Open ssl pfx

[Drawaes]

The tests probably won't pass because I need to set the password and path for the PFX instead of the PEM's you are currently using....

But its to give you the idea ;)

[dnfclas]

@Drawaes,
Thanks for having already signed the Contribution License Agreement. Your agreement was validated by .NET Foundation. We will now review your pull request.
Thanks,
.NET Foundation Pull Request Bot

[halter73]

Thanks! Even if we're not going keep it, it's nice to be able to use one cert file 👍

[analogrelay]

This isn't code we're ever going to ship, it's just a hack that we added a while ago to allow us to start working on HTTP/2 while we wait for support for ALPN in SslStream (which is apparently merged, and we're just waiting to update to it), but hey, if you want to make it work a little smoother, I'm not going to complain.

The tests probably won't pass

Hah, what tests? There are no tests for this code 😆 😛

[Drawaes]

yeah I know its not being kept... but you know, PEM files are ugly

[Drawaes]

Yeah the ALPN should be good to go ...
dotnet/corefx#24883
dotnet/corefx#24799

:) I have some more changes to go on SslStream... making it great again... (I also think I understand the lacklustre perf on Unix, but I am not there yet on implementing the fix as it's a beast of old code)

https://github.com/dotnet/corefx/issues/23485

[analogrelay]

fail: Microsoft.AspNetCore.Server.Kestrel[0]
      Uncaught exception from the OnConnectionAsync method of an IConnectionAdapter.
System.EntryPointNotFoundException: Unable to find an entry point named 'SSL_CTX_set1_chain' in DLL 'libssl'.
   at Microsoft.AspNetCore.Server.Kestrel.Tls.OpenSsl.NativeMethods.SSL_CTX_set1_chain(IntPtr ctx, IntPtr sk)
   at Microsoft.AspNetCore.Server.Kestrel.Tls.OpenSsl.SSL_CTX_Set_Pfx(IntPtr ctx, String path, String password) in C:\Users\anurse\Code\aspnet\KestrelHttpServer\src\Kestrel.Tls\OpenSsl.cs:line 96
   at Microsoft.AspNetCore.Server.Kestrel.Tls.TlsStream..ctor(Stream innerStream, String certificatePath, String password, IEnumerable`1 protocols) in C:\Users\anurse\Code\aspnet\KestrelHttpServer\src\Kestrel.Tls\TlsStream.cs:line 56
   at Microsoft.AspNetCore.Server.Kestrel.Tls.TlsConnectionAdapter.<InnerOnConnectionAsync>d__10.MoveNext() in C:\Users\anurse\Code\aspnet\KestrelHttpServer\src\Kestrel.Tls\TlsConnectionAdapter.cs:line 73
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.HttpConnection.<ApplyConnectionAdaptersAsync>d__56.MoveNext() in C:\Users\anurse\Code\aspnet\KestrelHttpServer\src\Kestrel.Core\Internal\HttpConnection.cs:line 286

:( https://sadtrombone.com/

For some reason, in my docker image (based on Debian Stretch), libssl doesn't have any of the set/add chain functions:

root@823c5b1448b8:/app# nm -D /usr/lib//x86_64-linux-gnu/libssl.so | grep chain
0000000000034cf0 T SSL_CTX_use_certificate_chain_file
000000000004e530 T SSL_check_chain
0000000000031f20 T SSL_get0_verified_chain
000000000002e6e0 T SSL_get_peer_cert_chain
0000000000034d00 T SSL_use_certificate_chain_file
                 U X509_STORE_CTX_get0_chain
                 U X509_STORE_CTX_get1_chain
                 U X509_chain_check_suiteb
                 U X509_chain_up_ref

Possibly an optional component not compiled in? I think I'm going to just revert this for now as this was intended to be part of a quick addition and wasn't something I planned to spend all day doing :)

[Drawaes]

sure if you want, or remove the chain stuff....They are macros that sometimes don't get compiled in. You probably aren't using chains in your PFX anyway

[analogrelay]

Oh, they're macros? Then they wouldn't work at all. You can't P/Invoke to a macro. You'd have to call SSL_CTX_ctrl directly.

[analogrelay]

Ok, I think I can save it. I'll roll it into my PR though, so I can actually test it