[ngx-voms] allow proxy certs programmatically

The support for proxy certificates currently relies on setting (to 1) the OPENSSL environment variable OPENSSL_ALLOW_PROXY_CERTS; see for examples one of the tests. This feature is not available any more in OpenSSL 1.1, which requires the use of explicit program instructions to set that flag during verification.

Technically the solution is pretty simple:

X509_STORE* store = SSL_CTX_get_cert_store(ctx);
X509_STORE_set_flags(store, X509_V_FLAG_ALLOW_PROXY_CERTS);

The difficulty comes from the fact that we don't want to touch the nginx code, unless strictly needed. After some investigation, it happens that this is indeed possible, because nginx creates the SSL_CTX only once (at the beginning of a so-called cycle) and that SSL_CTX is accessible through the server configuration of the openssl module.

changed title from allow proxy certs programmatically to [ngx-voms] allow proxy certs programmatically

mentioned in commit 17f8e6ed

mentioned in merge request !12 (merged)

closed via commit 17f8e6ed

closed via merge request !12 (merged)

mentioned in commit ef792a9b

Discussion about a possible patch to nginx.

Discussion about reverting the "getenv hack" in OpenSSL.