[Bug 297954] rpc.tlsservd does not serve intermediate certificates

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297954

            Bug ID: 297954
           Summary: rpc.tlsservd does not serve intermediate certificates
           Product: Base System
           Version: 15.1-RELEASE
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: bin
          Assignee: [email protected]
          Reporter: [email protected]

When rpc.tlsservd reads $certdir/cert.pem, it does so via
SSL_CTX_use_certificate_file(), which according to its documentation loads only
the first certificate in the referenced file. This means that intermediate
certificates in cert.pem are ignored and not delivered to clients during the
TLS handshake.

As there seems to be no other way to supply certificates to rpc.tlsservd, this
makes it impossible to use root CAs on clients to verify server certificates if
there are intermediate CAs between them and the server certificate.

I'm not that deep into TLS stuff, but it seems like using
SSL_CTX_use_certificate_chain_file() instead would fix this.

-- 
You are receiving this mail because:
You are the assignee for the bug.