Skip to content

Commit 069971f

Browse files
gstraussgstrauss
committed
[TLS] issue trace if unable to check/refresh cert
when configured to check/refresh certificates server.feature-flags += ("ssl.refresh-certs" => "enable")
1 parent 9e60222 commit 069971f

File tree

5 files changed

+80
-10
lines changed

5 files changed

+80
-10
lines changed

‎src/mod_gnutls.c‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3361,6 +3361,18 @@ mod_gnutls_refresh_plugin_ssl_ctx (plugin_ssl_ctx * const s)
33613361
}
33623362

33633363

3364+
__attribute_cold__
3365+
static int
3366+
mod_gnutls_refresh_plugin_cert_fail (server * const srv, plugin_cert * const pc)
3367+
{
3368+
log_perror(srv->errh, __FILE__, __LINE__,
3369+
"GnuTLS: unable to check/refresh cert key; "
3370+
"continuing to use already-loaded %s",
3371+
pc->ssl_privkey->ptr);
3372+
return 0;
3373+
}
3374+
3375+
33643376
static int
33653377
mod_gnutls_refresh_plugin_cert (server * const srv, plugin_cert * const pc)
33663378
{
@@ -3388,15 +3400,17 @@ mod_gnutls_refresh_plugin_cert (server * const srv, plugin_cert * const pc)
33883400
* update privkey last, after pem file (and OCSP stapling file) */
33893401
struct stat st;
33903402
if (0 != stat(pc->ssl_privkey->ptr, &st))
3391-
return 0; /* ignore if stat() error; keep using existing crt/pk */
3403+
return mod_gnutls_refresh_plugin_cert_fail(srv, pc);
3404+
/* ignore if stat() error; keep using existing crt/pk */
33923405
if (TIME64_CAST(st.st_mtime) <= pc->pkey_ts)
33933406
return 0; /* mtime match; no change */
33943407

33953408
plugin_cert *npc =
33963409
network_gnutls_load_pemfile(srv, pc->ssl_pemfile, pc->ssl_privkey,
33973410
pc->ssl_stapling_file);
33983411
if (NULL == npc)
3399-
return 0; /* ignore if crt/pk error; keep using existing crt/pk */
3412+
return mod_gnutls_refresh_plugin_cert_fail(srv, pc);
3413+
/* ignore if crt/pk error; keep using existing crt/pk */
34003414

34013415
/*(future: if threaded, only one thread should update pcs)*/
34023416

‎src/mod_mbedtls.c‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2985,6 +2985,18 @@ mod_mbedtls_refresh_plugin_ssl_ctx (server * const srv, plugin_ssl_ctx * const s
29852985
}
29862986

29872987

2988+
__attribute_cold__
2989+
static int
2990+
mod_mbedtls_refresh_plugin_cert_fail (server * const srv, plugin_cert * const pc)
2991+
{
2992+
log_perror(srv->errh, __FILE__, __LINE__,
2993+
"MTLS: unable to check/refresh cert key; "
2994+
"continuing to use already-loaded %s",
2995+
pc->ssl_privkey->ptr);
2996+
return 0;
2997+
}
2998+
2999+
29883000
static int
29893001
mod_mbedtls_refresh_plugin_cert (server * const srv, plugin_cert * const pc)
29903002
{
@@ -3012,14 +3024,16 @@ mod_mbedtls_refresh_plugin_cert (server * const srv, plugin_cert * const pc)
30123024
* update privkey last, after pem file (and OCSP stapling file) */
30133025
struct stat st;
30143026
if (0 != stat(pc->ssl_privkey->ptr, &st))
3015-
return 0; /* ignore if stat() error; keep using existing crt/pk */
3027+
return mod_mbedtls_refresh_plugin_cert_fail(srv, pc);
3028+
/* ignore if stat() error; keep using existing crt/pk */
30163029
if (TIME64_CAST(st.st_mtime) <= pc->pkey_ts)
30173030
return 0; /* mtime match; no change */
30183031

30193032
plugin_cert *npc =
30203033
network_mbedtls_load_pemfile(srv, pc->ssl_pemfile, pc->ssl_privkey);
30213034
if (NULL == npc)
3022-
return 0; /* ignore if crt/pk error; keep using existing crt/pk */
3035+
return mod_mbedtls_refresh_plugin_cert_fail(srv, pc);
3036+
/* ignore if crt/pk error; keep using existing crt/pk */
30233037

30243038
/*(future: if threaded, only one thread should update pcs)*/
30253039

‎src/mod_nss.c‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2885,6 +2885,18 @@ mod_nss_refresh_plugin_ssl_ctx (server * const srv, plugin_ssl_ctx * const s)
28852885
}
28862886

28872887

2888+
__attribute_cold__
2889+
static int
2890+
mod_nss_refresh_plugin_cert_fail (server * const srv, plugin_cert * const pc)
2891+
{
2892+
log_perror(srv->errh, __FILE__, __LINE__,
2893+
"NSS: unable to check/refresh cert key; "
2894+
"continuing to use already-loaded %s",
2895+
pc->ssl_privkey->ptr);
2896+
return 0;
2897+
}
2898+
2899+
28882900
static int
28892901
mod_nss_refresh_plugin_cert (server * const srv, plugin_cert * const pc)
28902902
{
@@ -2912,15 +2924,17 @@ mod_nss_refresh_plugin_cert (server * const srv, plugin_cert * const pc)
29122924
* update privkey last, after pem file (and OCSP stapling file) */
29132925
struct stat st;
29142926
if (0 != stat(pc->ssl_privkey->ptr, &st))
2915-
return 0; /* ignore if stat() error; keep using existing crt/pk */
2927+
return mod_nss_refresh_plugin_cert_fail(srv, pc);
2928+
/* ignore if stat() error; keep using existing crt/pk */
29162929
if (TIME64_CAST(st.st_mtime) <= pc->pkey_ts)
29172930
return 0; /* mtime match; no change */
29182931

