[OpenSIPS-Devel] [OpenSIPS/opensips] 552663: tls_mgm: fix require_cert and verify_cert enforcem...

[Răzvan Crainea]

  Branch: refs/heads/master
  Home:   https://github.com/OpenSIPS/opensips
  Commit: 5526637f38b855b51d3627e30618c9458a1d0ce9
      https://github.com/OpenSIPS/opensips/commit/5526637f38b855b51d3627e30618c9458a1d0ce9
  Author: Ivan Poddubny <ivan.poddubny at gmail.com>
  Date:   2026-07-21 (Tue, 21 Jul 2026)

  Changed paths:
    M modules/tls_openssl/openssl_config.c
    M modules/tls_wolfssl/wolfssl_config.c

  Log Message:
  -----------
  tls_mgm: fix require_cert and verify_cert enforcement for virtual domains

Multiple virtual TLS domains can be defined on a single socket via
match_sip_domain (SNI), each with distinct require_cert and verify_cert
settings. However, these domain-specific verification rules were
never applied to the connection during the TLS handshake, leaving only
the socket's default settings enforced.

This commit adds SSL_set_verify to the SNI callbacks for both OpenSSL
and WolfSSL to ensure the correct domain-specific rules are applied.


  Commit: 3ed3b93187fc577a339d68c85c704e04f4118274
      https://github.com/OpenSIPS/opensips/commit/3ed3b93187fc577a339d68c85c704e04f4118274
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-07-21 (Tue, 21 Jul 2026)

  Changed paths:
    M modules/tls_mgm/tls_helper.h
    M modules/tls_openssl/openssl_config.c
    M modules/tls_wolfssl/wolfssl_config.c

  Log Message:
  -----------
  tls_mgm: unify TLS verify mode selection


Compare: https://github.com/OpenSIPS/opensips/compare/d1ddd1051b6d...3ed3b93187fc

To unsubscribe from these emails, change your notification settings at https://github.com/OpenSIPS/opensips/settings/notifications