1 #pragma once 2 3 #include "bmcweb_config.h" 4 5 #include "logging.hpp" 6 #include "ossl_random.hpp" 7 #include "persistent_data.hpp" 8 9 #include <boost/beast/core/file_posix.hpp> 10 11 extern "C" 12 { 13 #include <nghttp2/nghttp2.h> 14 #include <openssl/bio.h> 15 #include <openssl/dh.h> 16 #include <openssl/dsa.h> 17 #include <openssl/err.h> 18 #include <openssl/evp.h> 19 #include <openssl/pem.h> 20 #include <openssl/rand.h> 21 #include <openssl/rsa.h> 22 #include <openssl/ssl.h> 23 } 24 25 #include <boost/asio/ssl/context.hpp> 26 #include <boost/system/error_code.hpp> 27 28 #include <filesystem> 29 #include <memory> 30 #include <optional> 31 #include <random> 32 #include <string> 33 34 namespace ensuressl 35 { 36 constexpr const char* trustStorePath = "/etc/ssl/certs/authority"; 37 constexpr const char* x509Comment = "Generated from OpenBMC service"; 38 static void initOpenssl(); 39 static EVP_PKEY* createEcKey(); 40 41 // Trust chain related errors.` 42 inline bool isTrustChainError(int errnum) 43 { 44 return (errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) || 45 (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) || 46 (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) || 47 (errnum == X509_V_ERR_CERT_UNTRUSTED) || 48 (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE); 49 } 50 51 inline bool validateCertificate(X509* const cert) 52 { 53 // Create an empty X509_STORE structure for certificate validation. 54 X509_STORE* x509Store = X509_STORE_new(); 55 if (x509Store == nullptr) 56 { 57 BMCWEB_LOG_ERROR("Error occurred during X509_STORE_new call"); 58 return false; 59 } 60 61 // Load Certificate file into the X509 structure. 62 X509_STORE_CTX* storeCtx = X509_STORE_CTX_new(); 63 if (storeCtx == nullptr) 64 { 65 BMCWEB_LOG_ERROR("Error occurred during X509_STORE_CTX_new call"); 66 X509_STORE_free(x509Store); 67 return false; 68 } 69 70 int errCode = X509_STORE_CTX_init(storeCtx, x509Store, cert, nullptr); 71 if (errCode != 1) 72 { 73 BMCWEB_LOG_ERROR("Error occurred during X509_STORE_CTX_init call"); 74 X509_STORE_CTX_free(storeCtx); 75 X509_STORE_free(x509Store); 76 return false; 77 } 78 79 errCode = X509_verify_cert(storeCtx); 80 if (errCode == 1) 81 { 82 BMCWEB_LOG_INFO("Certificate verification is success"); 83 X509_STORE_CTX_free(storeCtx); 84 X509_STORE_free(x509Store); 85 return true; 86 } 87 if (errCode == 0) 88 { 89 errCode = X509_STORE_CTX_get_error(storeCtx); 90 X509_STORE_CTX_free(storeCtx); 91 X509_STORE_free(x509Store); 92 if (isTrustChainError(errCode)) 93 { 94 BMCWEB_LOG_DEBUG("Ignoring Trust Chain error. Reason: {}", 95 X509_verify_cert_error_string(errCode)); 96 return true; 97 } 98 BMCWEB_LOG_ERROR("Certificate verification failed. Reason: {}", 99 X509_verify_cert_error_string(errCode)); 100 return false; 101 } 102 103 BMCWEB_LOG_ERROR( 104 "Error occurred during X509_verify_cert call. ErrorCode: {}", errCode); 105 X509_STORE_CTX_free(storeCtx); 106 X509_STORE_free(x509Store); 107 return false; 108 } 109 110 inline std::string verifyOpensslKeyCert(const std::string& filepath) 111 { 112 bool privateKeyValid = false; 113 114 BMCWEB_LOG_INFO("Checking certs in file {}", filepath); 115 boost::beast::file_posix file; 116 boost::system::error_code ec; 117 file.open(filepath.c_str(), boost::beast::file_mode::read, ec); 118 if (ec) 119 { 120 return ""; 121 } 122 bool certValid = false; 123 std::string fileContents; 124 fileContents.resize(static_cast<size_t>(file.size(ec)), '\0'); 125 file.read(fileContents.data(), fileContents.size(), ec); 126 if (ec) 127 { 128 BMCWEB_LOG_ERROR("Failed to read file"); 129 return ""; 130 } 131 132 BIO* bufio = BIO_new_mem_buf(static_cast<void*>(fileContents.data()), 133 static_cast<int>(fileContents.size())); 134 EVP_PKEY* pkey = PEM_read_bio_PrivateKey(bufio, nullptr, nullptr, nullptr); 135 BIO_free(bufio); 136 if (pkey != nullptr) 137 { 138 #if (OPENSSL_VERSION_NUMBER < 0x30000000L) 139 RSA* rsa = EVP_PKEY_get1_RSA(pkey); 140 if (rsa != nullptr) 141 { 142 BMCWEB_LOG_INFO("Found an RSA key"); 143 if (RSA_check_key(rsa) == 1) 144 { 145 privateKeyValid = true; 146 } 147 else 148 { 149 BMCWEB_LOG_ERROR("Key not valid error number {}", 150 ERR_get_error()); 151 } 152 RSA_free(rsa); 153 } 154 else 155 { 156 EC_KEY* ec = EVP_PKEY_get1_EC_KEY(pkey); 157 if (ec != nullptr) 158 { 159 BMCWEB_LOG_INFO("Found an EC key"); 160 if (EC_KEY_check_key(ec) == 1) 161 { 162 privateKeyValid = true; 163 } 164 else 165 { 166 BMCWEB_LOG_ERROR("Key not valid error number {}", 167 ERR_get_error()); 168 } 169 EC_KEY_free(ec); 170 } 171 } 172 #else 173 EVP_PKEY_CTX* pkeyCtx = EVP_PKEY_CTX_new_from_pkey(nullptr, pkey, 174 nullptr); 175 176 if (pkeyCtx == nullptr) 177 { 178 BMCWEB_LOG_ERROR("Unable to allocate pkeyCtx {}", ERR_get_error()); 179 } 180 else if (EVP_PKEY_check(pkeyCtx) == 1) 181 { 182 privateKeyValid = true; 183 } 184 else 185 { 186 BMCWEB_LOG_ERROR("Key not valid error number {}", ERR_get_error()); 187 } 188 #endif 189 190 if (privateKeyValid) 191 { 192 BIO* bufio2 = 193 BIO_new_mem_buf(static_cast<void*>(fileContents.data()), 194 static_cast<int>(fileContents.size())); 195 X509* x509 = PEM_read_bio_X509(bufio2, nullptr, nullptr, nullptr); 196 BIO_free(bufio2); 197 if (x509 == nullptr) 198 { 199 BMCWEB_LOG_ERROR("error getting x509 cert {}", ERR_get_error()); 200 } 201 else 202 { 203 certValid = validateCertificate(x509); 204 X509_free(x509); 205 } 206 } 207 208 #if (OPENSSL_VERSION_NUMBER > 0x30000000L) 209 EVP_PKEY_CTX_free(pkeyCtx); 210 #endif 211 EVP_PKEY_free(pkey); 212 } 213 if (!certValid) 214 { 215 return ""; 216 } 217 return fileContents; 218 } 219 220 inline X509* loadCert(const std::string& filePath) 221 { 222 BIO* certFileBio = BIO_new_file(filePath.c_str(), "rb"); 223 if (certFileBio == nullptr) 224 { 225 BMCWEB_LOG_ERROR("Error occurred during BIO_new_file call, FILE= {}", 226 filePath); 227 return nullptr; 228 } 229 230 X509* cert = X509_new(); 231 if (cert == nullptr) 232 { 233 BMCWEB_LOG_ERROR("Error occurred during X509_new call, {}", 234 ERR_get_error()); 235 BIO_free(certFileBio); 236 return nullptr; 237 } 238 239 if (PEM_read_bio_X509(certFileBio, &cert, nullptr, nullptr) == nullptr) 240 { 241 BMCWEB_LOG_ERROR( 242 "Error occurred during PEM_read_bio_X509 call, FILE= {}", filePath); 243 244 BIO_free(certFileBio); 245 X509_free(cert); 246 return nullptr; 247 } 248 BIO_free(certFileBio); 249 return cert; 250 } 251 252 inline int addExt(X509* cert, int nid, const char* value) 253 { 254 X509_EXTENSION* ex = nullptr; 255 X509V3_CTX ctx{}; 256 X509V3_set_ctx(&ctx, cert, cert, nullptr, nullptr, 0); 257 258 // NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast) 259 ex = X509V3_EXT_conf_nid(nullptr, &ctx, nid, const_cast<char*>(value)); 260 if (ex == nullptr) 