mod_component: Remove unused variable

[prosody.git] / core / certmanager.lua

diff --git a/core/certmanager.lua b/core/certmanager.lua
index 0dc0bfd4bec49004bf6bd3dd84409572f5feb04b..cccf30988dadd055cc70305415351b6a4eb42993 100644 (file)
--- a/core/certmanager.lua
+++ b/core/certmanager.lua
@@ -35,17 +35,25 @@ function create_context(host, mode, user_ssl_config)
                mode = mode;
                protocol = user_ssl_config.protocol or "sslv23";
                key = resolve_path(config_path, user_ssl_config.key);
-               password = user_ssl_config.password;
+               password = user_ssl_config.password or function() log("error", "Encrypted certificate for %s requires 'ssl' 'password' to be set in config", host); end;
                certificate = resolve_path(config_path, user_ssl_config.certificate);
                capath = resolve_path(config_path, user_ssl_config.capath or default_capath);
                cafile = resolve_path(config_path, user_ssl_config.cafile);
                verify = user_ssl_config.verify or default_verify;
                options = user_ssl_config.options or default_options;
-               ciphers = user_ssl_config.ciphers;
                depth = user_ssl_config.depth;
        };
 
        local ctx, err = ssl_newcontext(ssl_config);
+
+       -- LuaSec ignores the cipher list from the config, so we have to take care
+       -- of it ourselves (W/A for #x)
+       if ctx and user_ssl_config.ciphers then
+               local success;
+               success, err = ssl.context.setcipher(ctx, user_ssl_config.ciphers);
+               if not success then ctx = nil; end
+       end
+
        if not ctx then
                err = err or "invalid ssl config"
                local file = err:match("^error loading (.-) %(");
@@ -67,9 +75,9 @@ function create_context(host, mode, user_ssl_config)
                        else
                                reason = "Reason: "..tostring(reason):lower();
                        end
-                       log("error", "SSL/TLS: Failed to load %s: %s", file, reason);
+                       log("error", "SSL/TLS: Failed to load %s: %s (host: %s)", file, reason, host);
                else
-                       log("error", "SSL/TLS: Error initialising for host %s: %s", host, err );
+                       log("error", "SSL/TLS: Error initialising for host %s: %s (host: %s)", host, err, host);
                end
        end
        return ctx, err;