Re: Using certificates and keys from a list

> On Apr 9, 2026, at 09:18, Jochen Bern <[email protected]> wrote:
>=20
> Am 09.04.26 um 17:48 schrieb Doug Hardie:
>> This app needs to access key files during the SSL Client Hello processin=
g.
>> [...] The only thing that takes place before the client hello call back
>> is the initialization of the SSL parameters. [...] The one valid concern
>> is that retaining the UID of root throughout the remainder of the app
>> might somehow reset the euid back to root.  Hence, I am changing the
>> last part of the call back to setuid to the unprivileged user.  I
>> believe that will prevent any follow on code from changing it.
>=20
> Does that mean that your server-side application (instance/process) *term=
inates* after processing *one* TCP connection (might preclude TLS session r=
euse)? In that case, I'd agree that fully relinquishing the elevated rights=
 ASAP (just with an adapted definition of "AP") would be even better.

That is correct.  Once the TCP connection closes, the app terminates.  It o=
nly handles on connection.  There is just too much instance information sto=
red in the app to be able to easily cleanse it to handle another connection=
.  It is just easier to limit it to one connection.  The connection rate is=
 quite low, so the additional overhead of forking for each connection is no=
t significant.

-- Doug


--=20
You received this message because you are subscribed to the Google Groups "=
openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msg=
id/openssl-users/FA79F75E-D024-46D1-B1D0-B0A13BD6B0C0%40lafn.org.