261 { 262 BMCWEB_LOG_ERROR("Error: In X509V3_EXT_conf_nidn: {}", value); 263 return -1; 264 } 265 X509_add_ext(cert, ex, -1); 266 X509_EXTENSION_free(ex); 267 return 0; 268 } 269 270 // Writes a certificate to a path, ignoring errors 271 inline void writeCertificateToFile(const std::string& filepath, 272 const std::string& certificate) 273 { 274 boost::system::error_code ec; 275 boost::beast::file_posix file; 276 file.open(filepath.c_str(), boost::beast::file_mode::write, ec); 277 if (!ec) 278 { 279 file.write(certificate.data(), certificate.size(), ec); 280 // ignore result 281 } 282 } 283 284 inline std::string generateSslCertificate(const std::string& cn) 285 { 286 BMCWEB_LOG_INFO("Generating new keys"); 287 initOpenssl(); 288 289 std::string buffer; 290 BMCWEB_LOG_INFO("Generating EC key"); 291 EVP_PKEY* pPrivKey = createEcKey(); 292 if (pPrivKey != nullptr) 293 { 294 BMCWEB_LOG_INFO("Generating x509 Certificates"); 295 // Use this code to directly generate a certificate 296 X509* x509 = X509_new(); 297 if (x509 != nullptr) 298 { 299 // get a random number from the RNG for the certificate serial 300 // number If this is not random, regenerating certs throws browser 301 // errors 302 bmcweb::OpenSSLGenerator gen; 303 std::uniform_int_distribution<int> dis( 304 1, std::numeric_limits<int>::max()); 305 int serial = dis(gen); 306 307 ASN1_INTEGER_set(X509_get_serialNumber(x509), serial); 308 309 // not before this moment 310 X509_gmtime_adj(X509_get_notBefore(x509), 0); 311 // Cert is valid for 10 years 312 X509_gmtime_adj(X509_get_notAfter(x509), 313 60L * 60L * 24L * 365L * 10L); 314 315 // set the public key to the key we just generated 316 X509_set_pubkey(x509, pPrivKey); 317 318 // get the subject name 319 X509_NAME* name = X509_get_subject_name(x509); 320 321 using x509String = const unsigned char; 322 // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast) 323 x509String* country = reinterpret_cast<x509String*>("US"); 324 // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast) 325 x509String* company = reinterpret_cast<x509String*>("OpenBMC"); 326 // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast) 327 x509String* cnStr = reinterpret_cast<x509String*>(cn.c_str()); 328 329 X509_NAME_add_entry_by_txt(name, "C", MBSTRING_ASC, country, -1, -1, 330 0); 331 X509_NAME_add_entry_by_txt(name, "O", MBSTRING_ASC, company, -1, -1, 332 0); 333 X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, cnStr, -1, -1, 334 0); 335 // set the CSR options 336 X509_set_issuer_name(x509, name); 337 338 X509_set_version(x509, 2); 339 addExt(x509, NID_basic_constraints, ("critical,CA:TRUE")); 340 addExt(x509, NID_subject_alt_name, ("DNS:" + cn).c_str()); 341 addExt(x509, NID_subject_key_identifier, ("hash")); 342 addExt(x509, NID_authority_key_identifier, ("keyid")); 343 addExt(x509, NID_key_usage, ("digitalSignature, keyEncipherment")); 344 addExt(x509, NID_ext_key_usage, ("serverAuth")); 345 addExt(x509, NID_netscape_comment, (x509Comment)); 346 347 // Sign the certificate with our private key 348 X509_sign(x509, pPrivKey, EVP_sha256()); 349 350 BIO* bufio = BIO_new(BIO_s_mem()); 351 352 int pkeyRet = PEM_write_bio_PrivateKey( 353 bufio, pPrivKey, nullptr, nullptr, 0, nullptr, nullptr); 354 if (pkeyRet <= 0) 355 { 356 BMCWEB_LOG_ERROR( 357 "Failed to write pkey with code {}. Ignoring.", pkeyRet); 358 } 359 360 