Re: Using certificates and keys from a list

On Wed, Apr 08, 2026 at 03:24:14PM -0700, Doug Hardie wrote:

> I implemented all that code to load the certificates and keys and it
> worked just fine.  However, once I set the keys to 0600, it no longer
> worked.  The reason is that the startup code that runs as root is
> quite small.  It doesn't know which keys will be required.  In fact,
> those keys might not even exist yet.  They can be added at any time.
> Hence, the app needs to read the keys after the uid has been changed
> to the unprivileged uid.
>=20
> The solution turns out to be changing the setuid to seteuid to the
> unprivileged user, and then when the connection is starting, in the
> SSL_CTX_set_client_hello_cb routine, use seteuid (0) to go back to
> root.  After the certificate and key are loaded use seteuid to go back
> to the unprivileged user.  This is on FreeBSD.  There is a similar,
> but different implementation for Linux.

In an HTTPS server I implemented, a different approach is used.  The
directory in which the keys are stored is owned by "root", with 0700
permissions, but the private key + certificate chain files are world
readable (or group readable if preferred, the server does not care).

The process starts life as "root", opens a directory file descriptor,
and then fully drops privs.  When reading certificate files it uses
openat(2) to access the private key and certificate material through
filenames that are relative to the cached directory descriptor.

--=20
    Viktor.  =F0=9F=87=BA=F0=9F=87=A6 =D0=A1=D0=BB=D0=B0=D0=B2=D0=B0 =D0=A3=
=D0=BA=D1=80=D0=B0=D1=97=D0=BD=D1=96!

--=20
You received this message because you are subscribed to the Google Groups "=
openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msg=
id/openssl-users/adcdgpUKxhc3yQnr%40chardros.imrryr.org.