+#ifndef OPENSSL_NO_DTLS1
+ if (www && socket_type == SOCK_DGRAM) {
+ BIO_printf(bio_err, "Can't use -HTTP, -www or -WWW with DTLS\n");
+ goto end;
+ }
+#endif
+
+ if (unix_path && (socket_type != SOCK_STREAM)) {
+ BIO_printf(bio_err,
+ "Can't use unix sockets and datagrams together\n");
+ goto end;
+ }
+#if !defined(OPENSSL_NO_JPAKE) && !defined(OPENSSL_NO_PSK)
+ if (jpake_secret) {
+ if (psk_key) {
+ BIO_printf(bio_err, "Can't use JPAKE and PSK together\n");
+ goto end;
+ }
+ psk_identity = "JPAKE";
+ }
+#endif
+
+ if (!app_passwd(passarg, dpassarg, &pass, &dpass)) {
+ BIO_printf(bio_err, "Error getting password\n");
+ goto end;
+ }
+
+ if (s_key_file == NULL)
+ s_key_file = s_cert_file;
+#ifndef OPENSSL_NO_TLSEXT
+ if (s_key_file2 == NULL)
+ s_key_file2 = s_cert_file2;
+#endif
+
+ if (!load_excert(&exc))
+ goto end;
+
+ if (nocert == 0) {
+ s_key = load_key(s_key_file, s_key_format, 0, pass, e,
+ "server certificate private key file");
+ if (!s_key) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+
+ s_cert = load_cert(s_cert_file, s_cert_format,
+ NULL, e, "server certificate file");
+
+ if (!s_cert) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ if (s_chain_file) {
+ s_chain = load_certs(s_chain_file, FORMAT_PEM,
+ NULL, e, "server certificate chain");
+ if (!s_chain)
+ goto end;
+ }
+#ifndef OPENSSL_NO_TLSEXT
+ if (tlsextcbp.servername) {
+ s_key2 = load_key(s_key_file2, s_key_format, 0, pass, e,
+ "second server certificate private key file");
+ if (!s_key2) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+
+ s_cert2 = load_cert(s_cert_file2, s_cert_format,
+ NULL, e, "second server certificate file");
+
+ if (!s_cert2) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ }
+#endif /* OPENSSL_NO_TLSEXT */
+ }
+#if !defined(OPENSSL_NO_TLSEXT)
+# if !defined(OPENSSL_NO_NEXTPROTONEG)
+ if (next_proto_neg_in) {
+ unsigned short len;
+ next_proto.data = next_protos_parse(&len, next_proto_neg_in);
+ if (next_proto.data == NULL)
+ goto end;
+ next_proto.len = len;
+ } else {
+ next_proto.data = NULL;
+ }
+# endif
+ alpn_ctx.data = NULL;
+ if (alpn_in) {
+ unsigned short len;
+ alpn_ctx.data = next_protos_parse(&len, alpn_in);
+ if (alpn_ctx.data == NULL)
+ goto end;
+ alpn_ctx.len = len;
+ }
+#endif
+
+ if (crl_file) {
+ X509_CRL *crl;
+ crl = load_crl(crl_file, crl_format);
+ if (!crl) {
+ BIO_puts(bio_err, "Error loading CRL\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ crls = sk_X509_CRL_new_null();
+ if (!crls || !sk_X509_CRL_push(crls, crl)) {
+ BIO_puts(bio_err, "Error adding CRL\n");
+ ERR_print_errors(bio_err);
+ X509_CRL_free(crl);
+ goto end;
+ }
+ }
+
+ if (s_dcert_file) {
+
+ if (s_dkey_file == NULL)
+ s_dkey_file = s_dcert_file;
+
+ s_dkey = load_key(s_dkey_file, s_dkey_format,
+ 0, dpass, e, "second certificate private key file");
+ if (!s_dkey) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+
+ s_dcert = load_cert(s_dcert_file, s_dcert_format,
+ NULL, e, "second server certificate file");
+
+ if (!s_dcert) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ if (s_dchain_file) {
+ s_dchain = load_certs(s_dchain_file, FORMAT_PEM,
+ NULL, e, "second server certificate chain");
+ if (!s_dchain)
+ goto end;
+ }
+
+ }
+
+ if (!app_RAND_load_file(NULL, 1) && inrand == NULL
+ && !RAND_status()) {
+ BIO_printf(bio_err,
+ "warning, not much extra random data, consider using the -rand option\n");
+ }
+ if (inrand != NULL)
+ BIO_printf(bio_err, "%ld semi-random bytes loaded\n",
+ app_RAND_load_files(inrand));
+
+ if (bio_s_out == NULL) {
+ if (s_quiet && !s_debug) {
+ bio_s_out = BIO_new(BIO_s_null());
+ if (s_msg && !bio_s_msg)
+ bio_s_msg = dup_bio_out();
+ } else {
+ if (bio_s_out == NULL)
+ bio_s_out = dup_bio_out();
+ }
+ }