char* data = nullptr; 361 long int dataLen = BIO_get_mem_data(bufio, &data); 362 buffer += std::string_view(data, static_cast<size_t>(dataLen)); 363 BIO_free(bufio); 364 365 bufio = BIO_new(BIO_s_mem()); 366 pkeyRet = PEM_write_bio_X509(bufio, x509); 367 if (pkeyRet <= 0) 368 { 369 BMCWEB_LOG_ERROR( 370 "Failed to write X509 with code {}. Ignoring.", pkeyRet); 371 } 372 dataLen = BIO_get_mem_data(bufio, &data); 373 buffer += std::string_view(data, static_cast<size_t>(dataLen)); 374 375 BIO_free(bufio); 376 BMCWEB_LOG_INFO("Cert size is {}", buffer.size()); 377 X509_free(x509); 378 } 379 380 EVP_PKEY_free(pPrivKey); 381 pPrivKey = nullptr; 382 } 383 384 // cleanup_openssl(); 385 return buffer; 386 } 387 388 EVP_PKEY* createEcKey() 389 { 390 EVP_PKEY* pKey = nullptr; 391 392 #if (OPENSSL_VERSION_NUMBER < 0x30000000L) 393 int eccgrp = 0; 394 eccgrp = OBJ_txt2nid("secp384r1"); 395 396 EC_KEY* myecc = EC_KEY_new_by_curve_name(eccgrp); 397 if (myecc != nullptr) 398 { 399 EC_KEY_set_asn1_flag(myecc, OPENSSL_EC_NAMED_CURVE); 400 EC_KEY_generate_key(myecc); 401 pKey = EVP_PKEY_new(); 402 if (pKey != nullptr) 403 { 404 if (EVP_PKEY_assign(pKey, EVP_PKEY_EC, myecc) != 0) 405 { 406 /* pKey owns myecc from now */ 407 if (EC_KEY_check_key(myecc) <= 0) 408 { 409 BMCWEB_LOG_ERROR("EC_check_key failed."); 410 } 411 } 412 } 413 } 414 #else 415 // Create context for curve parameter generation. 416 std::unique_ptr<EVP_PKEY_CTX, decltype(&::EVP_PKEY_CTX_free)> ctx{ 417 EVP_PKEY_CTX_new_id(EVP_PKEY_EC, nullptr), &::EVP_PKEY_CTX_free}; 418 if (!ctx) 419 { 420 return nullptr; 421 } 422 423 // Set up curve parameters. 424 EVP_PKEY* params = nullptr; 425 if ((EVP_PKEY_paramgen_init(ctx.get()) <= 0) || 426 (EVP_PKEY_CTX_set_ec_param_enc(ctx.get(), OPENSSL_EC_NAMED_CURVE) <= 427 0) || 428 (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx.get(), NID_secp384r1) <= 429 0) || 430 (EVP_PKEY_paramgen(ctx.get(), ¶ms) <= 0)) 431 { 432 return nullptr; 433 } 434 435 // Set up RAII holder for params. 436 std::unique_ptr<EVP_PKEY, decltype(&::EVP_PKEY_free)> pparams{ 437 params, &::EVP_PKEY_free}; 438 439 // Set new context for key generation, using curve parameters. 440 ctx.reset(EVP_PKEY_CTX_new_from_pkey(nullptr, params, nullptr)); 441 if (!ctx || (EVP_PKEY_keygen_init(ctx.get()) <= 0)) 442 { 443 return nullptr; 444 } 445 446 // Generate key. 447 if (EVP_PKEY_keygen(ctx.get(), &pKey) <= 0) 448 { 449 return nullptr; 450 } 451 #endif 452 453 return pKey; 454 } 455 456 void initOpenssl() 457 { 458 #if OPENSSL_VERSION_NUMBER < 0x10100000L 459 SSL_load_error_strings(); 460 OpenSSL_add_all_algorithms(); 461 RAND_load_file("/dev/urandom", 1024); 462 #endif 463 } 464 465 inline std::string ensureOpensslKeyPresentAndValid(const std::string& filepath) 466 { 467 std::string cert = verifyOpensslKeyCert(filepath); 468 469 if (cert.empty()) 470 { 471 BMCWEB_LOG_WARNING("Error in verifying signature, regenerating"); 472 cert = generateSslCertificate("testhost"); 473 if (cert.empty()) 474 { 475 BMCWEB_LOG_ERROR("Failed to generate cert"); 476 } 477 else 478 { 479 writeCertificateToFile(filepath, cert); 480 } 481 } 482 return cert; 483 } 484 485 inline std::string ensureCertificate() 486 { 487 namespace fs = std::filesystem; 488 // Cleanup older certificate file existing in the system 489 fs::path oldcertPath = fs::path("/home/root/server.pem"); 490 std::error_code ec; 491 fs::remove(oldcertPath, ec); 492 // Ignore failure to remove; File might not exist. 