ANGRY SCREED WITH CAPS LOCK ON

diff --git a/citadel/modules/crypto/serv_crypto.c b/citadel/modules/crypto/serv_crypto.c
index 16fb4f57e03f19fdb41a2fbeaf4bc8c52fbd198c..56bd7cc486ae10ff7ddd2ef545285f9e7ebfd8e3 100644 (file)
--- a/citadel/modules/crypto/serv_crypto.c
+++ b/citadel/modules/crypto/serv_crypto.c
@@ -54,6 +54,7 @@ void generate_key(char *keyfilename) {
        FILE *fp;
 
        if (access(keyfilename, R_OK) == 0) {   // Already have one.
+               syslog(LOG_INFO, "crypto: %s exists and is readable", keyfilename);
                return;
        }
 
@@ -107,6 +108,7 @@ void generate_certificate(char *keyfilename, char *certfilename) {
        FILE *fp;
 
        if (access(certfilename, R_OK) == 0) {                  // already have one.
+               syslog(LOG_INFO, "crypto: %s exists and is readable", certfilename);
                return;
        }
 
@@ -234,10 +236,16 @@ void bind_to_key_and_certificate(void) {
        }
 
        syslog(LOG_DEBUG, "crypto: using certificate chain %s", file_crpt_file_cer);
-        SSL_CTX_use_certificate_chain_file(new_ctx, file_crpt_file_cer);
+        if (!SSL_CTX_use_certificate_chain_file(new_ctx, file_crpt_file_cer)) {
+               syslog(LOG_ERR, "crypto: SSL_CTX_use_certificate_chain_file failed: %s", ERR_reason_error_string(ERR_get_error()));
+               return;
+       }
 
        syslog(LOG_DEBUG, "crypto: using private key %s", file_crpt_file_key);
-        SSL_CTX_use_PrivateKey_file(new_ctx, file_crpt_file_key, SSL_FILETYPE_PEM);
+        if (!SSL_CTX_use_PrivateKey_file(new_ctx, file_crpt_file_key, SSL_FILETYPE_PEM)) {
+               syslog(LOG_ERR, "crypto: SSL_CTX_use_PrivateKey_file failed: %s", ERR_reason_error_string(ERR_get_error()));
+               return;
+       }
 
        old_ctx = ssl_ctx;
        ssl_ctx = new_ctx;              // All future binds will use the new certificate

diff --git a/citadel/modules/crypto/serv_crypto.h b/citadel/modules/crypto/serv_crypto.h
index 4cef7e43b4b1a55bffcf60ccccf47fe3bd5cc053..b5ee85d53bd970058333422d20ce73e017134254 100644 (file)
--- a/citadel/modules/crypto/serv_crypto.h
+++ b/citadel/modules/crypto/serv_crypto.h
@@ -5,8 +5,7 @@
 #define SIGN_DAYS      1100    // Just over three years
 
 // Which ciphers will be offered; see https://www.openssl.org/docs/manmaster/man1/ciphers.html
-//#define CIT_CIPHERS  "ALL:RC4+RSA:+SSLv2:+TLSv1:!MD5:@STRENGTH"
-#define CIT_CIPHERS    "DEFAULT"
+#define CIT_CIPHERS    "ALL:RC4+RSA:+SSLv2:+TLSv1:!MD5:@STRENGTH"
 
 #ifdef HAVE_OPENSSL
 #define OPENSSL_NO_KRB5                /* work around redhat b0rken ssl headers */