ctx.c

Go to the documentation of this file.

/*
 *   This program is free software; you can redistribute it and/or modify
 *   it under the terms of the GNU General Public License as published by
 *   the Free Software Foundation; either version 2 of the License, or
 *   (at your option) any later version.
 *
 *   This program is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *   GNU General Public License for more details.
 *
 *   You should have received a copy of the GNU General Public License
 *   along with this program; if not, write to the Free Software
 *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
 */
 
/**
 * $Id: e4a6285f6eba36fc4f9fcc611214eed931b43e1e $
 *
 * @file tls/ctx.c
 * @brief Initialise and configure SSL_CTX structures.
 *
 * @copyright 2026 Network RADIUS SAS (legal@networkradius.com)
 */
RCSID("$Id: e4a6285f6eba36fc4f9fcc611214eed931b43e1e $")
USES_APPLE_DEPRECATED_API       /* OpenSSL API has been deprecated by Apple */
 
#ifdef WITH_TLS
#define LOG_PREFIX "tls"
#define _TLS_PRIVATE 1
 
#include <freeradius-devel/tls/log.h>
#include <freeradius-devel/tls/strerror.h>
#include <freeradius-devel/util/base16.h>
#include <freeradius-devel/util/debug.h>
#include <freeradius-devel/util/misc.h>
#include <freeradius-devel/util/syserror.h>
 
#include "base.h"
#include "utils.h"
#include "dtls.h"
#include "log.h"
#include "cert.h"
 
#include <openssl/rand.h>
#include <openssl/dh.h>
#include <openssl/x509v3.h>
#include <openssl/provider.h>
 
#ifndef OPENSSL_NO_ECDH
static int ctx_ecdh_curve_set(SSL_CTX *ctx, char const *ecdh_curve, bool disable_single_dh_use)
{
        char *list;
 
        if (!disable_single_dh_use) {
                SSL_CTX_set_options(ctx, SSL_OP_SINGLE_ECDH_USE);
        }
 
        if (!ecdh_curve || !*ecdh_curve) return 0;
 
        list = strdup(ecdh_curve);
        if (SSL_CTX_set1_curves_list(ctx, list) == 0) {
                free(list);
                ERROR("Unknown ecdh_curve \"%s\"", ecdh_curve);
                return -1;
        }
        free(list);
        return 0;
}
#endif
 
/*
 *      TODO: Check for the type of key exchange * like conf->dh_key
 */
static int ctx_dh_params_load(SSL_CTX *ctx, char *file)
{
        BIO     *bio;
        int     ret;
 
        EVP_PKEY *dh = NULL;
 
        if (!file) return 0;
 
        /*
         * Prior to trying to load the file, check what OpenSSL will do with it.
         *
         * Certain downstreams (such as RHEL) will ignore user-provided dhparams
         * in FIPS mode, unless the specified parameters are FIPS-approved.
         * However, since OpenSSL >= 1.1.1 will automatically select parameters
         * anyways, there's no point in attempting to load them.
         *
         * Change suggested by @t8m
         */
        if (EVP_default_properties_is_fips_enabled(NULL)) {
                WARN(LOG_PREFIX ": Ignoring user-selected DH parameters in FIPS mode. Using defaults.");
                return 0;
        }
 
        if ((bio = BIO_new_file(file, "r")) == NULL) {
                ERROR("Unable to open DH file - %s", file);
                return -1;
        }
 
        dh = PEM_read_bio_Parameters(bio, &dh);
        BIO_free(bio);
        if (!dh) {
                WARN("Unable to set DH parameters.  DH cipher suites may not work!");
                WARN("Fix this by generating the DH parameter file");
                return 0;
        }
 
        ret = SSL_CTX_set0_tmp_dh_pkey(ctx, dh);
        if (ret == 0) {
                EVP_PKEY_free(dh);
                ERROR("Unable to set DH parameters");
                return -1;
        }
 
        return 0;
}
 
static int tls_ctx_verify_chain_member(X509 **self_signed, SSL_CTX *ctx, X509 *to_verify,
                                       fr_tls_chain_verify_mode_t verify_mode)
{
        fr_unix_time_t  not_after;
 