493 494 fs::path certPath = "/etc/ssl/certs/https/"; 495 // if path does not exist create the path so that 496 // self signed certificate can be created in the 497 // path 498 fs::path certFile = certPath / "server.pem"; 499 500 if (!fs::exists(certPath, ec)) 501 { 502 fs::create_directories(certPath, ec); 503 } 504 BMCWEB_LOG_INFO("Building SSL Context file= {}", certFile.string()); 505 std::string sslPemFile(certFile); 506 return ensuressl::ensureOpensslKeyPresentAndValid(sslPemFile); 507 } 508 509 inline int nextProtoCallback(SSL* /*unused*/, const unsigned char** data, 510 unsigned int* len, void* /*unused*/) 511 { 512 // First byte is the length. 513 constexpr std::string_view h2 = "\x02h2"; 514 *data = std::bit_cast<const unsigned char*>(h2.data()); 515 *len = static_cast<unsigned int>(h2.size()); 516 return SSL_TLSEXT_ERR_OK; 517 } 518 519 inline int alpnSelectProtoCallback(SSL* /*unused*/, const unsigned char** out, 520 unsigned char* outlen, 521 const unsigned char* in, unsigned int inlen, 522 void* /*unused*/) 523 { 524 // There's a mismatch in constness for nghttp2_select_next_protocol. The 525 // examples in nghttp2 don't show this problem. Unclear what the right fix 526 // is here. 527 528 // NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast) 529 unsigned char** outNew = const_cast<unsigned char**>(out); 530 int rv = nghttp2_select_next_protocol(outNew, outlen, in, inlen); 531 if (rv != 1) 532 { 533 return SSL_TLSEXT_ERR_NOACK; 534 } 535 536 return SSL_TLSEXT_ERR_OK; 537 } 538 539 inline bool getSslContext(boost::asio::ssl::context& mSslContext, 540 const std::string& sslPemFile) 541 { 542 mSslContext.set_options(boost::asio::ssl::context::default_workarounds | 543 boost::asio::ssl::context::no_sslv2 | 544 boost::asio::ssl::context::no_sslv3 | 545 boost::asio::ssl::context::single_dh_use | 546 boost::asio::ssl::context::no_tlsv1 | 547 boost::asio::ssl::context::no_tlsv1_1); 548 549 BMCWEB_LOG_DEBUG("Using default TrustStore location: {}", trustStorePath); 550 mSslContext.add_verify_path(trustStorePath); 551 552 if (!sslPemFile.empty()) 553 { 554 boost::system::error_code ec; 555 556 boost::asio::const_buffer buf(sslPemFile.data(), sslPemFile.size()); 557 mSslContext.use_certificate(buf, boost::asio::ssl::context::pem, ec); 558 if (ec) 559 { 560 return false; 561 } 562 mSslContext.use_private_key(buf, boost::asio::ssl::context::pem, ec); 563 if (ec) 564 { 565 BMCWEB_LOG_CRITICAL("Failed to open ssl pkey"); 566 return false; 567 } 568 } 569 570 // Set up EC curves to auto (boost asio doesn't have a method for this) 571 // There is a pull request to add this. Once this is included in an asio 572 // drop, use the right way 573 // http://stackoverflow.com/questions/18929049/boost-asio-with-ecdsa-certificate-issue 574 if (SSL_CTX_set_ecdh_auto(mSslContext->native_handle(), 1) != 1) 575 {} 576 577 // Mozilla intermediate cipher suites v5.7 578 // Sourced from: https://ssl-config.mozilla.org/guidelines/5.7.json 579 const char* mozillaIntermediate = "ECDHE-ECDSA-AES128-GCM-SHA256:" 580 "ECDHE-RSA-AES128-GCM-SHA256:" 581 "ECDHE-ECDSA-AES256-GCM-SHA384:" 582 "ECDHE-RSA-AES256-GCM-SHA384:" 583 "ECDHE-ECDSA-CHACHA20-POLY1305:" 584 "ECDHE-RSA-CHACHA20-POLY1305:" 585 "DHE-RSA-AES128-GCM-SHA256:" 586 "DHE-RSA-AES256-GCM-SHA384:" 