zeroc-ice 3.6b1 → 3.6.0

data/ext/ice/cpp/src/IceSSL/SSLEngineF.h

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2015 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.

data/ext/ice/cpp/src/IceSSL/SecureTransportEngine.cpp

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2015 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
@@ -58,13 +58,13 @@ Init init;
 class RegExp : public IceUtil::Shared
 {
 public:
-    
+
     RegExp(const string&);
     ~RegExp();
     bool match(const string&);
-    
+
 private:
-    
+
     regex_t _preg;
 };
 typedef IceUtil::Handle<RegExp> RegExpPtr;
@@ -99,14 +99,14 @@ struct CipherExpression
 class CiphersHelper
 {
 public:
-    
+
     static void initialize();
     static SSLCipherSuite cipherForName(const string& name);
     static string cipherName(SSLCipherSuite cipher);
     static map<string, SSLCipherSuite> ciphers();
 
 private:
-    
+
     static map<string, SSLCipherSuite> _ciphers;
 };
 
@@ -237,7 +237,7 @@ CiphersHelper::initialize()
         //_ciphers["DH_anon_WITH_3DES_EDE_CBC_SHA"] = TLS_DH_anon_WITH_3DES_EDE_CBC_SHA;
         _ciphers["DH_anon_WITH_AES_128_CBC_SHA256"] = TLS_DH_anon_WITH_AES_128_CBC_SHA256;
         _ciphers["DH_anon_WITH_AES_256_CBC_SHA256"] = TLS_DH_anon_WITH_AES_256_CBC_SHA256;
-            
+
         //
         // Addendum from RFC 4279, TLS PSK
         //
@@ -286,17 +286,17 @@ CiphersHelper::initialize()
         _ciphers["DHE_PSK_WITH_AES_256_GCM_SHA384"] = TLS_DHE_PSK_WITH_AES_256_GCM_SHA384;
         _ciphers["RSA_PSK_WITH_AES_128_GCM_SHA256"] = TLS_RSA_PSK_WITH_AES_128_GCM_SHA256;
         _ciphers["RSA_PSK_WITH_AES_256_GCM_SHA384"] = TLS_RSA_PSK_WITH_AES_256_GCM_SHA384;
-            
+
         _ciphers["PSK_WITH_AES_128_CBC_SHA256"] = TLS_PSK_WITH_AES_128_CBC_SHA256;
         _ciphers["PSK_WITH_AES_256_CBC_SHA384"] = TLS_PSK_WITH_AES_256_CBC_SHA384;
         _ciphers["PSK_WITH_NULL_SHA256"] = TLS_PSK_WITH_NULL_SHA256;
         _ciphers["PSK_WITH_NULL_SHA384"] = TLS_PSK_WITH_NULL_SHA384;
-            
+
         _ciphers["DHE_PSK_WITH_AES_128_CBC_SHA256"] = TLS_DHE_PSK_WITH_AES_128_CBC_SHA256;
         _ciphers["DHE_PSK_WITH_AES_256_CBC_SHA384"] = TLS_DHE_PSK_WITH_AES_256_CBC_SHA384;
         _ciphers["DHE_PSK_WITH_NULL_SHA256"] = TLS_DHE_PSK_WITH_NULL_SHA256;
         _ciphers["DHE_PSK_WITH_NULL_SHA384"] = TLS_DHE_PSK_WITH_NULL_SHA384;
-            
+
         _ciphers["RSA_PSK_WITH_AES_128_CBC_SHA256"] = TLS_RSA_PSK_WITH_AES_128_CBC_SHA256;
         _ciphers["RSA_PSK_WITH_AES_256_CBC_SHA384"] = TLS_RSA_PSK_WITH_AES_256_CBC_SHA384;
         _ciphers["RSA_PSK_WITH_NULL_SHA256"] = TLS_RSA_PSK_WITH_NULL_SHA256;
@@ -358,23 +358,23 @@ CiphersHelper::cipherForName(const string& name)
 // protocol ciphers, for example SSL_RSA_WITH_RC4_128_MD5/TLS_RSA_WITH_RC4_128_MD5
 // are represeted by the same SSLCipherSuite value, the names return by this method
 // doesn't include a protocol prefix.