+#if !defined(OPENSSL_NO_RSA) || !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_EC)
+ if (nocert)
+#endif
+ {
+ s_cert_file = NULL;
+ s_key_file = NULL;
+ s_dcert_file = NULL;
+ s_dkey_file = NULL;
+#ifndef OPENSSL_NO_TLSEXT
+ s_cert_file2 = NULL;
+ s_key_file2 = NULL;
+#endif
+ }
+
+ ctx = SSL_CTX_new(meth);
+ if (sdebug)
+ ssl_ctx_security_debug(ctx, bio_err, sdebug);
+ if (ctx == NULL) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ if (session_id_prefix) {
+ if (strlen(session_id_prefix) >= 32)
+ BIO_printf(bio_err,
+ "warning: id_prefix is too long, only one new session will be possible\n");
+ if (!SSL_CTX_set_generate_session_id(ctx, generate_session_id)) {
+ BIO_printf(bio_err, "error setting 'id_prefix'\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ BIO_printf(bio_err, "id_prefix '%s' set.\n", session_id_prefix);
+ }
+ SSL_CTX_set_quiet_shutdown(ctx, 1);
+ if (exc)
+ ssl_ctx_set_excert(ctx, exc);
+
+ if (state)
+ SSL_CTX_set_info_callback(ctx, apps_ssl_info_callback);
+ if (no_cache)
+ SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
+ else if (ext_cache)
+ init_session_cache_ctx(ctx);
+ else
+ SSL_CTX_sess_set_cache_size(ctx, 128);
+
+#ifndef OPENSSL_NO_SRTP
+ if (srtp_profiles != NULL) {
+ /* Returns 0 on success! */
+ if (SSL_CTX_set_tlsext_use_srtp(ctx, srtp_profiles) != 0) {
+ BIO_printf(bio_err, "Error setting SRTP profile\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ }
+#endif
+
+ if (!ctx_set_verify_locations(ctx, CAfile, CApath)) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ if (vpmtouched && !SSL_CTX_set1_param(ctx, vpm)) {
+ BIO_printf(bio_err, "Error setting verify params\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+
+ ssl_ctx_add_crls(ctx, crls, 0);
+ if (!config_ctx(cctx, ssl_args, ctx, no_ecdhe, jpake_secret == NULL))
+ goto end;
+
+ if (!ssl_load_stores(ctx, vfyCApath, vfyCAfile, chCApath, chCAfile,
+ crls, crl_download)) {
+ BIO_printf(bio_err, "Error loading store locations\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+#ifndef OPENSSL_NO_TLSEXT
+ if (s_cert2) {
+ ctx2 = SSL_CTX_new(meth);
+ if (ctx2 == NULL) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ }
+
+ if (ctx2) {
+ BIO_printf(bio_s_out, "Setting secondary ctx parameters\n");
+
+ if (sdebug)
+ ssl_ctx_security_debug(ctx, bio_err, sdebug);
+
+ if (session_id_prefix) {
+ if (strlen(session_id_prefix) >= 32)
+ BIO_printf(bio_err,
+ "warning: id_prefix is too long, only one new session will be possible\n");
+ if (!SSL_CTX_set_generate_session_id(ctx2, generate_session_id)) {
+ BIO_printf(bio_err, "error setting 'id_prefix'\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ BIO_printf(bio_err, "id_prefix '%s' set.\n", session_id_prefix);
+ }
+ SSL_CTX_set_quiet_shutdown(ctx2, 1);
+ if (exc)
+ ssl_ctx_set_excert(ctx2, exc);
+
+ if (state)
+ SSL_CTX_set_info_callback(ctx2, apps_ssl_info_callback);
+
+ if (no_cache)
+ SSL_CTX_set_session_cache_mode(ctx2, SSL_SESS_CACHE_OFF);
+ else if (ext_cache)
+ init_session_cache_ctx(ctx2);
+ else
+ SSL_CTX_sess_set_cache_size(ctx2, 128);
+
+ if ((!SSL_CTX_load_verify_locations(ctx2, CAfile, CApath)) ||
+ (!SSL_CTX_set_default_verify_paths(ctx2))) {
+ ERR_print_errors(bio_err);
+ }
+ if (vpmtouched && !SSL_CTX_set1_param(ctx2, vpm)) {
+ BIO_printf(bio_err, "Error setting verify params\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+
+ ssl_ctx_add_crls(ctx2, crls, 0);
+ if (!config_ctx(cctx, ssl_args, ctx2, no_ecdhe, jpake_secret == NULL))
+ goto end;
+ }
+# ifndef OPENSSL_NO_NEXTPROTONEG
+ if (next_proto.data)
+ SSL_CTX_set_next_protos_advertised_cb(ctx, next_proto_cb,
+ &next_proto);
+# endif
+ if (alpn_ctx.data)
+ SSL_CTX_set_alpn_select_cb(ctx, alpn_cb, &alpn_ctx);
+#endif