Setup default certificates path (#13941)
* setup default certificates path * change logic * change default in stream.conf
Emmanuel Vasilakis committed
Nov 3, 2022 at 16:22 UTC
a41ba6db5a55a879cc3f49524eca5a4f6ecf7fe0
3 files changed
+22
-30
libnetdata/socket/security.c
+11
-20
@@ -357,31 +357,22 @@ int security_test_certificate(SSL *ssl) {
357
* @return It returns 0 on success and -1 otherwise.
358
*/
359
int ssl_security_location_for_context(SSL_CTX *ctx, char *file, char *path) {
360
- struct stat statbuf;
361
- if (stat(file, &statbuf)) {
362
- info("Netdata does not have the parent's SSL certificate, so it will use the default OpenSSL configuration to validate certificates!");
363
- return 0;
364
- }
365
-
366
- ERR_clear_error();
367
- u_long err;
368
- char buf[256];
369
- if(!SSL_CTX_load_verify_locations(ctx, file, path)) {
370
- goto slfc;
360
+ int load_custom = 1, load_default = 1;
361
+ if (file || path) {
362
+ if(!SSL_CTX_load_verify_locations(ctx, file, path)) {
363
+ info("Netdata can not verify custom CAfile or CApath for parent's SSL certificate, so it will use the default OpenSSL configuration to validate certificates!");
364
+ load_custom = 0;
365
+ }
366
}
367
368
if(!SSL_CTX_set_default_verify_paths(ctx)) {
374
- goto slfc;
369
+ info("Can not verify default OpenSSL configuration to validate certificates!");
370
+ load_default = 0;
371
}
372
377
- return 0;
373
+ if (load_custom == 0 && load_default == 0)
374
+ return -1;
375
379
-slfc:
380
- while ((err = ERR_get_error()) != 0) {
381
- ERR_error_string_n(err, buf, sizeof(buf));
382
- error("Cannot set the directory for the certificates and the parent SSL certificate: %s",buf);
383
- }
384
- return -1;
376
+ return 0;
377
}
386
-
378
#endif
streaming/rrdpush.c
+2
-2
@@ -140,8 +140,8 @@ int rrdpush_init() {
140
}
141
}
142
143
- netdata_ssl_ca_path = appconfig_get(&stream_config, CONFIG_SECTION_STREAM, "CApath", "/etc/ssl/certs/");
144
- netdata_ssl_ca_file = appconfig_get(&stream_config, CONFIG_SECTION_STREAM, "CAfile", "/etc/ssl/certs/certs.pem");
143
+ netdata_ssl_ca_path = appconfig_get(&stream_config, CONFIG_SECTION_STREAM, "CApath", NULL);
144
+ netdata_ssl_ca_file = appconfig_get(&stream_config, CONFIG_SECTION_STREAM, "CAfile", NULL);
145
#endif
146
147
return default_rrdpush_enabled;
streaming/stream.conf
+9
-8
@@ -40,17 +40,18 @@
40
#ssl skip certificate verification = yes
41
42
# Certificate Authority Path
43
- # OpenSSL has a default directory where the known certificates are stored,
44
- # case it is necessary it is possible to change this rule using the variable
45
- # "CApath"
46
- #CApath = /etc/ssl/certs/
43
+ # OpenSSL has a default directory where the known certificates are stored.
44
+ # In case it is necessary, it is possible to change this rule using the variable
45
+ # "CApath", e.g. CApath = /etc/ssl/certs/
46
+ #
47
+ #CApath =
48
49
# Certificate Authority file
49
- # When the Netdata parent has certificate, that is not recognized as valid,
50
- # we can add this certificate in the list of known certificates in CApath
51
- # and give for Netdata as argument.
50
+ # When the Netdata parent has a certificate that is not recognized as valid,
51
+ # we can add it to the list of known certificates in "CApath" and give it to
52
+ # Netdata as an argument, e.g. CAfile = /etc/ssl/certs/cert.pem
53
#
53
- #CAfile = /etc/ssl/certs/cert.pem
54
+ #CAfile =
55
56
# The API_KEY to use (as the sender)
57
api key =