diff options
| author | Maxim Dounin <mdounin@mdounin.ru> | 2021-08-16 22:40:31 +0300 |
|---|---|---|
| committer | Maxim Dounin <mdounin@mdounin.ru> | 2021-08-16 22:40:31 +0300 |
| commit | ce5996cdd1b2e150f645efbc337e5a681dbe241c (patch) | |
| tree | 7474e80d643bbd397d62ceb0192da067044b5fcb /src/http/modules/ngx_http_uwsgi_module.c | |
| parent | b381cbc085502b76a1db3f4439ccec5bb01b5a54 (diff) | |
| download | nginx-ce5996cdd1b2e150f645efbc337e5a681dbe241c.tar.gz nginx-ce5996cdd1b2e150f645efbc337e5a681dbe241c.zip | |
SSL: ciphers now set before loading certificates (ticket #2035).
To load old/weak server or client certificates it might be needed to adjust
the security level, as introduced in OpenSSL 1.1.0. This change ensures that
ciphers are set before loading the certificates, so security level changes
via the cipher string apply to certificate loading.
Diffstat (limited to 'src/http/modules/ngx_http_uwsgi_module.c')
| -rw-r--r-- | src/http/modules/ngx_http_uwsgi_module.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/src/http/modules/ngx_http_uwsgi_module.c b/src/http/modules/ngx_http_uwsgi_module.c index 40a06c78e..4f9c349c2 100644 --- a/src/http/modules/ngx_http_uwsgi_module.c +++ b/src/http/modules/ngx_http_uwsgi_module.c @@ -2432,6 +2432,12 @@ ngx_http_uwsgi_set_ssl(ngx_conf_t *cf, ngx_http_uwsgi_loc_conf_t *uwcf) cln->handler = ngx_ssl_cleanup_ctx; cln->data = uwcf->upstream.ssl; + if (ngx_ssl_ciphers(cf, uwcf->upstream.ssl, &uwcf->ssl_ciphers, 0) + != NGX_OK) + { + return NGX_ERROR; + } + if (uwcf->upstream.ssl_certificate) { if (uwcf->upstream.ssl_certificate_key == NULL) { @@ -2463,12 +2469,6 @@ ngx_http_uwsgi_set_ssl(ngx_conf_t *cf, ngx_http_uwsgi_loc_conf_t *uwcf) } } - if (ngx_ssl_ciphers(cf, uwcf->upstream.ssl, &uwcf->ssl_ciphers, 0) - != NGX_OK) - { - return NGX_ERROR; - } - if (uwcf->upstream.ssl_verify) { if (uwcf->ssl_trusted_certificate.len == 0) { ngx_log_error(NGX_LOG_EMERG, cf->log, 0, |