-// 
+//
 string
 CiphersHelper::cipherName(SSLCipherSuite cipher)
 {
     switch(cipher)
     {
-        case SSL_NULL_WITH_NULL_NULL: 
+        case SSL_NULL_WITH_NULL_NULL:
             return "NULL_WITH_NULL_NULL";
         case SSL_RSA_WITH_NULL_MD5:
             return "RSA_WITH_NULL_MD5";
         case SSL_RSA_WITH_NULL_SHA:
             return "RSA_WITH_NULL_SHA";
-        case SSL_RSA_EXPORT_WITH_RC4_40_MD5: 
+        case SSL_RSA_EXPORT_WITH_RC4_40_MD5:
             return "RSA_EXPORT_WITH_RC4_40_MD5";
-        case SSL_RSA_WITH_RC4_128_MD5: 
+        case SSL_RSA_WITH_RC4_128_MD5:
             return "RSA_WITH_RC4_128_MD5";
-        case SSL_RSA_WITH_RC4_128_SHA: 
+        case SSL_RSA_WITH_RC4_128_SHA:
             return "RSA_WITH_RC4_128_SHA";
         case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5:
             return "RSA_EXPORT_WITH_RC2_CBC_40_MD5";
@@ -382,7 +382,7 @@ CiphersHelper::cipherName(SSLCipherSuite cipher)
             return "RSA_WITH_IDEA_CBC_SHA";
         case SSL_RSA_EXPORT_WITH_DES40_CBC_SHA:
             return "RSA_EXPORT_WITH_DES40_CBC_SHA";
-        case SSL_RSA_WITH_DES_CBC_SHA: 
+        case SSL_RSA_WITH_DES_CBC_SHA:
             return "RSA_WITH_DES_CBC_SHA";
         case SSL_RSA_WITH_3DES_EDE_CBC_SHA:
             return "RSA_WITH_3DES_EDE_CBC_SHA";
@@ -796,6 +796,7 @@ IceSSL::SecureTransportEngine::initialized() const
     IceUtil::Mutex::Lock lock(_mutex);
     return _initialized;
 }
+
 //
 // Setup the engine.
 //
@@ -807,385 +808,279 @@ IceSSL::SecureTransportEngine::initialize()
     {
         return;
     }
-    
+
     SSLEngine::initialize();
-    
-    const string propPrefix = "IceSSL.";
+
     const PropertiesPtr properties = communicator()->getProperties();
-    
+
     //
     // Check for a default directory. We look in this directory for
     // files mentioned in the configuration.
     //
-    string defaultDir = properties->getProperty(propPrefix + "DefaultDir");
-    
+    const string defaultDir = properties->getProperty("IceSSL.DefaultDir");
+
     //
     // Open the application KeyChain or create it if the keychain doesn't exists
     //
     string keychainPath = properties->getProperty("IceSSL.Keychain");
     string keychainPassword = properties->getProperty("IceSSL.KeychainPassword");
-    
-    bool usePassword = !keychainPassword.empty();
-    size_t size = keychainPassword.size();
-    const char* password = usePassword ? keychainPassword.c_str() : 0;
-    
-    CFDataRef hash = 0;
+
     SecKeychainRef keychain = 0;
-    SecCertificateRef cert = 0;
-    SecKeyRef key = 0;
-    SecIdentityRef identity = 0;
-    
-    try
+    OSStatus err = 0;
+    if(keychainPath.empty())
     {
-        OSStatus err = 0;
-        if(keychainPath.empty())
+        if((err = SecKeychainCopyDefault(&keychain)))
         {
-            if((err = SecKeychainCopyDefault(&keychain)))
-            {
-                throw PluginInitializationException(__FILE__, __LINE__, 
-                                            "IceSSL: unable to retrieve default keychain:\n" + errorToString(err));
-            }
+            throw PluginInitializationException(__FILE__, __LINE__,
+                                                "IceSSL: unable to retrieve default keychain:\n" + errorToString(err));
         }
-        else
+    }
+    else
+    {
+        //
+        // KeyChain path is relative to the current working directory.
