* Allow the use of chained certificates for crypto

diff --git a/citadel/ChangeLog b/citadel/ChangeLog
index 501a21dccfb15ae92cb1523a2bb2fa9f2ef8128d..a4af2685274912a059dce60688f779f5f9966a1c 100644 (file)
--- a/citadel/ChangeLog
+++ b/citadel/ChangeLog
@@ -1,4 +1,7 @@
  $Log$
+ Revision 641.22  2005/03/05 22:31:01  ajc
+ * Allow the use of chained certificates for crypto
+
  Revision 641.21  2005/03/04 20:04:00  ajc
  * IMAP FETCH RFC822.SIZE now honors the cached rfc822 size in each
    message's metadata, using it if present and storing it for next time
@@ -6517,3 +6520,4 @@ Sat Jul 11 00:20:48 EDT 1998 Nathan Bryant <bryant@cs.usm.maine.edu>
 
 Fri Jul 10 1998 Art Cancro <ajc@uncensored.citadel.org>
        * Initial CVS import
+

diff --git a/citadel/docs/citadel.html b/citadel/docs/citadel.html
index 203ec878afec23d64bbc1b077f7457dc321c46aa..f556e97160908b3d4616de59d7d7e97207527345 100644 (file)
--- a/citadel/docs/citadel.html
+++ b/citadel/docs/citadel.html
@@ -2311,6 +2311,10 @@ Authority
 when you order the certificate. </li>
   <li>When the certificate is received, simply save it as <tt>citadel.cer</tt>
 and restart the Citadel server. </li>
+  <li>If your certificate authority delivers a 'chained' certificate (one
+with intermediate certificate authorities), simply append the intermediate
+certificate after your server's own certificate in the <tt>citadel.cer</tt>
+file.</li>
 </ul>
 <br>
 <hr style="width: 100%; height: 2px;">

diff --git a/citadel/serv_crypto.c b/citadel/serv_crypto.c
index a730f553188738993abc40499c9190abec04453b..bac21b2b04ab67eec08f83c4512b84b6572967ae 100644 (file)
--- a/citadel/serv_crypto.c
+++ b/citadel/serv_crypto.c
@@ -334,7 +334,7 @@ void init_ssl(void)
        /*
         * Now try to bind to the key and certificate.
         */
-        SSL_CTX_use_certificate_file(ssl_ctx, CTDL_CER_PATH, SSL_FILETYPE_PEM);
+        SSL_CTX_use_certificate_chain_file(ssl_ctx, CTDL_CER_PATH);
         SSL_CTX_use_PrivateKey_file(ssl_ctx, CTDL_KEY_PATH, SSL_FILETYPE_PEM);
         if ( !SSL_CTX_check_private_key(ssl_ctx) ) {
                lprintf(CTDL_CRIT, "Cannot install certificate: %s\n",