static SSL_CTX *context;
static EVP_PKEY *pkey;
+static char const * ciphers = "EECDH+CHACHA20:EECDH+AESGCM:EECDH+AES+TLSv1.2:EECDH+AES:AESGCM:AES:!aNULL:!DHE:!kECDH";
+
static int verify_callback(int preverify_ok, X509_STORE_CTX *ctx);
static int SSL_add_ext(X509 * crt, int nid, char *value) {
ERR_load_crypto_strings();
context = SSL_CTX_new(SSLv23_server_method());
+ SSL_CTX_set_options(context, SSL_OP_NO_SSLv2);
+ SSL_CTX_set_options(context, SSL_OP_NO_SSLv3);
+ SSL_CTX_set_options(context, SSL_OP_CIPHER_SERVER_PREFERENCE);
if (context == NULL)
{
ERR_print_errors_fp(stderr);
abort();
}
+ SSL_CTX_set_cipher_list(context, ciphers);
+
+ EC_KEY *ecdhkey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+ SSL_CTX_set_tmp_ecdh(context, ecdhkey);
+ EC_KEY_free(ecdhkey);
+
char const * sslCAPath = getStrConf(CAPATH);
if(sslCAPath != NULL)
{
* it for something special
*/
if (!preverify_ok && (err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT)) {
- X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert), buf, 256);
+ X509_NAME_oneline(X509_get_issuer_name(err_cert), buf, 256);
Log_warn("issuer= %s", buf);
}
return 1;