[BUG] Impossible to load chain of certificates and CA certificates from DB

[vasilevalex]

OpenSIPS version you are running

All versions

Describe the bug
Module tls_mgm uses DB. If we store TLS domain information in database, it is impossible to load chain of TLS certificates (only first one loaded) and impossible to load CA certificates (only first one loaded)

To Reproduce

1. Store TLS certificate (full chain), private key and CA-list in DB
2. Start opensips
3. Check, what data it has.
4. Only certificate without rest chain ond only first CA certificate available.

Expected behavior
Load full chain of certificates for TLS domain and list of CA certificates

Relevant System Logs
No logs, no errors.

OS/environment information

• Operating System: CentOS 7
• OpenSIPS installation: git
• other relevant information:

Additional context
Issue #1709 related to this one.

[razvancrainea]

Just to confirm, in the database you do have all the certificates chain, correct?

[vasilevalex]

@razvancrainea , yes, they are correct. Please review PR

[vasilevalex]

And I changed manually MySQL scheme of course, as it is impossible to store all CA certificates in 16K blob. This mentioned in #1709

[vasilevalex]

@razvancrainea Can you help? tls_dump_cert_info (defined in tls_conn_server.h) is just for print certificate subj and issuer. And patch is much more informative in logs with this function, but I got this warnings because of unused static functions:
tls_conn_server.h:510:12: error: ‘tls_fix_read_conn’ defined but not used I don't want to duplicate functionality, may be we can move this function in some common header?

[razvancrainea]

I've just pushed a commit on master and merged your PR. Can you confirm it's all right now? If so, I will backport them.

[vasilevalex]

@razvancrainea , I don't know how to check tls_mgm.xml, but, yes, this is just change of ca_list field type. PR I've tested only on 2.4.5, but this part of code was not changed in 3.0. When tls_mgm takes certificates from files - it uses it right way, certificate - as full chain, and ca-list -as list of all CA certificates, so just initialisation from DB was incorrect before PR. I've attached patch for 2.4 branch
tls_ca_db_24.patch.txt
So please backport changes to other branches

[razvancrainea]

I've just pushed this upstream, let me know if it's all good.

[vasilevalex]

@razvancrainea I've built latest 2.4.5 version from git. Everything works like expected.