diff options
| author | Mikkel Krautz <mikkel@krautz.dk> | 2017-02-26 01:10:54 +0300 |
|---|---|---|
| committer | Mikkel Krautz <mikkel@krautz.dk> | 2017-02-26 01:10:54 +0300 |
| commit | 7b500db3611184623c7b684251c8e64c8310c227 (patch) | |
| tree | ad0870d4538b69e6a2116400b14485c45b368f72 /src/murmur/Cert.cpp | |
| parent | ac02f450c95f2a17a308acba16245df55fa88505 (diff) | |
Server: treat certs from murmur.ini's sslCA as CA certs for client verification.
The sslCA option is used by people to specify extra CA certificates.
Before this patch series, the certificates from sslCA would be added
to the QSslSocket::defaultCaCertificates() list via MetaParams. Thus,
those certificates were automatically treated by QSslSocket as valid
root certificates -- by all QSslSocket instances in Murmur.
Since we've now stopped adding the sslCA certificates to the global
QSslSocket::defaultCaCertificates() list, we now have to add them to
each QSslSocket as necessary, for them to be treated as CA certificates.
One use-case for murmur.ini's sslCA option is to add extra CA
certificates in case the system CA store doesn't contain the necessary
certificates.
In Murmur, one place where CA certificates are used is when verifying
client certificats. In Murmur, if a user is using a valid CA-signed
certificate, that user has passed the 'strong' check.
As mentioned, before this patchset, all the certificates from the PEM
bundle pointed to by murmur.ini's sslCA option would be added to
QSslSocket's global default CA certificates list, which is available
via QSslSocket::defaultCaCertificates().
Thus, any CA certificates in sslCAs would be treated as CA certificates
when verifying client certificates of conecting clients.
To keep this behavior, we now add MetaParams's qlCAs to the CA list of
the each connecting client's QSslSocket.
This is useful if you are using private CA for signing
identities for Murmur. If you put your CA certificate into the PEM
bundle pointed to by sslCA, Murmur will treat users with a certificate
issued by that CA as having a valid ('strong') certificate.
Another useful use-case for this is if a user is running Murmur on an
unsupported OS, where certificate verification doesn't work due to Murmur
or Qt not being able to find the system's certificate store. In this
scenario, it is possible to point murmur.ini's sslCA option the sytem's
CA bundle, or a PEM copy of the Mozilla CA bundle. That way, verification
of client certificates from generally trusted certificate authorities is
restored.
Diffstat (limited to 'src/murmur/Cert.cpp')
0 files changed, 0 insertions, 0 deletions