        STACK_OF(X509)  *chain;
        X509            *leaf;
 
        leaf = SSL_CTX_get0_certificate(ctx);
        if (!leaf) {
                ERROR("Chain does not contain a valid leaf certificate");
                return -1;
        }
 
        if (!SSL_CTX_get0_chain_certs(ctx, &chain)) {
                fr_tls_log_perror(NULL, "Failed retrieving chain certificates");
                return -1;
        }
 
        switch (fr_tls_cert_is_valid(NULL, &not_after, to_verify)) {
        case -1:
                fr_tls_chain_marker_log(NULL, L_ERR, chain, leaf, to_verify);
                PERROR("Malformed certificate");
                return -1;
 
        case -2:
        case -3:
                switch (verify_mode) {
                case FR_TLS_CHAIN_VERIFY_SOFT:
                        fr_tls_chain_marker_log(NULL, L_WARN, chain, leaf, to_verify);
                        PWARN("Certificate validation failed");
                        break;
 
                case FR_TLS_CHAIN_VERIFY_HARD:
                        fr_tls_chain_marker_log(NULL, L_ERR, chain, leaf, to_verify);
                        PERROR("Certificate validation failed");
                        return -1;
 
                default:
                        break;
                }
 
        }
 
        /*
         *      Check for self-signed certs
         */
        switch (verify_mode) {
        case FR_TLS_CHAIN_VERIFY_SOFT:
        case FR_TLS_CHAIN_VERIFY_HARD:
                /*
                 *      There can be only one... self signed
                 *      cert in a chain.
                 *
                 *      We have to do this check manually
                 *      because the OpenSSL functions will
                 *      only check to see if it can build
                 *      a chain, not that all certificates
                 *      in the chain are used.
                 *
                 *      Having multiple self-signed certificates
                 *      usually indicates someone has copied
                 *      the wrong certificates into the
                 *      server.pem file.
                 */
                if (X509_name_cmp(X509_get_subject_name(to_verify),
                                  X509_get_issuer_name(to_verify)) == 0) {
                        if (*self_signed) {
                                switch (verify_mode) {
                                case FR_TLS_CHAIN_VERIFY_SOFT:
                                        WARN("Found multiple self-signed certificates in chain");
                                        WARN("First certificate was:");
                                        fr_tls_chain_marker_log(NULL, L_WARN,
                                                                            chain, leaf, *self_signed);
 
                                        WARN("Second certificate was:");
                                        fr_tls_chain_marker_log(NULL, L_WARN,
                                                                            chain, leaf, to_verify);
                                        break;
 
                                case FR_TLS_CHAIN_VERIFY_HARD:
                                        ERROR("Found multiple self-signed certificates in chain");
                                        ERROR("First certificate was:");
                                        fr_tls_chain_marker_log(NULL, L_ERR,
                                                                            chain, leaf, *self_signed);
 
                                        ERROR("Second certificate was:");
                                        fr_tls_chain_marker_log(NULL, L_ERR,
                                                                            chain, leaf, to_verify);
                                        return -1;
 
                                default:
                                        break;
                                }
                        }
                        *self_signed = to_verify;
                }
                break;
 
        default:
                break;
        }
 
        return 0;
}
 
static int tls_ctx_load_cert_chain(SSL_CTX *ctx, fr_tls_chain_conf_t *chain, bool allow_multi_self_signed)
{
        int             i;
 
        /*
         *      The chain section loaded the files when it was parsed,
         *      each SSL_CTX just takes references.
         */
        fr_assert(chain->leaf && chain->private_key);
 
        if (SSL_CTX_use_certificate(ctx, chain->leaf) != 1) {
                fr_tls_log_perror(NULL, "Failed setting certificate from \"%s\"", chain->certificate_file);
                return -1;
        }
 
DIAG_OFF_OPTIONAL(used-but-marked-unused)       /* fix spurious warnings for sk macros */
        for (i = 0; i < sk_X509_num(chain->extra); i++) {
                if (SSL_CTX_add1_chain_cert(ctx, sk_X509_value(chain->extra, i)) != 1) {
                        fr_tls_log_perror(NULL, "Failed adding certificate %d to the chain for \"%s\"",
                                          i + 1, chain->certificate_file);
                        return -1;
                }
        }
DIAG_ON_OPTIONAL(used-but-marked-unused)
 
        if (SSL_CTX_use_PrivateKey(ctx, chain->private_key) != 1) {
                fr_tls_log_perror(NULL, "Failed setting private key from \"%s\"", chain->private_key_file);
                return -1;
        }
 
        /*
         *      Loop over the certificates checking validity periods.
         *      SSL_CTX_build_cert_chain does this too, but we can
         *      produce significantly better errors here.
         */
        {
                X509            *self_signed = NULL;
                STACK_OF(X509)  *our_chain;
 
                if (tls_ctx_verify_chain_member(&self_signed, ctx, SSL_CTX_get0_certificate(ctx),
                                                chain->verify_mode) < 0) return -1;
 
                if (!SSL_CTX_get0_chain_certs(ctx, &our_chain)) {
                        fr_tls_log_perror(NULL, "Failed retrieving chain certificates");
                        return -1;
                }
 
                if (allow_multi_self_signed) self_signed = NULL;
 
