From 62ec584a3014b9b9333dcc6feb4989d1592d6d26 Mon Sep 17 00:00:00 2001 From: Roger Dingledine Date: Tue, 13 Sep 2011 18:24:45 -0400 Subject: Generate our ssl session certs with a plausible lifetime Nobody but Tor uses certs on the wire with 2 hour lifetimes, and it makes us stand out. Resolves ticket 4014. --- src/or/main.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'src/or/main.c') diff --git a/src/or/main.c b/src/or/main.c index e44fd49462..3c879dcd0e 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -866,12 +866,14 @@ run_scheduled_events(time_t now) now + DESCRIPTOR_FAILURE_RESET_INTERVAL; } - /** 1b. Every MAX_SSL_KEY_LIFETIME seconds, we change our TLS context. */ + /** 1b. Every MAX_SSL_KEY_LIFETIME_INTERNAL seconds, we change our + * TLS context. */ if (!last_rotated_x509_certificate) last_rotated_x509_certificate = now; - if (last_rotated_x509_certificate+MAX_SSL_KEY_LIFETIME < now) { + if (last_rotated_x509_certificate+MAX_SSL_KEY_LIFETIME_INTERNAL < now) { log_info(LD_GENERAL,"Rotating tls context."); - if (tor_tls_context_new(get_identity_key(), MAX_SSL_KEY_LIFETIME) < 0) { + if (tor_tls_context_new(get_identity_key(), + MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_warn(LD_BUG, "Error reinitializing TLS context"); /* XXX is it a bug here, that we just keep going? -RD */ } -- cgit v1.2.3-54-g00ecf