Dynamic SSL/TLS context switching for Mtls context aggregation between peer bmc by priyair · Pull Request #1401 · ibm-openbmc/bmcweb

priyair · 2026-02-16T21:38:22Z

This pull request supersedes #1395.
This patch implements dynamic SSL/TLS context switching
in bmcweb. The implementation maintains two separate SSL
contexts:

- HTTPS context: standard TLS with optional client
  certificate
- mTLS context: mutual TLS requiring mandatory client
  certificate authentication

The server selects the appropriate context based on the
client's Server Name Indication (SNI). This enables
secure peer-to-peer Redfish aggregation while continuing
to support standard HTTPS clients on same port.

Tested By:
    '''

        - Configured peer BMC aggregation using JSON
        configuration files
        - Verified requests from client BMCs with
        TLS strict mode both enabled and disabled
        - Tested with client certificates and
        authentication tokens
        - HTTPS and mTLS connections are correctly
        established and switched based on SNI

1. Token-based authentication with tlsStrict=false:
   curl -k -H "X-Auth-Token: $bmc_token24" -X GET \
     https://<bmc>/redfish/v1/Systems

2. Certificate upload to Truststore:
   curl -k -H "X-Auth-Token: $bmc_token26" -X POST \
     https://<bmc26>/redfish/v1/bmc/Truststore/Certificates \
     -H "Content-Type: application/json" \
     -d '{"CertificateType": "PEM",
          "CertificateString": "'"$CERT_STRING"'"}'

3. Certificate replacement:
   curl -k -H "X-Auth-Token: $bmc_token26" -X POST \
     https://<bmc26>/redfish/v1/bmc/CertificateService.ReplaceCertificate \
     -H "Content-Type: application/json" -d '{
       "CertificateType": "PEM",
       "CertificateString": "'"$CERT_STRING"'",
      "CertificateUri": {
         "@odata.id": "/redfish/v1/HTTPS/Certificates/1"
       }
     }'

4. mTLS authentication with tlsStrict=false:
   curl -v --cert client.pem \
     --cacert ../serverCA/ca.crt \
     https://<bmc>/redfish/v1/Systems

5. Token-based authentication with tlsStrict=true:
   curl -k -H "X-Auth-Token: $bmc_token24" -X GET \
     https://<bmc>/redfish/v1/Systems

6. mTLS authentication with tlsStrict=true:
   curl -v --cert client.pem \
     --cacert ../serverCA/ca.crt \
     https://<bmc>/redfish/v1/Systems
        '''
    '''

priyair

This pull request supersedes #1395.

abhilashraju · 2026-02-17T04:25:54Z

+
+    // Keep context pair alive
+    static std::unique_ptr<SslContextPair> s_ctxPair;
+    s_ctxPair = std::move(ctxPair);


what is the use of static ? we are always recreating ctxPair here

what is the use of static ? we are always recreating ctxPair here

Removed static and created SslContextPair with both HTTPS and mTLS contexts for TLS handshake.

abhilashraju · 2026-02-17T04:26:22Z

 }

+// Common helper
+void setVerifyMode(const std::shared_ptr<boost::asio::ssl::context>& ctx,


why we need this function?

setVerifyMode() is called during context initialization (before connections)

abhilashraju · 2026-02-17T04:26:58Z

+
+    SSL_set_SSL_CTX(ssl, newCtx);
+
+    if (strict)


why we not using setVarifymode function declared above?

why we not using setVarifymode function declared above?

switchSslContext() is called during active SSL handshake (per-connection)

abhilashraju · 2026-02-17T04:27:25Z

+    // Determine if this should be mTLS based on SNI
+    if (SSL_client_hello_get0_ext(ssl, TLSEXT_TYPE_server_name, &sni,
+                                  &sniLen) == 1 &&
+        sniLen > 5)


can we move below line in to separate function?

can we move below line in to separate function?

Done, moved to function std::string hostname =
mtls_SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name);

baemyung · 2026-02-18T15:25:53Z

+        g_contextPairIndex =
+            SSL_CTX_get_ex_new_index(0, nullptr, nullptr, nullptr, nullptr);
+    }
+}


I think 'call-once' may be done more smoothly & clearly by doing like this.

