Set OPENSSL_EC_NAMED_CURVE explicitly on EC key so that certificate has ASN1 OID and NIST curve inf…

webrtc/base/opensslidentity.cc

 /*
  *  Copyright 2004 The WebRTC Project Authors. All rights reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 43 matching lines @@
       BN_free(exponent);
       RSA_free(rsa);
       LOG(LS_ERROR) << "Failed to make RSA key pair";
       return NULL;
     }
     // ownership of rsa struct was assigned, don't free it.
     BN_free(exponent);
   } else if (key_params.type() == KT_ECDSA) {
     if (key_params.ec_curve() == EC_NIST_P256) {
       EC_KEY* ec_key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+      // Ensure curve name is included when EC key is

[mattdr-at-webrtc.org, 2016/12/02 19:10:29]

The whitespace is a bit weird here -- it seems to associate the comment with the
previous call.

Let's have:

EC_KEY* ec_key = ...
<blank line>
//
//
//
EC_KEY_set_asn1_flag...
<blank line>
if (!pkey ...

that way it's obvious which call the comment refers to.

+      // is serialized. Without this call, OpenSSL versions
+      // before 1.1.0 will create certificates that don't work
+      // for TLS. This is a no-op for BoringSSL and OpenSSL 1.1.0+
+
+      EC_KEY_set_asn1_flag(ec_key, OPENSSL_EC_NAMED_CURVE);
       if (!pkey || !ec_key || !EC_KEY_generate_key(ec_key) ||
           !EVP_PKEY_assign_EC_KEY(pkey, ec_key)) {
         EVP_PKEY_free(pkey);
         EC_KEY_free(ec_key);
         LOG(LS_ERROR) << "Failed to make EC key pair";
         return NULL;
       }
       // ownership of ec_key struct was assigned, don't free it.
     } else {
       // Add generation of any other curves here.
@@ skipping 490 matching lines @@
          *this->certificate_ == *other.certificate_;
 }
 
 bool OpenSSLIdentity::operator!=(const OpenSSLIdentity& other) const {
   return !(*this == other);
 }
 
 }  // namespace rtc
 
 #endif  // HAVE_OPENSSL_SSL_H