vincenthz/hs-tls-extra — pull request #7 by pheaver (2012-10-03 00:45:36+00:00)
Title: add certificateVerifyChainAgainst

This function takes in a list of existing (parsed) certs and uses it instead of reading from the filesystem on every request. On unix, we can use readAll to get the certs once and for all and pass them into this function each time.

This patch is crucial for performance. Without it, performance is so bad that the package is basically unusable.

In http-conduit, a defaultCheckCerts function is defined. Here is the alternate version that uses the cached list of certs. Is there a place for this function in tls-extra?

checkCerts :: [X509] -> S8.ByteString -> [X509] -> IO TLSCertificateUsage
checkCerts allCerts host' certs =
case certificateVerifyDomain (S8.unpack host') certs of
CertificateUsageAccept -> return $ certificateVerifyChainAgainst allCerts certs
rejected -> return rejected

Also change the type of certificateVerifyAgainst to be pure; there was no need for it to be in IO.