qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-21 18:44:45 -07:00
Code Releases Activity

crypto/tls: load a chain of certificates from a file.

Browse Source 
Many recently issued certificates are chained: there's one or more
intermediate certificates between the host certificate and the root CA
certificate. This change causes the code to load any number of
certificates from the certificate file. This matches the behaviour of
common webservers, and the output of OpenSSL's command line tools.

R=golang-dev, r2
CC=golang-dev
https://golang.org/cl/4119057
This commit is contained in:
Adam Langley 2011-02-05 13:54:25 -05:00
parent c63a88072b
commit 5626bd9e38
1 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/pkg/crypto/tls/tls.go
View File

@ -124,14 +124,22 @@ func LoadX509KeyPair(certFile string, keyFile string) (cert Certificate, err os.
return
}
certDERBlock, _ := pem.Decode(certPEMBlock)
if certDERBlock == nil {
var certDERBlock *pem.Block
for {
certDERBlock, certPEMBlock = pem.Decode(certPEMBlock)
if certDERBlock == nil {
break
}
if certDERBlock.Type == "CERTIFICATE" {
cert.Certificate = append(cert.Certificate, certDERBlock.Bytes)
}
}
if len(cert.Certificate) == 0 {
err = os.ErrorString("crypto/tls: failed to parse certificate PEM data")
return
}
cert.Certificate = [][]byte{certDERBlock.Bytes}
keyPEMBlock, err := ioutil.ReadFile(keyFile)
if err != nil {
return
@ -153,7 +161,7 @@ func LoadX509KeyPair(certFile string, keyFile string) (cert Certificate, err os.
// We don't need to parse the public key for TLS, but we so do anyway
// to check that it looks sane and matches the private key.
x509Cert, err := x509.ParseCertificate(certDERBlock.Bytes)
x509Cert, err := x509.ParseCertificate(cert.Certificate[0])
if err != nil {
return
}