|
Packit |
c4476c |
=pod
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=head1 NAME
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
SSL_CTX_set_client_cert_cb, SSL_CTX_get_client_cert_cb - handle client certificate callback function
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=head1 SYNOPSIS
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
#include <openssl/ssl.h>
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx,
|
|
Packit |
c4476c |
int (*client_cert_cb)(SSL *ssl, X509 **x509,
|
|
Packit |
c4476c |
EVP_PKEY **pkey));
|
|
Packit |
c4476c |
int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx))(SSL *ssl, X509 **x509,
|
|
Packit |
c4476c |
EVP_PKEY **pkey);
|
|
Packit |
c4476c |
int (*client_cert_cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey);
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=head1 DESCRIPTION
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
SSL_CTX_set_client_cert_cb() sets the client_cert_cb() callback, that is
|
|
Packit |
c4476c |
called when a client certificate is requested by a server and no certificate
|
|
Packit |
c4476c |
was yet set for the SSL object.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
When client_cert_cb() is NULL, no callback function is used.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
SSL_CTX_get_client_cert_cb() returns a pointer to the currently set callback
|
|
Packit |
c4476c |
function.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
client_cert_cb() is the application defined callback. If it wants to
|
|
Packit |
c4476c |
set a certificate, a certificate/private key combination must be set
|
|
Packit |
c4476c |
using the B<x509> and B<pkey> arguments and "1" must be returned. The
|
|
Packit |
c4476c |
certificate will be installed into B<ssl>, see the NOTES and BUGS sections.
|
|
Packit |
c4476c |
If no certificate should be set, "0" has to be returned and no certificate
|
|
Packit |
c4476c |
will be sent. A negative return value will suspend the handshake and the
|
|
Packit |
c4476c |
handshake function will return immediately. L<SSL_get_error(3)>
|
|
Packit |
c4476c |
will return SSL_ERROR_WANT_X509_LOOKUP to indicate, that the handshake was
|
|
Packit |
c4476c |
suspended. The next call to the handshake function will again lead to the call
|
|
Packit |
c4476c |
of client_cert_cb(). It is the job of the client_cert_cb() to store information
|
|
Packit |
c4476c |
about the state of the last call, if required to continue.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=head1 NOTES
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
During a handshake (or renegotiation) a server may request a certificate
|
|
Packit |
c4476c |
from the client. A client certificate must only be sent, when the server
|
|
Packit |
c4476c |
did send the request.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
When a certificate was set using the
|
|
Packit |
c4476c |
L<SSL_CTX_use_certificate(3)> family of functions,
|
|
Packit |
c4476c |
it will be sent to the server. The TLS standard requires that only a
|
|
Packit |
c4476c |
certificate is sent, if it matches the list of acceptable CAs sent by the
|
|
Packit |
c4476c |
server. This constraint is violated by the default behavior of the OpenSSL
|
|
Packit |
c4476c |
library. Using the callback function it is possible to implement a proper
|
|
Packit |
c4476c |
selection routine or to allow a user interaction to choose the certificate to
|
|
Packit |
c4476c |
be sent.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
If a callback function is defined and no certificate was yet defined for the
|
|
Packit |
c4476c |
SSL object, the callback function will be called.
|
|
Packit |
c4476c |
If the callback function returns a certificate, the OpenSSL library
|
|
Packit |
c4476c |
will try to load the private key and certificate data into the SSL
|
|
Packit |
c4476c |
object using the SSL_use_certificate() and SSL_use_private_key() functions.
|
|
Packit |
c4476c |
Thus it will permanently install the certificate and key for this SSL
|
|
Packit |
c4476c |
object. It will not be reset by calling L<SSL_clear(3)>.
|
|
Packit |
c4476c |
If the callback returns no certificate, the OpenSSL library will not send
|
|
Packit |
c4476c |
a certificate.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=head1 RETURN VALUES
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
SSL_CTX_get_client_cert_cb() returns function pointer of client_cert_cb() or
|
|
Packit |
c4476c |
NULL if the callback is not set.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=head1 BUGS
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
The client_cert_cb() cannot return a complete certificate chain, it can
|
|
Packit |
c4476c |
only return one client certificate. If the chain only has a length of 2,
|
|
Packit |
c4476c |
the root CA certificate may be omitted according to the TLS standard and
|
|
Packit |
c4476c |
thus a standard conforming answer can be sent to the server. For a
|
|
Packit |
c4476c |
longer chain, the client must send the complete chain (with the option
|
|
Packit |
c4476c |
to leave out the root CA certificate). This can only be accomplished by
|
|
Packit |
c4476c |
either adding the intermediate CA certificates into the trusted
|
|
Packit |
c4476c |
certificate store for the SSL_CTX object (resulting in having to add
|
|
Packit |
c4476c |
CA certificates that otherwise maybe would not be trusted), or by adding
|
|
Packit |
c4476c |
the chain certificates using the
|
|
Packit |
c4476c |
L<SSL_CTX_add_extra_chain_cert(3)>
|
|
Packit |
c4476c |
function, which is only available for the SSL_CTX object as a whole and that
|
|
Packit |
c4476c |
therefore probably can only apply for one client certificate, making
|
|
Packit |
c4476c |
the concept of the callback function (to allow the choice from several
|
|
Packit |
c4476c |
certificates) questionable.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
Once the SSL object has been used in conjunction with the callback function,
|
|
Packit |
c4476c |
the certificate will be set for the SSL object and will not be cleared
|
|
Packit |
c4476c |
even when L<SSL_clear(3)> is being called. It is therefore
|
|
Packit |
c4476c |
mandatory to destroy the SSL object using L<SSL_free(3)>
|
|
Packit |
c4476c |
and create a new one to return to the previous state.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=head1 SEE ALSO
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
L<ssl(7)>, L<SSL_CTX_use_certificate(3)>,
|
|
Packit |
c4476c |
L<SSL_CTX_add_extra_chain_cert(3)>,
|
|
Packit |
c4476c |
L<SSL_get_client_CA_list(3)>,
|
|
Packit |
c4476c |
L<SSL_clear(3)>, L<SSL_free(3)>
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=head1 COPYRIGHT
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
Copyright 2002-2018 The OpenSSL Project Authors. All Rights Reserved.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
Licensed under the OpenSSL license (the "License"). You may not use
|
|
Packit |
c4476c |
this file except in compliance with the License. You can obtain a copy
|
|
Packit |
c4476c |
in the file LICENSE in the source distribution or at
|
|
Packit |
c4476c |
L<https://www.openssl.org/source/license.html>.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=cut
|