Skip to content

Commit

Permalink
Warn capath is not supported for websockets
Browse files Browse the repository at this point in the history
libwebsockets doesn't provide an option to provide a `capath`, ie
a directory that contains multiple certificates.
( warmcat/libwebsockets#3276 )

To avoid confusion, explicitly state that it's not supported for
websockets in the doc for mosquitto.conf, and add a warning if option is
provided while `capath` is not provided.
  • Loading branch information
CoRfr committed Nov 13, 2024
1 parent ba2b98d commit 66cc2b2
Show file tree
Hide file tree
Showing 3 changed files with 8 additions and 1 deletion.
1 change: 1 addition & 0 deletions man/mosquitto.conf.5.xml
Original file line number Diff line number Diff line change
Expand Up @@ -1326,6 +1326,7 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S
"openssl rehash <path to capath>" each time
you add/remove a certificate.
</para>
<para><option>capath</option> is not supported for websockets.</para>
</listitem>
</varlistentry>
<varlistentry>
Expand Down
1 change: 1 addition & 0 deletions mosquitto.conf
Original file line number Diff line number Diff line change
Expand Up @@ -359,6 +359,7 @@
# containing the CA certificates. For capath to work correctly, the
# certificate files must have ".crt" as the file ending and you must run
# "openssl rehash <path to capath>" each time you add/remove a certificate.
# capath is not supported for websockets.
#cafile
#capath

Expand Down
7 changes: 6 additions & 1 deletion src/websockets.c
Original file line number Diff line number Diff line change
Expand Up @@ -698,7 +698,12 @@ void mosq_websockets_init(struct mosquitto__listener *listener, const struct mos
info.gid = -1;
info.uid = -1;
#ifdef WITH_TLS
info.ssl_ca_filepath = listener->cafile;
if(listener->cafile){
info.ssl_ca_filepath = listener->cafile;
}
else if(listener->capath){
log__printf(NULL, MOSQ_LOG_WARNING, "Warning: CA path option is not supported for websockets");
}
info.ssl_cert_filepath = listener->certfile;
info.ssl_private_key_filepath = listener->keyfile;
info.ssl_cipher_list = listener->ciphers;
Expand Down

0 comments on commit 66cc2b2

Please sign in to comment.