tls: function to replace cert for SSL object of a connection
MODIFY
include/re_tls.h
include/re_tls.h
@@ -69,6 +69,7 @@ void tls_disable_verify_server(struct tls *tls);
/* TCP */
+int tls_conn_change_cert(struct tls_conn *tc, const char *file);
int tls_start_tcp(struct tls_conn **ptc, struct tls *tls,
struct tcp_conn *tcp, int layer);

MODIFY
src/tls/openssl/tls_tcp.c
src/tls/openssl/tls_tcp.c
@@ -347,6 +347,44 @@ static bool send_handler(int *err, struct mbuf *mb, void *arg)
}
+/**
+ * Change used certificate+key of an existing SSL object
+ *
+ * @param tc TLS connection object
+ * @param file Cert+Key file
+ *
+ * @return int 0 if success, otherwise errorcode
+ */
+int tls_conn_change_cert(struct tls_conn *tc, const char *file)
+{
+ int r = 0;
+
+ if (!tc || !file)
+ return EINVAL;
+
+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
+ r = SSL_use_certificate_chain_file(tc->ssl, file);
+#else
+ r = SSL_use_certificate_file(tc->ssl, file, SSL_FILETYPE_PEM);
+#endif
+ if (r <= 0) {
+ DEBUG_WARNING("change cert: "
+ "cant't read certificate file: %s\n", file);
+ ERR_clear_error();
+ return EINVAL;
+ }
+
+ r = SSL_use_PrivateKey_file(tc->ssl, file, SSL_FILETYPE_PEM);
+ if (r <= 0) {
+ DEBUG_WARNING("change cert: key missmatch in %s\n", file);
+ ERR_clear_error();
+ return EKEYREJECTED;
+ }
+
+ return 0;
+}
+
+
/**
* Start TLS on a TCP-connection
*

tls: function to replace cert for SSL object of a connection