From: Sergey Kandaurov <pluknet@nginx.com>
Date: Thu, 29 Oct 2020 14:53:58 +0000 (+0000)
Subject: Merged with the default branch.
X-Git-Tag: release-1.25.0~4^2~491
X-Git-Url: http://git.kaiwu.me/%7B@url%7D?a=commitdiff_plain;h=6f73d24061261884b1c2191629d4f1ced8740d82;p=nginx.git

Merged with the default branch.
---

6f73d24061261884b1c2191629d4f1ced8740d82
diff --cc src/http/modules/ngx_http_ssl_module.c
index 409514821,e062b03a1..a2db307f7
--- a/src/http/modules/ngx_http_ssl_module.c
+++ b/src/http/modules/ngx_http_ssl_module.c
@@@ -1320,19 -1340,37 +1365,45 @@@ ngx_http_ssl_init(ngx_conf_t *cf
              cscf = addr[a].default_server;
              sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index];
  
-             if (sscf->certificates == NULL) {
+             if (sscf->certificates) {
+                 continue;
+             }
+ 
+             if (!sscf->reject_handshake) {
+                 ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
+                               "no \"ssl_certificate\" is defined for "
+                               "the \"listen ... ssl\" directive in %s:%ui",
+                               cscf->file_name, cscf->line);
+                 return NGX_ERROR;
+             }
+ 
+             /*
+              * if no certificates are defined in the default server,
+              * check all non-default server blocks
+              */
+ 
+             cscfp = addr[a].servers.elts;
+             for (s = 0; s < addr[a].servers.nelts; s++) {
+ 
+                 cscf = cscfp[s];
+                 sscf = cscf->ctx->srv_conf[ngx_http_ssl_module.ctx_index];
+ 
+                 if (sscf->certificates || sscf->reject_handshake) {
+                     continue;
+                 }
+ 
                  ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
                                "no \"ssl_certificate\" is defined for "
 -                              "the \"listen ... ssl\" directive in %s:%ui",
 -                              cscf->file_name, cscf->line);
 +                              "the \"listen ... %s\" directive in %s:%ui",
 +                              name, cscf->file_name, cscf->line);
 +                return NGX_ERROR;
 +            }
 +
 +            if (addr[a].opt.quic && !(sscf->protocols & NGX_SSL_TLSv1_3)) {
 +                ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
 +                              "\"ssl_protocols\" did not enable TLSv1.3 for "
 +                              "the \"listen ... %s\" directives in %s:%ui",
 +                              name, cscf->file_name, cscf->line);
                  return NGX_ERROR;
              }
          }