zedshaw/mongrel2 — pull request #166 by mcqueenorama (2013-02-26 01:03:50+00:00)
Title: ssl certificate verification required and basic unit test of cert verifi...

I added two new config file parameters to force mongrel2 to require a valid certificate instead of having it merely optional. The optional setup was not doing any verification because there was never a ca_chain for polarssl to do verify the peer_cert. One parameter forces verification, and the second specifies a ca_chain to use for the verification:

"ssl.verify_required": 1,
"ssl.ca_chain": "./certs/ewcli_root_ca.pem"

I also put the peer_cert into the ssl session cache, because it wasn't handling subsequent requests (after the initial handlshake and verification) properly. The peer_cert was always getting lost after the initial handshake.