The reason for this error message is that AddCRLToSSLContext in lib/base/tlsutility.cpp incorrectly verifies the return code of the OpenSSL function X509_LOOKUP_load_file. OpenSSL signals successful execution with a return code of one, but the code in AddCRLToSSLContext fails if the return code is not zero. This means that the code will not continue when the CRL has actually been loaded successfully, but it will continue when there is an error while loading the CRL.
I found this bug in Icinga 2.4, but it is still present in the current master branch.
Don't bother fixing this bug. I already have a patch and will submit a pull request shortly. This issue is only for tracking the bug.
The text was updated successfully, but these errors were encountered:
The code for loading CRLs was incorrectly assuming that OpenSSL's
X509_LOOKUP_load_file function returns zero on success, but actually it
returns one on success. This commit fixes this return code check so
that a CRL can be loaded.
When specifying a CRL through the
crl_path
option in the API listener configuration, starting Icinga2 fails with the following error message:The reason for this error message is that
AddCRLToSSLContext
inlib/base/tlsutility.cpp
incorrectly verifies the return code of the OpenSSL functionX509_LOOKUP_load_file
. OpenSSL signals successful execution with a return code of one, but the code inAddCRLToSSLContext
fails if the return code is not zero. This means that the code will not continue when the CRL has actually been loaded successfully, but it will continue when there is an error while loading the CRL.I found this bug in Icinga 2.4, but it is still present in the current master branch.
Don't bother fixing this bug. I already have a patch and will submit a pull request shortly. This issue is only for tracking the bug.
The text was updated successfully, but these errors were encountered: