Re: Using certificates and keys from a list

I implemented all that code to load the certificates and keys and it worked=
 just fine.  However, once I set the keys to 0600, it no longer worked.  Th=
e reason is that the startup code that runs as root is quite small.  It doe=
sn't know which keys will be required.  In fact, those keys might not even =
exist yet.  They can be added at any time.  Hence, the app needs to read th=
e keys after the uid has been changed to the unprivileged uid.

The solution turns out to be changing the setuid to seteuid to the unprivil=
eged user, and then when the connection is starting, in the SSL_CTX_set_cli=
ent_hello_cb routine, use seteuid (0) to go back to root.  After the certif=
icate and key are loaded use seteuid to go back to the unprivileged user.  =
This is on FreeBSD.  There is a similar, but different implementation for L=
inux.

-- Doug


--=20
You received this message because you are subscribed to the Google Groups "=
openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msg=
id/openssl-users/09BABC0E-35C8-4964-9677-5129903D269A%40sermon-archive.info=
.