+        //
+        if(!IceUtilInternal::isAbsolutePath(keychainPath))
         {
-            //
-            // KeyChain path is relative to the current working directory.
-            //
-            if(!IceUtilInternal::isAbsolutePath(keychainPath))
-            {
-                string cwd;
-                if(IceUtilInternal::getcwd(cwd) == 0)
-                {
-                    keychainPath = string(cwd) + '/' + keychainPath;
-                }
-            }
-        
-            if((err = SecKeychainOpen(keychainPath.c_str(),  &keychain)))
+            string cwd;
+            if(IceUtilInternal::getcwd(cwd) == 0)
             {
-                throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: unable to open keychain: `" + 
-                                                    keychainPath + "'\n" + errorToString(err));
+                keychainPath = string(cwd) + '/' + keychainPath;
             }
         }
-        
-        SecKeychainStatus status;
-        err = SecKeychainGetStatus(keychain, &status);
 
-        if(err == noErr)
+        if((err = SecKeychainOpen(keychainPath.c_str(), &keychain)))
         {
-            if((err = SecKeychainUnlock(keychain, size, password, usePassword)))
-            {
-                throw PluginInitializationException(__FILE__, __LINE__, 
-                                                    "IceSSL: unable to unlock keychain:\n" + errorToString(err));
-            }
+            throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: unable to open keychain: `" +
+                                                keychainPath + "'\n" + errorToString(err));
         }
-        else if(err == errSecNoSuchKeychain)
+    }
+
+    UniqueRef<SecKeychainRef> k(keychain);
+
+    SecKeychainStatus status;
+    err = SecKeychainGetStatus(keychain, &status);
+    if(err == noErr)
+    {
+        const char* pass = keychainPassword.empty() ? 0 : keychainPassword.c_str();
+        if((err = SecKeychainUnlock(keychain, keychainPassword.size(), pass, pass != 0)))
         {
-            if((err = SecKeychainCreate(keychainPath.c_str(), size, password, keychainPassword.empty(), 0, &keychain)))
-            {
-                throw PluginInitializationException(__FILE__, __LINE__, 
-                                                    "IceSSL: unable to create keychain:\n" + errorToString(err));
-            }
+            throw PluginInitializationException(__FILE__, __LINE__,
+                                                "IceSSL: unable to unlock keychain:\n" + errorToString(err));
         }
-        else
+    }
+    else if(err == errSecNoSuchKeychain)
+    {
+        const char* pass = keychainPassword.empty() ? 0 : keychainPassword.c_str();
+        if((err = SecKeychainCreate(keychainPath.c_str(), keychainPassword.size(), pass, pass == 0, 0, &keychain)))
         {
-            throw PluginInitializationException(__FILE__, __LINE__, 
-                                                "IceSSL: unable to open keychain:\n" + errorToString(err));
+            throw PluginInitializationException(__FILE__, __LINE__,
+                                                "IceSSL: unable to create keychain:\n" + errorToString(err));
         }
-        
-        //
-        // Set keychain settings to avoid keychain lock.
-        //
-        SecKeychainSettings settings;
-        settings.version = SEC_KEYCHAIN_SETTINGS_VERS1;
-        settings.lockOnSleep = FALSE;
-        settings.useLockInterval = FALSE;
-        settings.lockInterval = INT_MAX;
-        
-        if((err = SecKeychainSetSettings(keychain, &settings)))
+        k.reset(keychain);
+    }
+    else
+    {
+        throw PluginInitializationException(__FILE__, __LINE__,
+                                            "IceSSL: unable to open keychain:\n" + errorToString(err));
+    }
+
+    //
+    // Set keychain settings to avoid keychain lock.
+    //
+    SecKeychainSettings settings;
+    settings.version = SEC_KEYCHAIN_SETTINGS_VERS1;
+    settings.lockOnSleep = FALSE;
+    settings.useLockInterval = FALSE;
+    settings.lockInterval = INT_MAX;
+    if((err = SecKeychainSetSettings(keychain, &settings)))
+    {
+        throw PluginInitializationException(__FILE__, __LINE__,
+                                            "IceSSL: error setting keychain settings:\n" + errorToString(err));
+    }
+
+    //
+    // Load the CA certificates used to authenticate peers into
+    // _certificateAuthorities array.
