From 6dc5eeb8f9158ac399d306eebb56164badf8dbc8 Mon Sep 17 00:00:00 2001 From: Linus Nordberg Date: Fri, 14 Sep 2012 12:49:53 +0200 Subject: Document effects of RADSECPROXY-43. https://project.nordu.net/browse/RADSECPROXY-43 --- radsecproxy.conf.5.xml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/radsecproxy.conf.5.xml b/radsecproxy.conf.5.xml index 44ea1c7..bd52682 100644 --- a/radsecproxy.conf.5.xml +++ b/radsecproxy.conf.5.xml @@ -544,6 +544,15 @@ blocktype name { default. If the specified TLS block name does not exist, or the option is not specified and none of the defaults exist, the proxy will exit with an error. + + NOTE: All versions of radsecproxy up to and including 1.6 + erroneously verify client certificate chains using the CA in the + first matching client block regardless of which + block is used for the final decision. This changed in 1.6.1 so + that a client block with a different tls + option than the first matching client block is no longer + considered for verification of clients. + For a TLS/DTLS client, the option -- cgit v1.1