Skip to content

Added forced client certificate validation

Ole Christian Eidheim requested to merge sebt3:master into master

Created by: sebt3

Hi,

A few notes about this pull request. The added else block is very usefull for debuging any ssl issues. It should probably either come in a #ifdef block or a configurable "if". ssl_session_ctx_id could be randomized, although as far as I know there's no security issue at having a const this way. the SSL_CTX_set_session_id_context line enable SSL session caching. It is mandatory for client certification. Performance wise it sound wise to enable it even if not using client cert (so the long ssl handshake is skipped) your verify_file is then used to match the client certificate.

Merge request reports