# SSL engine support bug

**URL:** <https://www.ruby-forum.com/t/ssl-engine-support-bug/160177>\
**Category:** NGINX\
**Created:** [February 12, 2009, 4:15pm UTC](https://www.ruby-forum.com/t/ssl-engine-support-bug/160177 "2009-02-12T16:15:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marcin\_Gozdalik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e79b87/32.png) [@Marcin\_Gozdalik](https://www.ruby-forum.com/u/Marcin_Gozdalik)\
**Post date:** [February 12, 2009, 4:15pm UTC](https://www.ruby-forum.com/t/ssl-engine-support-bug/160177/1 "2009-02-12T16:15:57Z")

</div>

Hi

I believe I found a bug in the order of initialization of OpenSSL. The  
RSA  
keys are initialized (RSA\_new called) in  
SSL\_CTX\_use\_certificate\_chain\_file  
which is called from ngx\_ssl\_certificate which in turn is called from  
ngx\_conf\_parse at src/core/ngx\_conf\_file.c:237. The ssl\_engine is  
however  
parsed in ngx\_openssl\_init\_conf which is called later. Therefore the  
created  
RSA keys in SSL contexts use the built-in RSA\_METHOD and not the one  
provided by loaded engine.  
I don’t have enough knowledge of nginx so I can’t propose solution but  
the  
obvious thing would be to change the order of parsing of those  
directives  
(either load the engine earlier or load the SSL certificate and key  
later).

Best regards

---

<div class="post-metadata">

**Author:** ![Marcin\_Gozdalik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e79b87/32.png) [@Marcin\_Gozdalik](https://www.ruby-forum.com/u/Marcin_Gozdalik)\
**Post date:** [February 12, 2009, 5:15pm UTC](https://www.ruby-forum.com/t/ssl-engine-support-bug/160177/2 "2009-02-12T17:15:57Z")

</div>

On Thu, Feb 12, 2009 at 04:03:16PM +0100, Marcin Gozdalik wrote:

> I believe I found a bug in the order of initialization of OpenSSL. The RSA  
> keys are initialized (RSA\_new called) in SSL\_CTX\_use\_certificate\_chain\_file  
> which is called from ngx\_ssl\_certificate which in turn is called from  
> ngx\_conf\_parse at src/core/ngx\_conf\_file.c:237. The ssl\_engine is however  
> parsed in ngx\_openssl\_init\_conf which is called later. Therefore the created  
> RSA keys in SSL contexts use the built-in RSA\_METHOD and not the one  
> provided by loaded engine.  
> I don’t have enough knowledge of nginx so I can’t propose solution but the  
> obvious thing would be to change the order of parsing of those directives  
> (either load the engine earlier or load the SSL certificate and key later).

Try the attached patch.

---

<div class="post-metadata">

**Author:** ![Marcin\_Gozdalik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e79b87/32.png) [@Marcin\_Gozdalik](https://www.ruby-forum.com/u/Marcin_Gozdalik)\
**Post date:** [February 12, 2009, 7:23pm UTC](https://www.ruby-forum.com/t/ssl-engine-support-bug/160177/3 "2009-02-12T19:23:25Z")

</div>

2009/2/12 Igor S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

> On Thu, Feb 12, 2009 at 04:03:16PM +0100, Marcin Gozdalik wrote:
> 
> > I believe I found a bug in the order of initialization of OpenSSL. The  
> > RSA  
> > [snip]
> 
> Try the attached patch.

Works great - now the ENGINE is loaded before certificates. Thanks a  
lot.