Avoid unnecessary code (the deprecation macro wrapper itself emits unused args
warnings) in OpenSSL 1.1.0 and avoid _free()ing NULL references.
@@ -1320,18 +1320,23 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
OBJ_nid2sn(nid), vhost_id, certfile);
}
/*
- * ...otherwise, enable auto curve selection (OpenSSL 1.0.2 and later)
+ * ...otherwise, enable auto curve selection (OpenSSL 1.0.2)
* or configure NIST P-256 (required to enable ECDHE for earlier versions)
+ * ECDH is always enabled in 1.0.2 unless excluded from SSLCipherList
*/
+#if (OPENSSL_VERSION_NUMBER < 0x10100000L)
else {
-#if defined(SSL_CTX_set_ecdh_auto)
+#elif defined(SSL_CTX_set_ecdh_auto)
SSL_CTX_set_ecdh_auto(mctx->ssl_ctx, 1);
#else
eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey);
#endif
}
+#endif
+ if (eckey)
EC_KEY_free(eckey);
+ if (ecparams)
EC_GROUP_free(ecparams);
#endif
