[php-src] PR #25398: ext/openssl: Fix SNI certs not used on streams sharing a session SSL_CTX
| From: | bukka | Date: | Wed, 11 Nov 2026 17:55:51 +0000 |
| Subject: | [php-src] PR #25398: ext/openssl: Fix SNI certs not used on streams sharing a session SSL_CTX | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40553@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25398
Author: bukka
Since b1242c32bca a server stream seeded from a session stream shares the parent's
SSL_CTX and ignores its own context options. The SNI callback registered on that
context looks up sni_certs of the stream doing the handshake, but the table stayed only
on the parent, so the child always served the default certificate instead of the one matching the
requested name.
This gives the child its own table that references the parent's per-name contexts
(SSL_CTX_up_ref), so it also stays valid when the parent is closed first. It follows
the same approach as the ALPN list copy in GH-25211.
Only 8.6 is affected. In 8.5 a server stream with a session stream still created its own context
from its own options.