Subject: Changing Certificates Dynamically

From: "Edward Wong" <[email-masked]>
Date: Thu, 21 Mar 2002 14:10:33 -0800

Hey All,

This subject has probably already been broached, but is it possible to 
change certificates dynamically?  I'm having problems getting apache to 
present the new certificate during renegotiation.

For example, I start apache with a pre-existing self-signed certificate.  
Then I upload a new certificate to the server, and want to swtich to that 
certificate dynamically without restarting the server.

Is this possible?  When I do a "full renegotiation" as in 
ssl_engine_kernel.c, it doesn't actually DO anything with the new 
certificate--although it will change ciphers on subsequent connections (with 
old certificate).

Any and all help is appreciated,

Edward Wong

_________________________________________________________________
Send and receive Hotmail on your mobile device: http://mobile.msn.com

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Mads Toftum <[email-masked]>
Date: Thu, 21 Mar 2002 23:28:37 +0100

On Thu, Mar 21, 2002 at 02:10:33PM -0800, Edward Wong wrote:
> Is this possible? 

No. You need a restart (I'm not even sure that a graceful restart is
enough - I think you need the full stop/start)

vh

Mads Toftum
-- 
With a rubber duck, one's never alone.
              -- "The Hitchhiker's Guide to the Galaxy"
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]