tls: support OCSP on client and server

1 files changed, 38 insertions, 12 deletions

diff --git a/lib/_tls_common.js b/lib/_tls_common.js
index ce011bc7f3..4cd06f06f8 100644
--- a/lib/_tls_common.js
+++ b/lib/_tls_common.js
@@ -68,18 +68,8 @@ exports.createSecureContext = function createSecureContext(options, context) {
     }
   }
 
-  if (options.cert) c.context.setCert(options.cert);
-
-  if (options.ciphers)
-    c.context.setCiphers(options.ciphers);
-  else
-    c.context.setCiphers(tls.DEFAULT_CIPHERS);
-
-  if (util.isUndefined(options.ecdhCurve))
-    c.context.setECDHCurve(tls.DEFAULT_ECDH_CURVE);
-  else if (options.ecdhCurve)
-    c.context.setECDHCurve(options.ecdhCurve);
-
+  // NOTE: It's important to add CA before the cert to be able to load
+  // cert's issuer in C++ code.
   if (options.ca) {
     if (util.isArray(options.ca)) {
       for (var i = 0, len = options.ca.length; i < len; i++) {
@@ -92,6 +82,18 @@ exports.createSecureContext = function createSecureContext(options, context) {
     c.context.addRootCerts();
   }
 
+  if (options.cert) c.context.setCert(options.cert);
+
+  if (options.ciphers)
+    c.context.setCiphers(options.ciphers);
+  else
+    c.context.setCiphers(tls.DEFAULT_CIPHERS);
+
+  if (util.isUndefined(options.ecdhCurve))
+    c.context.setECDHCurve(tls.DEFAULT_ECDH_CURVE);
+  else if (options.ecdhCurve)
+    c.context.setECDHCurve(options.ecdhCurve);
+
   if (options.crl) {
     if (util.isArray(options.crl)) {
       for (var i = 0, len = options.crl.length; i < len; i++) {
@@ -126,3 +128,27 @@ exports.createSecureContext = function createSecureContext(options, context) {
 
   return c;
 };
+
+exports.translatePeerCertificate = function translatePeerCertificate(c) {
+  if (!c)
+    return null;
+
+  if (c.issuer) c.issuer = tls.parseCertString(c.issuer);
+  if (c.subject) c.subject = tls.parseCertString(c.subject);
+  if (c.infoAccess) {
+    var info = c.infoAccess;
+    c.infoAccess = {};
+
+    // XXX: More key validation?
+    info.replace(/([^\n:]*):([^\n]*)(?:\n|$)/g, function(all, key, val) {
+      if (key === '__proto__')
+        return;
+
+      if (c.infoAccess.hasOwnProperty(key))
+        c.infoAccess[key].push(val);
+      else
+        c.infoAccess[key] = [val];
+    });
+  }
+  return c;
+};