Add ssl verify client handler
Pull-Request Check List
- [x] Add patches into
src/. - [x] Add test into
test/. Please see about test docs. - [x] Add docs into
docs/if you change the features such as build system, Ruby methods, class and nginx directives.
The patch adds handlers after verifying client certificate in SSL Handshake.
I would fix things you point out. Please review them.
@keizo042 この件いかがでしょう?とても良いPRなのでマージしたいです
Nginx::SSL.accept_clientのテストを書くのが手間で止まっています。
他の指摘は問題なく修正可能です。
Nginx:SSL.accept_clientのテストには
x509として有効であり値として不適切である自己署名ではないx509証明書が必要です。
これを作成する方法とそれが適切であるとする条件が纏めきれていません。
証明書発行まわりは不勉強なので時間がかかりそうです。
@matsumotory
I have tried to use this feature for my local project and I start to confuse. Because, I have no idea what will be use case for this feature. As far I know MRuby doesn't have openssl library like CRuby. So, we cannot validate client certificate based with our custom CA cert.
Also, about a test I think openssl s_client not working properly for client cert validation results. It was only giving error "1: self signed certificate" when you provide a wrong client certificate, also same thing happened if you did not provide -CAfile abc.cert in command.