+    //
+    try
+    {
+        string caFile = properties->getProperty("IceSSL.CAs");
+        if(caFile.empty())
         {
-            throw PluginInitializationException(__FILE__, __LINE__, 
-                                                "IceSSL: error setting keychain settings:\n" + errorToString(err));
+            caFile = properties->getProperty("IceSSL.CertAuthFile");
         }
-        
-        int passwordRetryMax = properties->getPropertyAsIntWithDefault(propPrefix + "PasswordRetryMax", 3);
-        PasswordPromptPtr passwordPrompt = getPasswordPrompt();
-        
-        //
-        // Load the CA certificates used to authenticate peers into 
-        // _certificateAuthorities array.
-        //
+        if(!caFile.empty())
         {
-            try
+            string resolved;
+            if(!checkPath(caFile, defaultDir, false, resolved))
             {
-                string caFile = properties->getProperty(propPrefix + "CertAuthFile");
-                if(!caFile.empty())
-                {
-                    if(!checkPath(caFile, defaultDir, false))
-                    {
-                        throw PluginInitializationException(__FILE__, __LINE__, 
-                                                            "IceSSL: CA certificate file not found:\n" + caFile);
-                    }
-                    _certificateAuthorities = loadCACertificates(caFile);
-                }
+                throw PluginInitializationException(__FILE__, __LINE__,
+                                                    "IceSSL: CA certificate file not found:\n" + caFile);
             }
-            catch(const CertificateReadException& ce)
+            _certificateAuthorities.reset(loadCACertificates(resolved));
+        }
+        else if(properties->getPropertyAsInt("IceSSL.UsePlatformCAs") <= 0)
+        {
+            // Setup an empty list of Root CAs to not use the system root CAs.
+            _certificateAuthorities.reset(CFArrayCreate(0, 0, 0, 0));
+        }
+    }
+    catch(const CertificateReadException& ce)
+    {
+        throw PluginInitializationException(__FILE__, __LINE__, ce.reason);
+    }
+
+    const string password = properties->getProperty("IceSSL.Password");
+    const int passwordRetryMax = properties->getPropertyAsIntWithDefault("IceSSL.PasswordRetryMax", 3);
+    PasswordPromptPtr passwordPrompt = getPasswordPrompt();
+
+    string certFile = properties->getProperty("IceSSL.CertFile");
+    string keyFile = properties->getProperty("IceSSL.KeyFile");
+    string findCert = properties->getProperty("IceSSL.FindCert");
+    if(!certFile.empty())
+    {
+        vector<string> files;
+        if(!IceUtilInternal::splitString(certFile, IceUtilInternal::pathsep, files) || files.size() > 2)
+        {
+            throw PluginInitializationException(__FILE__, __LINE__,
+                                                "IceSSL: invalid value for IceSSL.CertFile:\n" + certFile);
+        }
+        vector<string> keyFiles;
+        if(!keyFile.empty())
+        {
+            if(!IceUtilInternal::splitString(keyFile, IceUtilInternal::pathsep, keyFiles) || keyFiles.size() > 2)
             {
-                throw PluginInitializationException(__FILE__, __LINE__, ce.reason);
+                throw PluginInitializationException(__FILE__, __LINE__,
+                                                    "IceSSL: invalid value for IceSSL.KeyFile:\n" + keyFile);
             }
-            catch(const CertificateEncodingException& ce)
+            if(files.size() != keyFiles.size())
             {
-                throw PluginInitializationException(__FILE__, __LINE__, ce.reason);
+                throw PluginInitializationException(__FILE__, __LINE__,
+                                                    "IceSSL: IceSSL.KeyFile does not agree with IceSSL.CertFile");
             }
         }
-        
-        //
-        // Import the application certificate and private keys into the application
-        // keychain.
