Improve handling of intermediate certificates in public key for SSL_CTX configuration

[dwolrdcojp]

The current code in the for loop does not properly add the intermediate certificates from the PEM file to the SSL_CTX. When a certificate provider, such as Let's Encrypt, supplies a fullchain.pem file containing both the server certificate and the intermediate certificate(s), the existing code only includes the server certificate. This leads to an improperly configured SSL handshake.

Commenting out the for loop, as suggested in the related issue on the iodine repo (boazsegev/iodine#94), does not resolve the problem.

An alternative solution is to use SSL_CTX_use_certificate_chain_file(), which can handle the inclusion of intermediate certificates. However, this approach requires modifying the current functions to pass the PEM file name instead of the public_key contents.

To address this issue, I propose the following changes:

Set the server certificate in the SSL_CTX using the initial X509 value from the public_key.
Iterate through the remaining X509 values (if any) and add them to the SSL_CTX using SSL_CTX_add1_chain_cert(). This function is specifically designed to add additional certificates to the certificate chain.

By making these modifications, the SSL_CTX will be properly configured with both the server certificate and any intermediate certificates present in the PEM file.

With this code change we were able to confirm a properly configured SSL certificate from our server environment.

References:

SSL_CTX_use_certificate_chain_file(): https://www.openssl.org/docs/manmaster/man3/SSL_CTX_use_certificate_chain_file.html

SSL_CTX_add1_chain_cert(): https://www.openssl.org/docs/man3.0/man3/SSL_CTX_add1_chain_cert.html

Please let me know if you have any questions or requests with this change!

[boazsegev]

@dwolrdcojp , thank you so much for this PR 🙏🏻🙏🏻🙏🏻

The next version of the core library used with facil.io is currently being developed here: https://github.com/facil-io/cstl

The OpenSSL support module for the library is in this subfolder: ./fio-stl/402 openssl.h

If you have time to review the new approach, that would be great (I used the SSL_CTX_use_certificate_chain_file API for the new module).

Thanks again!
B.

[dwolrdcojp]

@boazsegev I will test this new approach on our staging build and check if it's properly configured. Based on the openssl docs it seems the SSL_CTX_use_certificate_chain_file() function uses the SSL_CTX_add1_chain_cert() in its implementation so I believe it's going to be good! I will report back with my findings.

Thank you!