openbsd - A mirror of https://github.com/libressl/openbsd.git

	Commit message (Collapse)	Author	Age	Files	Lines
*	Limit tls_config_clear_keys() to only clearing private keys.	jsing	2018-04-18	1	-2/+2
\| \| \| \| \| \| \| \|	This was inadvertently clearing the keypair, which includes the OCSP staple and pubkey hash - if an application called tls_configure() followed by tls_config_clear_keys(), this would prevent OCSP staples from working. ok beck@
*	Move the keypair pubkey hash handling code to during config.	jsing	2018-02-10	1	-47/+46
\| \| \| \| \| \| \| \| \| \| \| \| \| \|	The keypair pubkey hash was being generated and set in the keypair when the TLS context was being configured. This code should not be messing around with the keypair contents, since it is part of the config (and not the context). Instead, generate the pubkey hash and store it in the keypair when the certificate is configured. This means that we are guaranteed to have the pubkey hash and as a side benefit, we identify bad certificate content when it is provided, instead of during the context configuration. ok beck@
*	Have tls_keypair_pubkey_hash() call tls_keypair_load_cert() instead of	jsing	2018-02-08	1	-10/+5
\| \| \| \| \|	rolling its own certificate loading. This also means we get better error reporting on failure.
*	Ensure that tls_keypair_clear() clears the OCSP staple and pubkey hash.	jsing	2018-02-08	1	-6/+5
\|
*	Move tls_keypair_pubkey_hash() to the keypair file.	jsing	2018-02-08	1	-1/+40
\|
*	Split keypair handling out into its own file - it had already appeared	jsing	2018-02-08	1	-0/+146
	in multiple locations. ok beck@