[asio-users] SSL with dynamically generated certificates

[Vilius Panevėžys]

Hi all,
I'm trying to implement a server that is capable of presenting a
dynamically generated certificate. Boost.Asio SSL support does not seem
to have accounted for such a scenario, but the API to access native SSL
and SSL_CTX handles gives me hope it should be possible to use the SSL
stream normally and use a few OpenSSL functions directly to set a
generated certificate.

Unfortunately, when I try to use a generated certificate the SSL
handshake with client fails with "no shared cipher" error. If I load a
certificate from file (ssl::context::use_certificate_file) before
creating SSL stream, it works fine. If I move certificate file loading
after SSL stream creation (before accepting a connection, though), I
get the same "no shared cipher" error as in case of dynamically
generated certificate. This makes me think that the "injection" fails
and the SSL stream effectively does not use a certificate if it is set
after the stream is constructed. A similar problem is described in
StackOverflow [1], but in this case I can't load the certificate before
constructing the SSL stream as the certificate I will present depends
on what the client says in ClientHello.

I use SSL_CTX_use_certificate and SSL_CTX_use_PrivateKey on
sslContext->native_handle() to dynamically set the generated certificate
after a connection has been accepted, but before initiating
async_handshake on the client's SSL stream.

I like Asio event loop-like concept and the simple and powerful API, so
I would very much prefer finding a solution/workaround to this instead
of having to give it up and work directly with OpenSSL and sockets,
eventually "reinventing" a subset of the API.

Looking forward to any advice.


[1]
http://stackoverflow.com/questions/12217346/c-boost-asio-error-no-shared-cipher/19584759#19584759

[Vilius Panevėžys]

Even though, it turned out long ago that my question had little to do
with asio and everything to do with OpenSSL usage, a quick follow-up for
someone who might have similar confusion in the future.

On Tue, 6 May 2014 20:07:06 +0300

Post by Vilius Panevėžys
I use SSL_CTX_use_certificate and SSL_CTX_use_PrivateKey

Manipulating SSL context have no effect on connections that have
already been created. Settings from context are copied in SSL_new, to
tweak it's settings later the connection has to be manipulated directly
with functions operating on SSL*, not SSL_CTX*.