV_CONF_OFFSET,
+ offsetof(ngx_mail_ssl_conf_t, trusted_certificate),
+ NULL },
+
{ ngx_string("ssl_prefer_server_ciphers"),
NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_FLAG,
ngx_conf_set_flag_slot,
@@ -137,6 +173,13 @@ static ngx_command_t ngx_mail_ssl_comma
offsetof(ngx_mail_ssl_conf_t, session_timeout),
NULL },
+ { ngx_string("ssl_crl"),
+ NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1,
+ ngx_conf_set_str_slot,
+ NGX_MAIL_SRV_CONF_OFFSET,
+ offsetof(ngx_mail_ssl_conf_t, crl),
+ NULL },
+
ngx_null_command
};
@@ -189,6 +232,9 @@ ngx_mail_ssl_create_conf(ngx_conf_t *cf)
* scf->certificate_key = { 0, NULL };
* scf->dhparam = { 0, NULL };
* scf->ecdh_curve = { 0, NULL };
+ * scf->client_certificate = { 0, NULL };
+ * scf->trusted_certificate = { 0, NULL };
+ * scf->crl = { 0, NULL };
* scf->ciphers = { 0, NULL };
* scf->shm_zone = NULL;
*/
@@ -196,6 +242,8 @@ ngx_mail_ssl_create_conf(ngx_conf_t *cf)
scf->enable = NGX_CONF_UNSET;
scf->starttls = NGX_CONF_UNSET_UINT;
scf->prefer_server_ciphers = NGX_CONF_UNSET;
+ scf->verify = NGX_CONF_UNSET_UINT;
+ scf->verify_depth = NGX_CONF_UNSET_UINT;
scf->builtin_session_cache = NGX_CONF_UNSET;
scf->session_timeout = NGX_CONF_UNSET;
scf->session_tickets = NGX_CONF_UNSET;
@@ -228,11 +276,20 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf,
(NGX_CONF_BITMASK_SET|NGX_SSL_SSLv3|NGX_SSL_TLSv1
|NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2));
+ ngx_conf_merge_uint_value(conf->verify, prev->verify, 0);
+ ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1);
+
ngx_conf_merge_str_value(conf->certificate, prev->certificate, "");
ngx_conf_merge_str_value(conf->certificate_key, prev->certificate_key, "");
ngx_conf_merge_str_value(conf->dhparam, prev->dhparam, "");
+ ngx_conf_merge_str_value(conf->client_certificate, prev->client_certificate,
+ "");
+ ngx_conf_merge_str_value(conf->trusted_certificate,
+ prev->trusted_certificate, "");
+ ngx_conf_merge_str_value(conf->crl, prev->crl, "");
+
ngx_conf_merge_str_value(conf->ecdh_curve, prev->ecdh_curve,
NGX_DEFAULT_ECDH_CURVE);
@@ -318,6 +375,35 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf,
return NGX_CONF_ERROR;
}
+ if (conf->verify) {
+
+ if (conf->client_certificate.len == 0 && conf->verify != 3) {
+ ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
+ "no ssl_client_certificate for ssl_client_verify");
+ return NGX_CONF_ERROR;
+ }
+
+ if (ngx_ssl_client_certificate(cf, &conf->ssl,
+ &conf->client_certificate,
+ conf->verify_depth)
+ != NGX_OK)
+ {
+ return NGX_CONF_ERROR;
+ }
+ }
+
+ if (ngx_ssl_trusted_certificate(cf, &conf->ssl,
+ &conf->trusted_certificate,
+ conf->verify_depth)
+ != NGX_OK)
+ {
+ return NGX_CONF_ERROR;
+ }
+
+ if (ngx_ssl_crl(cf, &conf->ssl, &conf->crl) != NGX_OK) {
+ return NGX_CONF_ERROR;
+ }
+
if (conf->prefer_server_ciphers) {
SSL_CTX_set_options(conf->ssl.ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
}
diff -r bc2ad47a3df6 src/mail/ngx_mail_ssl_module.h
--- a/src/mail/ngx_mail_ssl_module.h Sun Jun 08 12:36:26 2014 +0200
+++ b/src/mail/ngx_mail_ssl_module.h Sun Jun 08 12:37:37 2014 +0200
@@ -28,6 +28,8 @@ typedef struct {
ngx_uint_t starttls;
ngx_uint_t protocols;
+ ngx_uint_t verify;
+ ngx_uint_t verify_depth;
ssize_t builtin_session_cache;
time_t session_timeout;
@@ -36,6 +38,9 @@ typedef struct {
ngx_str_t certificate_key;
ngx_str_t dhparam;
ngx_str_t ecdh_curve;
+ ngx_str_t client_certificate;
+ ngx_str_t trusted_certificate;
+ ngx_str_t crl;
ngx_str_t ciphers;
_______________________________________________
nginx-devel mailing list
[email protected]
http://mailman.nginx.org/mailman/listinfo/nginx-devel
