From 714d0bfd378b6a9f0544dda011855846d0ba8379 Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Mon, 16 Aug 2010 09:19:29 +0200 Subject: Only include certificates with CA flag in TLS cert request --- src/libtls/tls_server.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'src/libtls/tls_server.c') diff --git a/src/libtls/tls_server.c b/src/libtls/tls_server.c index 2b2845ea1..faaecb5a0 100644 --- a/src/libtls/tls_server.c +++ b/src/libtls/tls_server.c @@ -18,6 +18,7 @@ #include #include +#include typedef struct private_tls_server_t private_tls_server_t; @@ -489,6 +490,7 @@ static status_t send_certificate_request(private_tls_server_t *this, tls_writer_t *authorities; enumerator_t *enumerator; certificate_t *cert; + x509_t *x509; identification_t *id; /* currently only RSA signatures are supported */ @@ -504,8 +506,12 @@ static status_t send_certificate_request(private_tls_server_t *this, CERT_X509, KEY_RSA, NULL, TRUE); while (enumerator->enumerate(enumerator, &cert)) { - id = cert->get_subject(cert); - authorities->write_data16(authorities, id->get_encoding(id)); + x509 = (x509_t*)cert; + if (x509->get_flags(x509) & X509_CA) + { + id = cert->get_subject(cert); + authorities->write_data16(authorities, id->get_encoding(id)); + } } enumerator->destroy(enumerator); writer->write_data16(writer, authorities->get_buf(authorities)); -- cgit v1.2.3