[Bug 233] New: openssl CAfile configuration option
https://bugzilla.balabit.com/show_bug.cgi?id=233 Summary: openssl CAfile configuration option Product: syslog-ng Version: unspecified Platform: All OS/Version: All Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi@balabit.hu ReportedBy: james@chatid.com Type of the Report: enhancement Estimated Hours: 0.0 Today I was trying to set up syslog-ng on some servers and encountered trouble configuring the server to send intermediary certificates.
From what I can see[1], the ca_dir option is the only way to get intermediary certs attached.
I can only assume that this maps down to a call to the `SSL_CTX_load_verify_locations` function in the openssl library[2] with a `NULL` CAfile argument and `ca_path` as the third argument Can a configuration option that maps to CAfile be added to syslog-ng? [1] http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.4-guide... [2] https://www.openssl.org/docs/ssl/SSL_CTX_load_verify_locations.html -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=233 --- Comment #1 from Balazs Scheidler <bazsi@balabit.hu> 2013-04-30 17:58:14 --- well, it could be, but can you elaborate your use-case? can't you split the CA file into separate files? -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=233 --- Comment #2 from James <james@chatid.com> 2013-04-30 20:59:52 --- (In reply to comment #1)
well, it could be, but can you elaborate your use-case? can't you split the CA file into separate files?
Intermediaries are often distributed concatenated in a single file; there's no reason to split it up. Perhaps a more common example: - you only want to trust a single specific CA. To do this with the current ca_dir option you need to create an empty dir and place the cert in it (or symbolic link). -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
participants (1)
-
bugzilla@bugzilla.balabit.com