| Subject: | Multiple directories in SSL_ca_path |
| Date: | Fri, 28 Aug 2015 17:16:18 +0100 |
| To: | bug-IO-Socket-SSL [...] rt.cpan.org |
| From: | dr1027 [...] evocat.net |
OpenSSL's SSL_CTX_load_verify_locations() accepts a list of directories to
search for certificates, eg (under unix) "/home/foo/certs:/etc/ssl/certs".
Hence Net::SSLeay::CTX_load_verify_locations does as well.
Could IO::Socket::SSL therefore also accept such a list,
eg
my $client = IO::Socket::SSL->new(
...
SSL_ca_path => '/home/foo/certs:/etc/ssl/certs',
...
);
Possibly the only changes needed to IO::Socket::SSL are on the checks as to
whether SSL_ca_path exists and is accessible. The checks would have to be
applied to each directory in SSL_ca_path instead of assuming it is a single
directory.
(I appreciate the documentation for CTX_load_verify_locations suggests only a
single directory can be given. However, crypto/x509/by_dir.c:add_cert_dir in
the openssl source splits up the CA path according to LIST_SEPARATOR_CHAR
defined in e_os.h as ':',';' or ',' according to OS. This seems to have been
the case since openssl v0.9.1c or earlier.)
Thanks,
David