587 "DHE-RSA-CHACHA20-POLY1305"; 588 589 if (SSL_CTX_set_cipher_list(mSslContext.native_handle(), 590 mozillaIntermediate) != 1) 591 { 592 BMCWEB_LOG_ERROR("Error setting cipher list"); 593 return false; 594 } 595 return true; 596 } 597 598 inline std::shared_ptr<boost::asio::ssl::context> getSslServerContext() 599 { 600 boost::asio::ssl::context sslCtx(boost::asio::ssl::context::tls_server); 601 602 auto certFile = ensureCertificate(); 603 if (!getSslContext(sslCtx, certFile)) 604 { 605 BMCWEB_LOG_CRITICAL("Couldn't get server context"); 606 return nullptr; 607 } 608 const persistent_data::AuthConfigMethods& c = 609 persistent_data::SessionStore::getInstance().getAuthMethodsConfig(); 610 611 boost::asio::ssl::verify_mode mode = boost::asio::ssl::verify_peer; 612 if (c.tlsStrict) 613 { 614 BMCWEB_LOG_DEBUG("Setting verify peer"); 615 mode |= boost::asio::ssl::verify_fail_if_no_peer_cert; 616 } 617 618 boost::system::error_code ec; 619 sslCtx.set_verify_mode(mode, ec); 620 if (ec) 621 { 622 BMCWEB_LOG_DEBUG("Failed to set verify mode {}", ec.message()); 623 return nullptr; 624 } 625 SSL_CTX_set_options(sslCtx.native_handle(), SSL_OP_NO_RENEGOTIATION); 626 627 if constexpr (BMCWEB_EXPERIMENTAL_HTTP2) 628 { 629 SSL_CTX_set_next_protos_advertised_cb(sslCtx.native_handle(), 630 nextProtoCallback, nullptr); 631 632 SSL_CTX_set_alpn_select_cb(sslCtx.native_handle(), 633 alpnSelectProtoCallback, nullptr); 634 } 635 636 return std::make_shared<boost::asio::ssl::context>(std::move(sslCtx)); 637 } 638 639 inline std::optional<boost::asio::ssl::context> getSSLClientContext() 640 { 641 namespace fs = std::filesystem; 642 643 boost::asio::ssl::context sslCtx(boost::asio::ssl::context::tls_client); 644 645 // NOTE, this path is temporary; In the future it will need to change to 646 // be set per subscription. Do not rely on this. 647 fs::path certPath = "/etc/ssl/certs/https/client.pem"; 648 std::string cert = verifyOpensslKeyCert(certPath); 649 650 if (!getSslContext(sslCtx, cert)) 651 { 652 return std::nullopt; 653 } 654 655 // Add a directory containing certificate authority files to be used 656 // for performing verification. 657 boost::system::error_code ec; 658 sslCtx.set_default_verify_paths(ec); 659 if (ec) 660 { 661 BMCWEB_LOG_ERROR("SSL context set_default_verify failed"); 662 return std::nullopt; 663 } 664 665 // Verify the remote server's certificate 666 sslCtx.set_verify_mode(boost::asio::ssl::verify_peer, ec); 667 if (ec) 668 { 669 BMCWEB_LOG_ERROR("SSL context set_verify_mode failed"); 670 return std::nullopt; 671 } 672 673 // All cipher suites are set as per OWASP datasheet. 674 // https://cheatsheetseries.owasp.org/cheatsheets/TLS_Cipher_String_Cheat_Sheet.html 675 constexpr const char* sslCiphers = "ECDHE-ECDSA-AES128-GCM-SHA256:" 676 "ECDHE-RSA-AES128-GCM-SHA256:" 677 "ECDHE-ECDSA-AES256-GCM-SHA384:" 678 "ECDHE-RSA-AES256-GCM-SHA384:" 679 "ECDHE-ECDSA-CHACHA20-POLY1305:" 680 "ECDHE-RSA-CHACHA20-POLY1305:" 681 "DHE-RSA-AES128-GCM-SHA256:" 682 "DHE-RSA-AES256-GCM-SHA384" 683 "TLS_AES_128_GCM_SHA256:" 684 "TLS_AES_256_GCM_SHA384:" 685 "TLS_CHACHA20_POLY1305_SHA256"; 686 687 if (SSL_CTX_set_cipher_list(sslCtx.native_handle(), sslCiphers) != 1) 688 { 689 BMCWEB_LOG_ERROR("SSL_CTX_set_cipher_list failed"); 690 return std::nullopt; 691 } 692 693 return {std::move(sslCtx)}; 694 } 695 696 } // namespace ensuressl 697