DIAG_OFF_OPTIONAL(used-but-marked-unused)       /* fix spurious warnings for sk macros */
                for (i = sk_X509_num(our_chain); i > 0 ; i--) {
                        /*
                         *      SSL_CTX_use_certificate_chain_file set the
                         *      current cert to be the one loaded from
                         *      that pem file.
                         */
                        if (tls_ctx_verify_chain_member(&self_signed, ctx, sk_X509_value(our_chain, i - 1),
                                                        chain->verify_mode) < 0) return -1;
 
                        if (allow_multi_self_signed) self_signed = NULL;
                }
DIAG_ON_OPTIONAL(used-but-marked-unused)        /* fix spurious warnings for sk macros */
        }
 
        {
                int mode = SSL_BUILD_CHAIN_FLAG_CHECK;
 
                if (!chain->include_root_ca) mode |= SSL_BUILD_CHAIN_FLAG_NO_ROOT;
 
                /*
                 *      Explicitly check that the certificate chain
                 *      we just loaded is sane.
                 *
                 *      This operates on the last loaded certificate.
                 */
                switch (chain->verify_mode) {
                case FR_TLS_CHAIN_VERIFY_NONE:
                        mode |= SSL_BUILD_CHAIN_FLAG_CLEAR_ERROR | SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR;
                        (void)SSL_CTX_build_cert_chain(ctx, mode);
                        break;
 
                /*
                 *      Seems to be a bug where
                 *      SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR trashes the error,
                 *      so have the function fail as normal.
                 */
                case FR_TLS_CHAIN_VERIFY_SOFT:
                        if (!SSL_CTX_build_cert_chain(ctx, mode)) {
                                fr_tls_strerror_printf(NULL);
                                PWARN("Failed verifying chain");
                        }
                        break;
 
                case FR_TLS_CHAIN_VERIFY_HARD:
                        if (!SSL_CTX_build_cert_chain(ctx, mode)) {
                                fr_tls_strerror_printf(NULL);
                                PERROR("Failed verifying chain");
                                return -1;
                        }
                        break;
 
                default:
                        break;
                }
        }
 
        return 0;
}
 
/** Map the configured version numbers onto the DTLS ones
 *
 * DTLS has 1.0 and 1.2, and nothing else.  There is no DTLS 1.1, and this
 * OpenSSL has no DTLS 1.3: dtls1.h defines DTLS_MAX_VERSION as
 * DTLS1_2_VERSION.
 *
 * The version numbers also run backwards.  DTLS1_VERSION is 0xFEFF and
 * DTLS1_2_VERSION is 0xFEFD, this function fixes that mapping.
 *
 * @param[in] ctx       to configure.
 * @param[in] conf      to read the versions from.
 * @return
 *      - 0 on success.
 *      - -1 on failure.
 */
static inline CC_HINT(always_inline)
int tls_ctx_version_set_dtls(SSL_CTX *ctx, fr_tls_conf_t const *conf)
{
        int version;
 
        if (conf->tls_max_version > (float) 0.0) {
                if (conf->tls_min_version > conf->tls_max_version) {
                        ERROR("tls_min_version (%f) must be <= tls_max_version (%f)",
                              (double)conf->tls_min_version, (double)conf->tls_max_version);
                        return -1;
                }
 
                /*
                 *      1.3 and above allow more than exists, and the most
                 *      recent DTLS there is satisfies them.
                 */
                if (conf->tls_max_version >= (float) 1.2) {
                        version = DTLS1_2_VERSION;
 
                } else if (conf->tls_max_version >= (float) 1.1) {
                        ERROR("There is no DTLS 1.1.  Set tls_max_version to 1.0 or 1.2");
                        return -1;
 
                } else if (conf->tls_max_version >= (float) 1.0) {
                        version = DTLS1_VERSION;
                        WARN("DTLS 1.0 is insecure and SHOULD NOT be used");
                        WARN("tls_max_version SHOULD be 1.2");
 
                } else {
                        ERROR("tls_max_version must be >= 1.0");
                        return -1;
                }
 
                if (!SSL_CTX_set_max_proto_version(ctx, version)) {
                        fr_tls_log_perror(NULL, "Failed setting DTLS maximum version");
                        return -1;
                }
        }
 
        /*
         *      A minimum which does not exist cannot be rounded down to one
         *      which does, as that would hand the administrator a weaker
         *      connection than the one asked for.
         */
        if (conf->tls_min_version >= (float) 1.3) {
                ERROR("DTLS 1.3 is not supported by this version of OpenSSL");
                return -1;
 