-        //
+
+        for(int i = 0; i < files.size(); ++i)
         {
-            string certFile = properties->getProperty(propPrefix + "CertFile");
-            string keyFile = properties->getPropertyWithDefault(propPrefix + "KeyFile", certFile);
-            vector<string>::size_type numCerts = 0;
+            string file = files[i];
+            string keyFile = keyFiles.empty() ? "" : keyFiles[i];
+            string resolved;
 
-            if(!certFile.empty())
+            if(!checkPath(file, defaultDir, false, resolved))
             {
-                vector<string> files;
-                if(!IceUtilInternal::splitString(certFile, IceUtilInternal::pathsep, files) || files.size() > 2)
-                {
-                    throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: invalid value for " + propPrefix +
-                                                        "CertFile:\n" + certFile);
-                }
-                numCerts = files.size();
-                for(vector<string>::iterator p = files.begin(); p != files.end();)
-                {
-                    string file = *p;
-                    if(!checkPath(file, defaultDir, false))
-                    {
-                        throw PluginInitializationException(__FILE__, __LINE__, 
-                                                            "IceSSL: certificate file not found:\n" + file);
-                    }
-                    
-                    try
-                    {
-                        loadCertificate(&cert, &hash, &key, keychain, file,
-                                        properties->getProperty(propPrefix + "Password"), passwordPrompt, 
-                                        passwordRetryMax);
-                        break;
-                    }
-                    catch(const CertificateReadException& ce)
-                    {
-                        //
-                        // If this is the last certificate rethrow the exception as PluginInitializationException,
-                        // otherwise try the next certificate.
-                        //
-                        if(++p == files.end())
-                        {
-                            throw PluginInitializationException(__FILE__, __LINE__, ce.reason);
-                        }
-                    }
-                }
-            }
-            
-            if(!key && !keyFile.empty())
-            {
-                vector<string> files;
-                if(!IceUtilInternal::splitString(keyFile, IceUtilInternal::pathsep, files) || files.size() > 2)
-                {
-                    throw PluginInitializationException(__FILE__, __LINE__,
-                                                "IceSSL: invalid value for " + propPrefix + "KeyFile:\n" + keyFile);
-                }
-                if(files.size() != numCerts)
-                {
-                    throw PluginInitializationException(__FILE__, __LINE__,
-                                                        "IceSSL: IceSSL.KeyFile does not agree with IceSSL.CertFile");
-                }
-                for(vector<string>::iterator p = files.begin(); p != files.end();)
-                {
-                    string file = *p;
-                    if(!checkPath(file, defaultDir, false))
-                    {
-                        throw PluginInitializationException(__FILE__, __LINE__, 
-                                                            "IceSSL: key file not found:\n" + file);
-                    }
-
-                    try
-                    {
-                        loadPrivateKey(&key, keyLabel(cert), hash, keychain, file, 
-                                       properties->getProperty(propPrefix + "Password"), 
-                                       passwordPrompt, passwordRetryMax);
-                        break;
-                    }
-                    catch(const CertificateReadException& ce)
-                    {
-                        //
-                        // If this is the last key rethrow the exception as PluginInitializationException,
-                        // otherwise try the next certificate.
-                        //
-                        if(++p == files.end())
-                        {
-                            PluginInitializationException ex(__FILE__, __LINE__, ce.reason);
-                            throw ex;
-                        }
-                    }
-                }
+                throw PluginInitializationException(__FILE__, __LINE__,
+                                                    "IceSSL: certificate file not found:\n" + file);
             }
+            file = resolved;
 
-            if(!cert)
+            if(!keyFile.empty())
             {
-                const string prop = propPrefix + "FindCert";
-                string val = properties->getProperty(prop);
-                if(!val.empty())
+                if(!checkPath(keyFile, defaultDir, false, resolved))
                 {
-                    if(!(cert = findCertificates(keychain, prop, val)))
-                    {
-                        throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: no certificates found");
-                    }
+                    throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: key file not found:\n" + keyFile);
                 }
+                keyFile = resolved;
             }
-            
-            if(cert)
+
+            try
             {
-                if((err = SecIdentityCreateWithCertificate(keychain, cert, &identity)) != noErr)
-                {
-                    throw PluginInitializationException(__FILE__, __LINE__,
-                                                "IceSSL: error creating certificate identity:\n" + errorToString(err));
-                }
+                _chain.reset(loadCertificateChain(file, keyFile, keychain, password, passwordPrompt, passwordRetryMax));
+                break;
             }
-            
-            if(identity)
+            catch(const CertificateReadException& ce)
             {
-                SecTrustRef trust = 0;
-                try
+                //
+                // If this is the last certificate rethrow the exception as PluginInitializationException,
+                // otherwise try the next certificate.