29192932
plugin_cert *npc =
29202933
network_nss_load_pemfile(srv, pc->ssl_pemfile, pc->ssl_privkey,
29212934
pc->ssl_stapling_file);
29222935
if (NULL == npc)
2923-
return 0; /* ignore if crt/pk error; keep using existing crt/pk */
2936+
return mod_nss_refresh_plugin_cert_fail(srv, pc);
2937+
/* ignore if crt/pk error; keep using existing crt/pk */
29242938

29252939
/*(future: if threaded, only one thread should update pcs)*/
29262940

‎src/mod_openssl.c‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5042,6 +5042,18 @@ mod_openssl_refresh_plugin_ssl_ctx (server * const srv, plugin_ssl_ctx * const s
50425042
}
50435043

50445044

5045+
__attribute_cold__
5046+
static int
5047+
mod_openssl_refresh_plugin_cert_fail (server * const srv, plugin_cert * const pc)
5048+
{
5049+
log_perror(srv->errh, __FILE__, __LINE__,
5050+
"SSL: unable to check/refresh cert key; "
5051+
"continuing to use already-loaded %s",
5052+
pc->ssl_privkey->ptr);
5053+
return 0;
5054+
}
5055+
5056+
50455057
static int
50465058
mod_openssl_refresh_plugin_cert (server * const srv, plugin_cert * const pc)
50475059
{
@@ -5069,15 +5081,17 @@ mod_openssl_refresh_plugin_cert (server * const srv, plugin_cert * const pc)
50695081
* update privkey last, after pem file (and OCSP stapling file) */
50705082
struct stat st;
50715083
if (0 != stat(pc->ssl_privkey->ptr, &st))
5072-
return 0; /* ignore if stat() error; keep using existing crt/pk */
5084+
return mod_openssl_refresh_plugin_cert_fail(srv, pc);
5085+
/* ignore if stat() error; keep using existing crt/pk */
50735086
if (TIME64_CAST(st.st_mtime) <= pc->pkey_ts)
50745087
return 0; /* mtime match; no change */
50755088

50765089
plugin_cert *npc =
50775090
network_openssl_load_pemfile(srv, pc->ssl_pemfile, pc->ssl_privkey,
50785091
pc->ssl_stapling_file);
50795092
if (NULL == npc)
5080-
return 0; /* ignore if crt/pk error; keep using existing crt/pk */
5093+
return mod_openssl_refresh_plugin_cert_fail(srv, pc);
5094+
/* ignore if crt/pk error; keep using existing crt/pk */
50815095

50825096
/*(future: if threaded, only one thread should update pcs)*/
50835097

‎src/mod_wolfssl.c‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3795,6 +3795,18 @@ mod_wolfssl_refresh_plugin_ssl_ctx (server * const srv, plugin_ssl_ctx * const s
37953795
}
37963796

37973797

3798+
__attribute_cold__
3799+
static int
3800+
mod_wolfssl_refresh_plugin_cert_fail (server * const srv, plugin_cert * const pc)
3801+
{
3802+
log_perror(srv->errh, __FILE__, __LINE__,
3803+
"SSL: unable to check/refresh cert key; "
3804+
"continuing to use already-loaded %s",
3805+
pc->ssl_privkey->ptr);
3806+
return 0;
3807+
}
3808+
3809+
37983810
static int
37993811
mod_wolfssl_refresh_plugin_cert (server * const srv, plugin_cert * const pc)
38003812
{
@@ -3822,15 +3834,17 @@ mod_wolfssl_refresh_plugin_cert (server * const srv, plugin_cert * const pc)
38223834
* update privkey last, after pem file (and OCSP stapling file) */
38233835
struct stat st;
38243836
if (0 != stat(pc->ssl_privkey->ptr, &st))
3825-
return 0; /* ignore if stat() error; keep using existing crt/pk */
3837+
return mod_wolfssl_refresh_plugin_cert_fail(srv, pc);
3838+
/* ignore if stat() error; keep using existing crt/pk */
38263839
if (TIME64_CAST(st.st_mtime) <= pc->pkey_ts)
38273840
return 0; /* mtime match; no change */
38283841

38293842
plugin_cert *npc =
38303843
network_openssl_load_pemfile(srv, pc->ssl_pemfile, pc->ssl_privkey,
38313844
pc->ssl_stapling_file);
38323845
if (NULL == npc)
3833-
return 0; /* ignore if crt/pk error; keep using existing crt/pk */
3846+
return mod_wolfssl_refresh_plugin_cert_fail(srv, pc);
3847+
/* ignore if crt/pk error; keep using existing crt/pk */
38343848

38353849
/*(future: if threaded, only one thread should update pcs)*/
38363850

0 commit comments

Comments
 (0)