        } else if (conf->tls_min_version >= (float) 1.2) {
                version = DTLS1_2_VERSION;
 
        } else if (conf->tls_min_version >= (float) 1.1) {
                ERROR("There is no DTLS 1.1.  Set tls_min_version to 1.0 or 1.2");
                return -1;
 
        } else if (conf->tls_min_version >= (float) 1.0) {
                version = DTLS1_VERSION;
                WARN("DTLS 1.0 is insecure and SHOULD NOT be used");
                WARN("tls_min_version SHOULD be 1.2");
 
        } else {
                ERROR("tls_min_version must be >= 1.0 as SSLv2 and SSLv3 are permanently disabled");
                return -1;
        }
 
        if (!SSL_CTX_set_min_proto_version(ctx, version)) {
                fr_tls_log_perror(NULL, "Failed setting DTLS minimum version");
                return -1;
        }
 
        return 0;
}
 
static inline CC_HINT(always_inline)
int tls_ctx_version_set(UNUSED int *ctx_options, SSL_CTX *ctx, fr_tls_conf_t const *conf)
{
        if (conf->socket_type == SOCK_DGRAM) return tls_ctx_version_set_dtls(ctx, conf);
 
        /*
         *      SSL_CTX_set_(min|max)_proto_version was included in OpenSSL 1.1.0
         *
         *      This version already defines macros for TLS1_2_VERSION and
         *      below, so we don't need to check for them explicitly.
         *
         *      TLS1_3_VERSION is available in OpenSSL 1.1.1.
         *
         *      TLS1_4_VERSION does not exist yet.  But we allow it
         *      only if it is explicitly permitted by the
         *      administrator.
         */
        if (conf->tls_max_version > (float) 0.0) {
                int max_version = 0;
 
                if (conf->tls_min_version > conf->tls_max_version) {
                        /*
                         *      %f is actually %lg now (double).  Compile complains about
                         *      implicit promotion unless we cast args to double.
                         */
                        ERROR("tls_min_version (%f) must be <= tls_max_version (%f)",
                              (double)conf->tls_min_version, (double)conf->tls_max_version);
                error:
                        return -1;
                }
 
                if (conf->tls_max_version < (float) 1.0) {
                        ERROR("tls_max_version must be >= 1.0 as SSLv2 and SSLv3 are permanently disabled");
                        goto error;
                }
 
#  ifdef TLS1_4_VERSION
                else if (conf->tls_max_version >= (float) 1.4) max_version = TLS1_4_VERSION;
#  endif
                else if (conf->tls_max_version >= (float) 1.3) max_version = TLS1_3_VERSION;
                else if (conf->tls_max_version >= (float) 1.2) max_version = TLS1_2_VERSION;
                else if (conf->tls_max_version >= (float) 1.1) max_version = TLS1_1_VERSION;
                else max_version = TLS1_VERSION;
 
                /*
                 *      Complain about insecure TLS versions.
                 */
                if (max_version < TLS1_2_VERSION) {
                        WARN("TLS 1.0 and 1.1 are insecure and SHOULD NOT be used");
                        WARN("tls_max_version SHOULD be 1.2 or greater");
                }
 
                if (!SSL_CTX_set_max_proto_version(ctx, max_version)) {
                        fr_tls_log_perror(NULL, "Failed setting TLS maximum version");
                        goto error;
                }
        }
 
        {
                int min_version;
 
                if (conf->tls_min_version < (float) 1.0) {
                        ERROR("tls_min_version must be >= 1.0 as SSLv2 and SSLv3 are permanently disabled");
                        goto error;
                }
#  ifdef TLS1_4_VERSION
                else if (conf->tls_min_version >= (float) 1.4) min_version = TLS1_4_VERSION;
#  endif
                else if (conf->tls_min_version >= (float) 1.3) min_version = TLS1_3_VERSION;
                else if (conf->tls_min_version >= (float) 1.2) min_version = TLS1_2_VERSION;
                else if (conf->tls_min_version >= (float) 1.1) min_version = TLS1_1_VERSION;
                else min_version = TLS1_VERSION;
 
                /*
                 *      Complain about insecure TLS versions.
                 */
                if (min_version < TLS1_2_VERSION) {
                        WARN("TLS 1.0 and 1.1 are insecure and SHOULD NOT be used");
                        WARN("tls_min_version SHOULD be 1.2 or greater");
                }
 
                if (!SSL_CTX_set_min_proto_version(ctx, min_version)) {
                        fr_tls_log_perror(NULL, "Failed setting TLS minimum version");
                        goto error;
                }
        }
 
        return 0;
}
 
/** Create SSL context
 *
 * - Load the trusted CAs
 * - Load the Private key & the certificate
 * - Set the Context options & Verify options
 *
 * @param conf to read settings from, including `socket_type`.
 * @param client If true SSL_CTX will be configured as a client context.
 * @return
 *      - A new SSL_CTX on success.
 *      - NULL on failure.
 */
SSL_CTX *fr_tls_ctx_alloc(fr_tls_conf_t const *conf, bool client)
{
        SSL_CTX         *ctx;
        X509_STORE      *verify_store = NULL;
        int             ctx_options = 0;
        int             mode= SSL_MODE_ASYNC;
 
