@@ -35,13 +35,13 @@ data TLSSettings = TLSSettings
3535
3636runTLS :: TLSSettings -> Settings -> Application -> IO ()
3737runTLS tset set app = do
38− cert <- readCertificate $ certFile tset
38+ certs <- readCertificates $ certFile tset
3939 pk <- readPrivateKey $ keyFile tset
4040 let params = TLS.defaultParams
4141 { TLS.pWantClientCert = False
4242 , TLS.pAllowedVersions = [TLS.SSL3,TLS.TLS10,TLS.TLS11,TLS.TLS12]
4343 , TLS.pCiphers = ciphers
44− , TLS.pCertificates = [(cert, Just pk)]
44+ , TLS.pCertificates = zip certs $ (Just pk):repeat Nothing
4545 }
4646 bracket
4747 (bindPort (settingsPort set) (settingsHost set))
@@ -100,12 +100,12 @@ ciphers =
100100 , TLSExtra.cipher_RC4_128_SHA1
101101 ]
102102
103−readCertificate :: FilePath -> IO X509.X509
104−readCertificate filepath = do
103+readCertificates :: FilePath -> IO [X509.X509]
104+readCertificates filepath = do
105105 certs <- rights . parseCerts . PEM.pemParseBS <$> B.readFile filepath
106106 case certs of
107− [] -> error "no valid certificate found"
108− (x:_) -> return x
107+ []-> error "no valid certificate found"
108+ x -> return x
109109 where parseCerts (Right pems) = map (X509.decodeCertificate . L.fromChunks . (:[]) . PEM.pemContent)
110110 $ filter (flip elem ["CERTIFICATE", "TRUSTED CERTIFICATE"] . PEM.pemName) pems
111111 parseCerts (Left err) = error $ "cannot parse PEM file: " ++ err