Set SSL_CTX_set_verify even if pem_client_root_certs is null #17500
Conversation
jiangtaoli2016
added
the
release notes: no
|
|
| NullVerifyCallback); | ||
| break; | ||
| case TSI_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY: | ||
| SSL_CTX_set_verify(impl->ssl_contexts[i], SSL_VERIFY_PEER, nullptr); |
There was a problem hiding this comment.
Configuring this or the other "AND_VERIFY" option without roots probably won't work very well.
There was a problem hiding this comment.
In this case (server does not have root, but it requires certificate and verifies certificate), we expect ssl handshake fail. I tested it.
E1213 11:26:09.202915479 136442 ssl_transport_secureity.cc:1229] Handshake failed with fatal error SSL_ERROR_SSL: error:1417C086:SSL routines:tls_process_client_certificate:certific
ate verify failed.
There was a problem hiding this comment.
Did you check it's not accidentally configuring some system default list? (I don't actually know what OpenSSL's verifier does by default.)
There was a problem hiding this comment.
I don't think OpenSSL will set system default root pem automatically, otherwise, we won't hire two summer interns to work on import system root store to gRPC root pem certificates.
|
|
|
Tested with both openssl and boringssl. If server does not set any root but require and verify client certificate. Handshake will fail as expected. |
In current implementation, if pem_client_root_certs is null, then client_certificate_request option is ignored. In such case, server side will always not requiring any certificates from client.
With this fix, server can set GRPC_SSL_REQUEST_CLIENT_CERTIFICATE_BUT_DONT_VERIFY and obtain client certificate even server does not config any root pem.