You don't need to configure certificates/keys as long as you don't
configure SSL-enabled listening ports.
This can make sense when you want to only link your local daemon to an
uplink server using SSL and only have clients on your local host or in
you fully trusted network, where SSL is not required.
- cert_file = Conf_SSLOptions.CertFile ? Conf_SSLOptions.CertFile:Conf_SSLOptions.KeyFile;
- if (!cert_file) {
- Log(LOG_ERR, "No SSL server key configured!");
- return false;
- }
-
if (array_bytes(&Conf_SSLOptions.KeyFilePassword))
Log(LOG_WARNING,
"Ignoring SSL \"KeyFilePassword\": Not supported by GnuTLS.");
if (array_bytes(&Conf_SSLOptions.KeyFilePassword))
Log(LOG_WARNING,
"Ignoring SSL \"KeyFilePassword\": Not supported by GnuTLS.");
return false;
gnutls_certificate_set_dh_params(x509_cred, dh_params);
return false;
gnutls_certificate_set_dh_params(x509_cred, dh_params);
- err = gnutls_certificate_set_x509_key_file(x509_cred, cert_file, Conf_SSLOptions.KeyFile, GNUTLS_X509_FMT_PEM);
- if (err < 0) {
- Log(LOG_ERR,
- "Failed to set certificate key file (cert %s, key %s): %s",
- cert_file,
- Conf_SSLOptions.KeyFile ? Conf_SSLOptions.KeyFile : "(NULL)",
- gnutls_strerror(err));
- return false;
+
+ cert_file = Conf_SSLOptions.CertFile ?
+ Conf_SSLOptions.CertFile : Conf_SSLOptions.KeyFile;
+ if (Conf_SSLOptions.KeyFile) {
+ err = gnutls_certificate_set_x509_key_file(x509_cred, cert_file,
+ Conf_SSLOptions.KeyFile,
+ GNUTLS_X509_FMT_PEM);
+ if (err < 0) {
+ Log(LOG_ERR,
+ "Failed to set certificate key file (cert %s, key %s): %s",
+ cert_file,
+ Conf_SSLOptions.KeyFile ? Conf_SSLOptions.KeyFile : "(NULL)",
+ gnutls_strerror(err));
+ return false;
+ }
}
/* Free currently active x509 context (if any) unless it is still in use */
}
/* Free currently active x509 context (if any) unless it is still in use */
char *cert_key;
assert(ctx);
char *cert_key;
assert(ctx);
- if (!Conf_SSLOptions.KeyFile) {
- Log(LOG_ERR, "No SSL server key configured!");
- return false;
- }
-
SSL_CTX_set_default_passwd_cb(ctx, pem_passwd_cb);
SSL_CTX_set_default_passwd_cb_userdata(ctx, &Conf_SSLOptions.KeyFilePassword);
SSL_CTX_set_default_passwd_cb(ctx, pem_passwd_cb);
SSL_CTX_set_default_passwd_cb_userdata(ctx, &Conf_SSLOptions.KeyFilePassword);
+ if (!Conf_SSLOptions.KeyFile)
+ return true;
+
if (SSL_CTX_use_PrivateKey_file(ctx, Conf_SSLOptions.KeyFile, SSL_FILETYPE_PEM) != 1) {
array_free_wipe(&Conf_SSLOptions.KeyFilePassword);
LogOpenSSLError("Failed to add private key", Conf_SSLOptions.KeyFile);
if (SSL_CTX_use_PrivateKey_file(ctx, Conf_SSLOptions.KeyFile, SSL_FILETYPE_PEM) != 1) {
array_free_wipe(&Conf_SSLOptions.KeyFilePassword);
LogOpenSSLError("Failed to add private key", Conf_SSLOptions.KeyFile);
/* not using systemd socket activation, initialize listening sockets: */
/* not using systemd socket activation, initialize listening sockets: */
+#ifdef SSL_SUPPORT
+ if (!Conf_SSLOptions.KeyFile &&
+ array_length(&Conf_SSLOptions.ListenPorts, sizeof (UINT16))) {
+ Log(LOG_ERR,
+ "Ignoring SSL-enabled listening ports: No key file set!");
+ array_free(&Conf_SSLOptions.ListenPorts);
+ }
+#endif
+
/* can't use Conf_ListenAddress directly, see below */
copy = strdup(Conf_ListenAddress);
if (!copy) {
/* can't use Conf_ListenAddress directly, see below */
copy = strdup(Conf_ListenAddress);
if (!copy) {