On Tue, Jun 24, 2014 at 07:58:27PM +0200, Jens Maus wrote:
> conn->ssLCtx = SSL_CTX_new(SSLv23_client_method());
> SSL_CTX_set_options(conn->sslCtx, SSL_OP_ALL | SSL_OP_NO_SSLv2);
> SSL_CTX_load_verify_locations(conn->sslCtx, ?);
> SSL_CTX_set_default_verify_paths(?);
> SSL_CTX_set_verify(conn->sslCtx, ?);
> SSL_CTX_set_cert_verify_callback(conn->sslCtx, ?);
> SSL_CTX_set_cipher_list(conn->sslCtx, ?);
The above should be done ONCE on application startup. A single
SSL_CTX can and should typically be used for multiple connections.
> conn->ssl = SSL_new(conn->sslCtx);
> SSL_set_fd(conn->ssl, (int)conn->socket);
> SSL_connect(conn->ssl);
Then for each connection just perform the above.
> So is there some possibility that I can load the ca-bundle.crt file in
> advance and simply supply the data to SSL_CTX instead of having to use
> SSL_CTX_load_verify_locations() which actually loads the ca-bundle.crt file
> from disk every time a new connection (and thus
> SSL_CTX_load_verify_locations()) is initiated?
Use a single SSL_CTX to make multiple connections.
--
Viktor.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [email protected]
