Verify client cert chains using the proper CA

This issue belongs to an archived project. You can view it, but you can't modify it. Learn more

XMLWordPrintable

    • Type: Bug
    • Resolution: Unresolved
    • Priority: Major
    • radsecproxy-1.8
    • Affects Version/s: None
    • Component/s: code
    • None

      The fix in RADSECPROXY-43 makes radsecproxy not consider client blocks with a different 'tls' setting than the first matching one.

      We should fix this, possibly by

      i) sending the server certs from _all_ 'tls' blocks in a TLS Certificate Request (RFC 5246 sect. 7.4.4.) and
      ii) re-verify the chain of client certs after verifying their content (X509_verify_cert()?)

            Assignee:
            Linus Nordberg [X] (Inactive)
            Reporter:
            Linus Nordberg [X] (Inactive)
            Archiver:
            Josva Kleist

              Created:
              Updated:
              Archived: