@@ -35,13 +35,13 @@ data TLSSettings = TLSSettings
36runTLS :: TLSSettings -> Settings -> Application -> IO ()
36runTLS :: TLSSettings -> Settings -> Application -> IO ()
37runTLS tset set app = do
37runTLS tset set app = do
38− cert <- readCertificate $ certFile tset
38+ certs <- readCertificates $ certFile tset
39 pk <- readPrivateKey $ keyFile tset
39 pk <- readPrivateKey $ keyFile tset
40 let params = TLS.defaultParams
40 let params = TLS.defaultParams
41 { TLS.pWantClientCert = False
41 { TLS.pWantClientCert = False
42 , TLS.pAllowedVersions = [TLS.SSL3,TLS.TLS10,TLS.TLS11,TLS.TLS12]
42 , TLS.pAllowedVersions = [TLS.SSL3,TLS.TLS10,TLS.TLS11,TLS.TLS12]
43 , TLS.pCiphers = ciphers
43 , TLS.pCiphers = ciphers
44− , TLS.pCertificates = [(cert, Just pk)]
44+ , TLS.pCertificates = zip certs $ (Just pk):repeat Nothing
47 (bindPort (settingsPort set) (settingsHost set))
47 (bindPort (settingsPort set) (settingsHost set))
@@ -100,12 +100,12 @@ ciphers =
100 , TLSExtra.cipher_RC4_128_SHA1
100 , TLSExtra.cipher_RC4_128_SHA1
103−readCertificate :: FilePath -> IO X509.X509
103+readCertificates :: FilePath -> IO [X509.X509]
104−readCertificate filepath = do
104+readCertificates filepath = do
105 certs <- rights . parseCerts . PEM.pemParseBS <$> B.readFile filepath
105 certs <- rights . parseCerts . PEM.pemParseBS <$> B.readFile filepath
106 case certs of
106 case certs of
107− [] -> error "no valid certificate found"
107+ []-> error "no valid certificate found"
108− (x:_) -> return x
108+ x -> return x
109 where parseCerts (Right pems) = map (X509.decodeCertificate . L.fromChunks . (:[]) . PEM.pemContent)
109 where parseCerts (Right pems) = map (X509.decodeCertificate . L.fromChunks . (:[]) . PEM.pemContent)
110 $ filter (flip elem ["CERTIFICATE", "TRUSTED CERTIFICATE"] . PEM.pemName) pems
110 $ filter (flip elem ["CERTIFICATE", "TRUSTED CERTIFICATE"] . PEM.pemName) pems
111 parseCerts (Left err) = error $ "cannot parse PEM file: " ++ err
111 parseCerts (Left err) = error $ "cannot parse PEM file: " ++ err