GitHub user biilmann opened a pull request:
https://github.com/apache/trafficserver/pull/402
Add TSSslContextCreate method
TSSslContextCreate returns a new SSL Context that's configured according to
the settings in records.config
This is useful if an extension wants to use the TS_SSL_CERT_HOOK to
control loading of SNI certificates, and still want to respect the
cipher suite and related SSL settings.
The current experimental plugin for loading SSL certificates just use
[SSL_CTX_new(SSLv23_client_method())](https://github.com/apache/trafficserver/blob/f54fbd5bf426c8ff42c16422e9b0708f79c3745e/plugins/experimental/ssl_cert_loader/ssl-cert-loader.cc#L156)
to create a new context, and doesn't respect the cipher suite settings in
records.config.
The meat of this implementation is in SSLCreateServerContext and could be
cleaned up a lot, since there's a lot of repetition between this method and
ssl_store_ssl_context. Ideally I would refactor that method to separate context
initialization and configuration from inserting the context into the
SSLCertLookup. Just wanted to check first to see if there is support for adding
the new TSSslContextCreate API method...
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/biilmann/trafficserver ssl-ctx
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/trafficserver/pull/402.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #402
----
commit cdc051d2478da8dc6c1076a6c01ee5d9c7de7db1
Author: Mathias Biilmann Christensen <[email protected]>
Date: 2015-12-29T06:45:03Z
Add TSSslContextCreate method
This method returns a new SSL Context that's configured according to
the settings in records.config
This is useful if an extension wants to use the TS_SSL_CERT_HOOK to
control loading of SNI certificates, and still want to respect the
cipher suite and related SSL settings.
----
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at [email protected] or file a JIRA ticket
with INFRA.
---
