Require client certificates once update_certs_pem() loads a client CA

SSLServer::update_certs_pem() loaded the client CA it was given but
left client certificate verification as it was, so on a server built
without a client CA it returned true while clients without a
certificate still got in. Turn verification on, as the constructors do
when they are given a client CA. A client CA passed to
update_certs_pem() now always makes client certificates required.
This commit is contained in:
yhirose committed 2026-10-21 16:41:12 -04:00
1 parent 7a9cee0e05
commit 98647e059d
2 files changed
+20 -9

No files matched your search

+3 -1
View File
@@ -18955,7 +18955,9 @@ inline bool SSLServer::update_certs_pem(const char *cert_pem,
return false;
}
if (client_ca_pem) {
return tls::update_server_client_ca(ctx_, client_ca_pem);
if (!tls::update_server_client_ca(ctx_, client_ca_pem)) { return false; }
// As in the constructors, a client CA makes client certificates required
tls::set_verify_client(ctx_, true);
}
return true;
}