wt/mongoose
1
0 Fork 0
mirror of https://github.com/cesanta/mongoose.git synced 2026-10-13 10:15:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3721 from cesanta/tls

Browse Source 
Built-in TLS: accept a chain that contains the configured CA
This commit is contained in:
Sergio R. Caprile authored and GitHub committed 2026-10-06 08:58:36 -03:00
2 parents 393c811f31 c8bf39dcd8
commit 7d3fe4f9cb
2 files changed
+24
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

mongoose.c
+12
View File
@@ -18800,6 +18800,18 @@ static int mg_tls_recv_cert(struct mg_connection *c, bool is_client) {
} // else r = 0 or -2 => subj not found or pubkey not matching
}
// Single CA: accept the chain if the CA itself is in it, e.g. a
// cross-signed copy of the root. Same subject and same public key
// means the same trusted key, and the links below ci are verified
if (tls->ca_der.len > 0 && ca.subj.len == ci->subj.len &&
memcmp(ca.subj.value, ci->subj.value, ca.subj.len) == 0 &&
ca.pubkey.len == ci->pubkey.len &&
memcmp(ca.pubkey.buf, ci->pubkey.buf, ca.pubkey.len) == 0) {
found_ca = true;
MG_VERBOSE(("CA found in chain at depth %d", certnum - 1));
break;
}
if (certnum == sizeof(certs) / sizeof(certs[0]) - 1) {
mg_error(c, "too many certificates in the chain");
return -1;
src/tls_builtin.c
+12
View File
@@ -1931,6 +1931,18 @@ static int mg_tls_recv_cert(struct mg_connection *c, bool is_client) {
} // else r = 0 or -2 => subj not found or pubkey not matching
}
// Single CA: accept the chain if the CA itself is in it, e.g. a
// cross-signed copy of the root. Same subject and same public key
// means the same trusted key, and the links below ci are verified
if (tls->ca_der.len > 0 && ca.subj.len == ci->subj.len &&
memcmp(ca.subj.value, ci->subj.value, ca.subj.len) == 0 &&
ca.pubkey.len == ci->pubkey.len &&
memcmp(ca.pubkey.buf, ci->pubkey.buf, ca.pubkey.len) == 0) {
found_ca = true;
MG_VERBOSE(("CA found in chain at depth %d", certnum - 1));
break;
}
if (certnum == sizeof(certs) / sizeof(certs[0]) - 1) {
mg_error(c, "too many certificates in the chain");
return -1;