 
        /*
         *      SOCK_SEQPACKET is refused rather than guessed at: OpenSSL has
         *      DTLS over SCTP, and nothing here has been written or tested
         *      for it.
         */
        switch (conf->socket_type) {
 
        /*
         *      Zero means the application never set it, which every caller other than DTLS does.  For EAP,
         *      the configuration is in module structure, and is mprotect()'d.
         */
        case 0:
        case SOCK_STREAM:
        case SOCK_DGRAM:
                break;
 
        default:
                ERROR("Unsupported socket type %d for a TLS context, expected SOCK_STREAM (%d) "
                      "or SOCK_DGRAM (%d)", conf->socket_type, SOCK_STREAM, SOCK_DGRAM);
                return NULL;
        }
 
        ctx = SSL_CTX_new((conf->socket_type == SOCK_DGRAM) ? DTLS_method() : TLS_method());
        if (!ctx) {
                fr_tls_log_perror(NULL, "Failed creating TLS context");
                return NULL;
        }
 
        /*
         *      Save the config on the context so that callbacks which
         *      only get SSL_CTX* e.g. session persistence, can get at it.
         */
        SSL_CTX_set_ex_data(ctx, FR_TLS_EX_INDEX_CONF, UNCONST(void *, conf));
 
        /*
         *      Identify the type of certificates that needs to be loaded
         */
#ifdef PSK_MAX_IDENTITY_LEN
        /*
         *      The virtual server has a `load psk` section, so the
         *      configuration MUST NOT also set a fixed key in a `psk` section.
         */
        if (conf->load_psk) {
                if (conf->psk.identity || conf->psk.key) {
                        ERROR("Invalid PSK Configuration: a fixed key is set in the psk section and the virtual server "
                              "has a \"load psk\" section.  Remove one of the two");
                error:
                        SSL_CTX_free(ctx);
                        return NULL;
                }
 
        /*
         *      A fixed key requires both `psk.identity` and `psk.key`.
         */
        } else if (conf->psk.identity) {
                size_t key_len = conf->psk.key ? talloc_array_length(conf->psk.key) : 0;
 
                if (!*conf->psk.identity) {
                        ERROR("Invalid PSK Configuration: psk.identity is empty");
                        goto error;
                }
 
                if (key_len == 0) {
                        ERROR("Invalid PSK Configuration: psk.identity is set but psk.key is missing or empty");
                        goto error;
                }
 
                if (key_len > PSK_MAX_PSK_LEN) {
                        ERROR("Invalid PSK Configuration: psk.key is %zu bytes, OpenSSL accepts at most %d bytes",
                              key_len, PSK_MAX_PSK_LEN);
                        goto error;
                }
 
        } else if (conf->psk.key) {
                ERROR("Invalid PSK Configuration: psk.key is set but psk.identity is not set");
                goto error;
        }
 
        /*
         *      Set the server PSK callback if necessary.
         */
        if (!client && (conf->psk.identity || conf->load_psk)) {
                SSL_CTX_set_psk_server_callback(ctx, fr_tls_session_psk_server_cb);
        }
 
        /*
         *      A fixed key takes the place of the certificate chain, so a
         *      configuration with a fixed key skips the chain loading below.
         */
        if (conf->psk.identity) {
                if (client) {
                        SSL_CTX_set_psk_client_callback(ctx, fr_tls_session_psk_client_cb);
                }
 
                SSL_CTX_set_mode(ctx, mode);
                goto post_ca;
        }
#endif
 
        /*
         *      OpenSSL will automatically create certificate chains,
         *      unless we tell it to not do that.  The problem is that
         *      it sometimes gets the chains right from a certificate
         *      signature view, but wrong from the clients view.
         *
         *      It's better just to have users specify the complete
         *      chains.
         */
        mode |= SSL_MODE_NO_AUTO_CHAIN;
 
        if (client) {
                mode |= SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER;
                mode |= SSL_MODE_AUTO_RETRY;
        }
 
        SSL_CTX_set_mode(ctx, mode);
 