#include <mutex> std::once_flag exDataIndex_flag; static void initializeExDataIndex() { std::call_once( exDataIndex_flag, [](){ g_contextPairIndex = SSL_CTX_get_ex_new_index(0, nullptr, nullptr, nullptr, nullptr); }); }

baemyung · 2026-02-18T15:33:53Z

+// Create mTLS server context
+static std::shared_ptr<boost::asio::ssl::context> getSslMtlsServerContext()
+{
+    using namespace boost::asio::ssl;


Would it be better to use the full namespace for the related ones for the clear references?

boost::asio::ssl::context::tls_server

Would it be better to use the full namespace for the related ones for the clear references?

boost::asio::ssl::context::tls_server

Done

This patch implements dynamic SSL/TLS context switching in bmcweb. The implementation maintains two separate SSL contexts: - HTTPS context: standard TLS with optional client certificate - mTLS context: mutual TLS requiring mandatory client certificate authentication The server selects the appropriate context based on the client's Server Name Indication (SNI). This enables secure peer-to-peer Redfish aggregation while continuing to support standard HTTPS clients on same port. Tested By: ''' - Configured peer BMC aggregation using JSON configuration files - Verified requests from client BMCs with TLS strict mode both enabled and disabled - Tested with client certificates and authentication tokens - HTTPS and mTLS connections are correctly established and switched based on SNI 1. Token-based authentication with tlsStrict=false: curl -k -H "X-Auth-Token: $bmc_token24" -X GET \ https://<bmc>/redfish/v1/Systems 2. Certificate upload to Truststore: curl -k -H "X-Auth-Token: $bmc_token26" -X POST \ https://<bmc26>/redfish/v1/bmc/Truststore/Certificates \ -H "Content-Type: application/json" \ -d '{"CertificateType": "PEM", "CertificateString": "'"$CERT_STRING"'"}' 3. Certificate replacement: curl -k -H "X-Auth-Token: $bmc_token26" -X POST \ https://<bmc26>/redfish/v1/bmc/CertificateService.ReplaceCertificate \ -H "Content-Type: application/json" -d '{ "CertificateType": "PEM", "CertificateString": "'"$CERT_STRING"'", "CertificateUri": { "@odata.id": "/redfish/v1/HTTPS/Certificates/1" } }' 4. mTLS authentication with tlsStrict=false: curl -v --cert client.pem \ --cacert ../serverCA/ca.crt \ https://<bmc>/redfish/v1/Systems 5. Token-based authentication with tlsStrict=true: curl -k -H "X-Auth-Token: $bmc_token24" -X GET \ https://<bmc>/redfish/v1/Systems 6. mTLS authentication with tlsStrict=true: curl -v --cert client.pem \ --cacert ../serverCA/ca.crt \ https://<bmc>/redfish/v1/Systems ''' Change-Id: I49c8f3d69d4b91a3a1ebe9b5f001943d5f1f47f8

baemyung

It looks good to me.
BTW, I think it is better to add upstream gerrit commit link here.

priyair · 2026-02-24T06:57:02Z

It looks good to me. BTW, I think it is better to add upstream gerrit commit link here.

https://gerrit.openbmc.org/c/openbmc/bmcweb/+/87711

gtmills

Can we keep going upstream here?

priyair force-pushed the mtls-context-aggregation branch from fa93b93 to 70d6721 Compare February 16, 2026 22:00

priyair commented Feb 16, 2026

View reviewed changes

priyair force-pushed the mtls-context-aggregation branch from 70d6721 to 0f88f4d Compare February 16, 2026 22:12

priyair mentioned this pull request Feb 16, 2026

Dynamic SSL/TLS context switching to support aggregation between peer bmc #1395

Closed

priyair force-pushed the mtls-context-aggregation branch from 0f88f4d to 5468096 Compare February 16, 2026 22:20

abhilashraju reviewed Feb 17, 2026

View reviewed changes

baemyung reviewed Feb 18, 2026

View reviewed changes

priyair force-pushed the mtls-context-aggregation branch from 5468096 to ca209e6 Compare February 23, 2026 13:06

baemyung approved these changes Feb 23, 2026

View reviewed changes

gtmills requested changes Feb 25, 2026

View reviewed changes

Conversation

priyair commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

priyair left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

baemyung left a comment

Choose a reason for hiding this comment

Uh oh!

priyair commented Feb 24, 2026

Uh oh!

gtmills left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

priyair commented Feb 16, 2026 •

edited

Loading