From caa2427f0c743beb0f6d1736dc8c0e4e551a0e1f Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Tue, 22 Nov 2016 16:54:28 +0000 Subject: [PATCH] Stop server from expecting Certificate message when not requested In a non client-auth renegotiation where the original handshake *was* client auth, then the server will expect the client to send a Certificate message anyway resulting in a connection failure. Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/1983) --- ssl/statem/statem.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ssl/statem/statem.c b/ssl/statem/statem.c index f4895f41ac..512f1e0941 100644 --- a/ssl/statem/statem.c +++ b/ssl/statem/statem.c @@ -361,6 +361,8 @@ static int state_machine(SSL *s, int server) */ s->ctx->stats.sess_accept_renegotiate++; } + + s->s3->tmp.cert_request = 0; } else { s->ctx->stats.sess_connect++; @@ -368,7 +370,6 @@ static int state_machine(SSL *s, int server) memset(s->s3->client_random, 0, sizeof(s->s3->client_random)); s->hit = 0; - s->s3->tmp.cert_request = 0; s->s3->tmp.cert_req = 0; if (SSL_IS_DTLS(s)) { -- 2.25.1