        /*
         *      Initialise a separate store for verifying user
         *      certificates.
         *
         *      This makes the configuration cleaner as there's
         *      no mixing of chain certs and user certs.
         */
        MEM(verify_store = X509_STORE_new());
 
        /* Sets OpenSSL's (CERT *)->verify_store, overring (SSL_CTX *)->cert_store */
        SSL_CTX_set0_verify_cert_store(ctx, verify_store);
 
        /* This isn't accessible to use later, i.e. there's no SSL_CTX_get0_verify_cert_store */
        SSL_CTX_set_ex_data(ctx, FR_TLS_EX_CTX_INDEX_VERIFY_STORE, verify_store);
 
        /*
         *      Load the CAs we trust
         */
        if (conf->ca_file || conf->ca_path) {
                /*
                 *      This adds all the certificates to the store for conf->ca_file
                 *      and adds a dynamic lookup for conf->ca_path.
                 *
                 *      It's also possible to add extra virtual server lookups
                 */
                if (!X509_STORE_load_locations(verify_store, conf->ca_file, conf->ca_path)) {
                        fr_tls_log_perror(NULL, "Failed reading Trusted root CA list \"%s\"",
                                      conf->ca_file ? conf->ca_file : conf->ca_path);
                        goto error;
                }
 
                /*
                 *      These set the default parameters of the store when the
                 *      store is involved in building chains.
                 *
                 *      The store validates the peer's certificate, so
                 *      the certificate purpose is the _peer's_
                 *      certificate purpose, which the opposite of us.
                 *
                 *      If we're a server, then we check that the peer is a client.
                 *      If we're a client, then we check the peer is a server.
                 */
                X509_STORE_set_purpose(verify_store, client ? X509_PURPOSE_SSL_SERVER : X509_PURPOSE_SSL_CLIENT);
 
                /*
                 *      Sets the list of CAs we send to the peer if we're
                 *      requesting a certificate.
                 *
                 *      This does not change the trusted certificate authorities,
                 *      those are set above with SSL_CTX_load_verify_locations.
                 */
                if (conf->ca_file) SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(conf->ca_file));
        } else {
                X509_STORE_set_default_paths(verify_store);
        }
 
        /*
         *      Load our certificate chains and keys
         */
        if (conf->chains) {
                size_t chains_conf = talloc_array_length(conf->chains);
 
                /*
                 *      Load our keys and certificates
                 *
                 *      If certificates are of type PEM then we can make use
                 *      of cert chain authentication using openssl api call
                 *      SSL_CTX_use_certificate_chain_file.  Please see how
                 *      the cert chain needs to be given in PEM from
                 *      openSSL.org
                 */
                {
                        size_t i;
 
                        for (i = 0; i < chains_conf; i++) {
                                if (tls_ctx_load_cert_chain(ctx, conf->chains[i], false) < 0) goto error;
                        }
                }
 
                /*
                 *      Print out our certificate chains.
                 *
                 *      There may be up to three, one for RSA, DH, DSA and EC.
                 *      OpenSSL internally and transparently stores completely
                 *      separate and distinct RSA/DSA/DH/ECC key pairs and chains.
                 */
                if (DEBUG_ENABLED2) {
                        size_t chains_set = 0;
                        int ret;
 
                        /*
                         *      Iterate over the different chain types we have
                         *      RSA, DSA, DH, EC etc...
                         */
                        for (ret = SSL_CTX_set_current_cert(ctx, SSL_CERT_SET_FIRST);
                             ret == 1;
                             ret = SSL_CTX_set_current_cert(ctx, SSL_CERT_SET_NEXT)) chains_set++;
 
                        /*
                         *      Check for discrepancies
                         */
 
                        DEBUG3("Found %zu server certificate chain(s)", chains_set);
 
                        if (chains_set != chains_conf) {
                                WARN("Number of chains configured (%zu) does not match chains set (%zu)",
                                      chains_conf, chains_set);
                                if (chains_conf > chains_set) WARN("Only one chain per key type is allowed, "
                                                                   "check config for duplicates");
                        }
 
                        for (ret = SSL_CTX_set_current_cert(ctx, SSL_CERT_SET_FIRST);
                             ret == 1;
                             ret = SSL_CTX_set_current_cert(ctx, SSL_CERT_SET_NEXT)) {
                                STACK_OF(X509)  *our_chain;
                                X509            *our_cert;
 
                                our_cert = SSL_CTX_get0_certificate(ctx);
 
                                /*
                                 *      The pkey type of the server certificate
                                 *      determines which pkey slot OpenSSL
                                 *      uses to store the chain.
                                 */
                                DEBUG3("%s chain", fr_tls_utils_x509_pkey_type(our_cert));
                                if (!SSL_CTX_get0_chain_certs(ctx, &our_chain)) {
                                        fr_tls_log_perror(NULL, "Failed retrieving chain certificates");
                                        goto error;
                                }
 
