Hello Viktor, On 2014-06-25 at 00:49, Viktor Dukhovni <[email protected]> wrote:
> On Tue, Jun 24, 2014 at 07:58:27PM +0200, Jens Maus wrote: > >> conn->ssLCtx = SSL_CTX_new(SSLv23_client_method()); >> SSL_CTX_set_options(conn->sslCtx, SSL_OP_ALL | SSL_OP_NO_SSLv2); >> SSL_CTX_load_verify_locations(conn->sslCtx, ?); >> SSL_CTX_set_default_verify_paths(?); >> SSL_CTX_set_verify(conn->sslCtx, ?); >> SSL_CTX_set_cert_verify_callback(conn->sslCtx, ?); >> SSL_CTX_set_cipher_list(conn->sslCtx, ?); > > The above should be done ONCE on application startup. A single > SSL_CTX can and should typically be used for multiple connections. Is this also true for multithreaded (parallel) connections? That means, can I simply create the SSL_CTX object upon starting my application and keep it throughout the whole lifetime of the application and just assign it to a new SSL connection via SSL_new()? Or is there some timeout involved or limitation with initiating parallel connections using the sam SSL_CTX? >> conn->ssl = SSL_new(conn->sslCtx); >> SSL_set_fd(conn->ssl, (int)conn->socket); >> SSL_connect(conn->ssl); > > Then for each connection just perform the above. This sounds reasonable and would be perfect for my purpose. However, I am still wondering if there are any things to consider when using a single SSL_CTX for multiple parallel connections to different servers. > >> So is there some possibility that I can load the ca-bundle.crt file in >> advance and simply supply the data to SSL_CTX instead of having to use >> SSL_CTX_load_verify_locations() which actually loads the ca-bundle.crt file >> from disk every time a new connection (and thus >> SSL_CTX_load_verify_locations()) is initiated? > > Use a single SSL_CTX to make multiple connections. As asked above. Is this also true for applications doing multiple connections in parallel to different servers? best regards, jens -- Jens Maus, Dresden/Germany http://jens-maus.de/ (Please note a real name change effective since 5.9.2013. Former name: Jens Langner) *** Content is authentic only with digital signature ***
smime.p7s
Description: S/MIME cryptographic signature
