Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ca-trust-file in inadyn.conf has no effect for gnutls #391

Open
1 of 2 tasks
cg2v opened this issue Sep 24, 2022 · 1 comment
Open
1 of 2 tasks

ca-trust-file in inadyn.conf has no effect for gnutls #391

cg2v opened this issue Sep 24, 2022 · 1 comment
Labels
blocker Blocks the next release it's targeted for help-wanted

Comments

@cg2v
Copy link

cg2v commented Sep 24, 2022 •
edited by troglobit
Loading

Since ssl_init is called before the first conf_parse_file, ssl_init does not have access to the value of ca-trust-file. openssl.c defers setting the ca location to ssl_open, so it does not have that problem.

This is likely the cause of #255, which I also experienced on Redhat Enterprise 8.

There's an additional problem that gnutls cannot use openssl "BEGIN TRUSTED CERTIFICATE" blocks, so cannot use the default CAFILE2.
@troglobit troglobit added help-wanted blocker Blocks the next release it's targeted for labels Sep 26, 2022
@troglobit troglobit mentioned this issue Oct 2, 2022
Open
troglobit added a commit that referenced this issue Oct 2, 2022
@troglobit
Fix #393: defer setting GnuTLS CA trust to ssl_open()
0dd3efa 
As mentioned in #391, setting the CA trust for the OpenSSL backend is
deferred to ssl_open().  This patch defers the GnuTLS CA init in a
similar fashion, allowing a custom user-defined trust file to be set
also when using the GnuTLS backend.

Verified manually with the FreeDNS plugin and three different CA files:

 - /etc/ssl/certs/ca-certificates.crt (everything works, CAFILE1)
 - /etc/ssl/certs/UCA_Global_G2_Root.pem (validation fails, expected)
 - /usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt (works)

Signed-off-by: Joachim Wiberg <[email protected]>
@troglobit
Copy link
Owner

I've split this issue in two parts, first part fixed in 0dd3efa, the other I'd appreciate some help with.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
blocker Blocks the next release it's targeted for help-wanted
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@troglobit @cg2v