                                if (DEBUG_ENABLED3) fr_tls_chain_log(NULL, L_DBG, our_chain, our_cert);
                        }
                        (void)SSL_CTX_set_current_cert(ctx, SSL_CERT_SET_FIRST);        /* Reset */
                }
        }
 
#ifdef PSK_MAX_IDENTITY_LEN
post_ca:
#endif
        if (tls_ctx_version_set(&ctx_options, ctx, conf) < 0) goto error;
 
        /*
         *      SSL_OP_SINGLE_DH_USE must be used in order to prevent
         *      small subgroup attacks and forward secrecy. Always
         *      using SSL_OP_SINGLE_DH_USE has an impact on the
         *      computer time needed during negotiation, but it is not
         *      very large.
         */
        if (!conf->disable_single_dh_use) {
                ctx_options |= SSL_OP_SINGLE_DH_USE;
        }
 
#ifdef SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS
        /*
         *      Note: This flag isn't honoured by all OpenSSL forks.
         */
        if (conf->allow_renegotiation) {
                ctx_options |= SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS;
        }
#endif
 
        /*
         *      SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS to work around issues
         *      in Windows Vista client.
         *      http://www.openssl.org/~bodo/tls-cbc.txt
         *      http://www.nabble.com/(RADIATOR)-Radiator-Version-3.16-released-t2600070.html
         */
        ctx_options |= SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
 
        /*
         *      SSL_OP_CIPHER_SERVER_PREFERENCE to follow best practice
         *      of nowday's TLS: do not allow poorly-selected ciphers from
         *      client to take preference
         */
        if (conf->cipher_server_preference) ctx_options |= SSL_OP_CIPHER_SERVER_PREFERENCE;
 
        SSL_CTX_set_options(ctx, ctx_options);
 
        /*
         *      TODO: Set the RSA & DH
         *      SSL_CTX_set_tmp_rsa_callback(ctx, cbtls_rsa);
         *      SSL_CTX_set_tmp_dh_callback(ctx, cbtls_dh);
         */
 
        /*
         *      Set the block size for record padding.  This is only
         *      used in TLS 1.3.
         */
        if (conf->padding_block_size) SSL_CTX_set_block_padding(ctx, conf->padding_block_size);
 
        /*
         *      Set elliptical curve crypto configuration.
         */
#ifndef OPENSSL_NO_ECDH
        if (ctx_ecdh_curve_set(ctx, conf->ecdh_curve, conf->disable_single_dh_use) < 0) goto error;
#endif
 
 
        /* Set Info callback */
        SSL_CTX_set_info_callback(ctx, fr_tls_session_info_cb);
 
        /*
         *      SSL_ctx_set_verify is now called in the session
         *      alloc functions so they can set custom behaviour
         *      depending on the code area the SSL * will be used
         *      and whether we're acting as a client or server.
         */
        if (conf->verify_depth) {
                SSL_CTX_set_verify_depth(ctx, conf->verify_depth);
        }
 
#ifdef HAVE_OPENSSL_OCSP_H
        /*
         *      Configure OCSP stapling for the server cert
         */
        if (conf->staple.enable) {
                SSL_CTX_set_tlsext_status_cb(ctx, fr_tls_ocsp_staple_cb);
                SSL_CTX_set_tlsext_status_arg(ctx, UNCONST(fr_tls_ocsp_conf_t *, &(conf->staple)));
        }
#endif
 
        /*
         *      Set the cipher list if we were told to do so.  We do
         *      this before setting min/max TLS version.  In a sane
         *      world, OpenSSL would error out if we set the max TLS
         *      version to something which was unsupported by the
         *      current security level.  However, this is OpenSSL.  If
         *      you set conflicting options, it doesn't give an error.
         *      Instead, it just picks something to do.
         *
         *      SSL_CTX_set_cipher_list() accepts an empty string to
         *      clear the list for TLS <1.3 methods.  However, it
         *      reports an error.  We therefore catch the error, and
         *      allow it.
         */
        if (conf->cipher_list &&
            !SSL_CTX_set_cipher_list(ctx, conf->cipher_list)) {
                unsigned long err = ERR_peek_last_error();
 
DIAG_OFF_OPTIONAL(used-but-marked-unused)       /* fix spurious warnings for ERR_GET macros */
                if (ERR_GET_LIB(err) != ERR_LIB_SSL ||
                    ERR_GET_REASON(err) != SSL_R_NO_CIPHER_MATCH) {
                        fr_tls_log_perror(NULL, "Failed setting cipher_list");
                        goto error;
                }
DIAG_ON_OPTIONAL(used-but-marked-unused)
        }
 
        /*
         *      SSL_CTX_set_ciphersuites() accepts an empty string to
         *      clear the list for TLS >=1.3 methods.  However, it
         *      reports an error.  We therefore catch the error, and
         *      allow it.
         */
       if (conf->cipher_suites &&
           !SSL_CTX_set_ciphersuites(ctx, conf->cipher_suites)) {
                unsigned long err = ERR_peek_last_error();
 
DIAG_OFF_OPTIONAL(used-but-marked-unused)       /* fix spurious warnings for ERR_GET macros */
                if (ERR_GET_LIB(err) != ERR_LIB_SSL ||
                    ERR_GET_REASON(err) != SSL_R_NO_CIPHER_MATCH) {
                        fr_tls_log_perror(NULL, "Failed setting cipher_suites");
                        goto error;
                }
DIAG_ON_OPTIONAL(used-but-marked-unused)
       }
 
        /*
         *      Set the supported groups if configured.
         *
         *      For TLS 1.3 this can help reduce round trips if the list
         *      includes a group the client predicted in the key_share extension.
         */
        if (conf->group_list) {
                if (!SSL_CTX_set1_groups_list(ctx, UNCONST(char *,conf->group_list))) {
                        fr_tls_log_perror(NULL, "Failed setting group list");
                        goto error;
                }
        }
 
        /*
         *      Print the actual cipher list
         */
        if (DEBUG_ENABLED3) {
                SSL             *ssl;
                unsigned int    i = 0;
                char const      *cipher;
 
                ssl = SSL_new(ctx);
                if (!ssl) {
                        fr_tls_log_perror(NULL, "Failed creating temporary SSL session");
                        goto error;
                }
 
                DEBUG3("Configured ciphers (by priority)");
 
                while ((cipher = SSL_get_cipher_list(ssl, i))) {
                        DEBUG3("[%u] %s", i, cipher);
                        i++;            /* Print index starting at zero */
                }
 
                SSL_free(ssl);
        }
 
        /*
         *      Load dh params
         */
        if (conf->dh_file) {
                if (ctx_dh_params_load(ctx, UNCONST(char *, conf->dh_file)) < 0) goto error;
        } else {
                /*
                 *      Tell OpenSSL to automatically set the DH
                 *      parameters based on the the size of the key
                 *      associated with the certificate, or for PSK,
                 *      with the negotiated symmetric cipher key.
                 */
                SSL_CTX_set_dh_auto(ctx, 1);
        }
 
        /*
         *      DTLS doesn't support stateless session resumption.  So
         *      we forbid that.
         *
         *      For "auto", we do a horrible hack, and just rewrite
         *      the config.  This is simpler than adding more options
         *      to the ctx_init() function.
         */
        if (conf->socket_type == SOCK_DGRAM) {
                if (conf->cache.mode == FR_TLS_TICKET_STATELESS) {
                        ERROR("session { mode = \"stateless\" } is not supported with DTLS.  "
                              "Use \"stateful\" or \"disabled\"");
                        goto error;
                }
 
                if (conf->cache.mode == FR_TLS_TICKET_AUTO) {
                        UNCONST(fr_tls_conf_t *, conf)->cache.mode = FR_TLS_TICKET_STATEFUL;
                }
 
                /*
                 *      A DTLS server answers the first ClientHello with a HelloVerifyRequest that carries a
                 *      cookie.  The cookie prevents an attacker from forging DTLS packets which would
                 *      otherwise be able to affect the connection.
                 *
                 *      The client simply echoes back any cookie that it received.
                 */
                if (!client) {
                        SSL_CTX_set_options(ctx, SSL_OP_COOKIE_EXCHANGE);
                        SSL_CTX_set_cookie_generate_cb(ctx, fr_dtls_cookie_generate_cb);
                        SSL_CTX_set_cookie_verify_cb(ctx, fr_dtls_cookie_verify_cb);
                }
        }
 
        /*
         *      Setup session caching
         */
        if (fr_tls_ticket_ctx_init(ctx, &conf->cache, client) < 0) goto error;
 
        /*
         *      Set the ALPN context.
         */
        if (fr_tls_ctx_alpn_set(ctx, conf, client) < 0) goto error;
 
        /*
         *      Set the keylog file if the admin requested it.
         */
        if ((getenv("SSLKEYLOGFILE") != NULL) || (conf->keylog_file && *conf->keylog_file)) {
                SSL_CTX_set_keylog_callback(ctx, fr_tls_session_keylog_cb);
        }
 
        return ctx;
}
#endif