+                //
+                if(i == files.size() - 1)
                 {
-                    //
-                    // Retrieve the certificate chain
-                    //
-                    SecPolicyRef policy = SecPolicyCreateSSL(true, 0);
-                    err = SecTrustCreateWithCertificates((CFArrayRef)cert, policy, &trust);
-                    CFRelease(policy);
-                    if(err || !trust)
-                    {
-                        throw PluginInitializationException(__FILE__, __LINE__, 
-                                    "IceSSL: error creating trust object" + (err ? ":\n" + errorToString(err) : ""));
-                    }
-                    
-                    if((err = SecTrustSetAnchorCertificates(trust, _certificateAuthorities)))
-                    {
-                        throw PluginInitializationException(__FILE__, __LINE__, 
-                                    "IceSSL: error while establish the anchor certificates:\n" + errorToString(err));
-                    }
-                    
-                    SecTrustResultType trustResult;
-                    if((err = SecTrustEvaluate(trust, &trustResult)))
-                    {
-                        throw PluginInitializationException(__FILE__, __LINE__, 
-                                                            "IceSSL: error evaluating trust:\n" + errorToString(err));
-                    }
-                    
-                    int chainLength = SecTrustGetCertificateCount(trust);
-                    _chain = CFArrayCreateMutable(kCFAllocatorDefault, chainLength, &kCFTypeArrayCallBacks);
-                    CFArrayAppendValue(_chain, identity);
-                    for(int i = 1; i < chainLength; ++i)
-                    {
-                        CFArrayAppendValue(_chain, SecTrustGetCertificateAtIndex(trust, i));
-                    }
-                    CFRelease(trust);
+                    throw PluginInitializationException(__FILE__, __LINE__, ce.reason);
                 }
-                catch(...)
-                {
-                    if(trust)
-                    {
-                        CFRelease(trust);
-                    }
-                    throw;
-                }
-            }
-            
-            if(hash)
-            {
-                CFRelease(hash);
-            }
-            
-            if(keychain)
-            {
-                CFRelease(keychain);
-            }
-            
-            if(cert)
-            {
-                CFRelease(cert);
-            }
-            
-            if(key)
-            {
-                CFRelease(key);
-            }
-            
-            if(identity)
-            {
-                CFRelease(identity);
             }
         }
     }
-    catch(...)
-    {    
-        if(hash)
-        {
-            CFRelease(hash);
-        }
-        
-        if(keychain)
+    else if(!findCert.empty())
+    {
+        UniqueRef<SecCertificateRef> cert(findCertificate(keychain, findCert));
+
+        //
+        // Retrieve the certificate chain
+        //
+        UniqueRef<SecPolicyRef> policy(SecPolicyCreateSSL(true, 0));
+        SecTrustRef trust = 0;
+        err = SecTrustCreateWithCertificates((CFArrayRef)cert.get(), policy.get(), &trust);
+        if(err || !trust)
         {
-            CFRelease(keychain);
+            throw PluginInitializationException(__FILE__, __LINE__,
+                                                "IceSSL: error creating trust object" +
+                                                (err ? ":\n" + errorToString(err) : ""));
         }
-        
-        if(cert)
+        UniqueRef<SecTrustRef> v(trust);
+
+        SecTrustResultType trustResult;
+        if((err = SecTrustEvaluate(trust, &trustResult)))
         {
-            CFRelease(cert);
+            throw PluginInitializationException(__FILE__, __LINE__,
+                                                "IceSSL: error evaluating trust:\n" + errorToString(err));
         }
-        
-        if(key)
+
+        int chainLength = SecTrustGetCertificateCount(trust);
+        CFMutableArrayRef items = CFArrayCreateMutable(kCFAllocatorDefault, chainLength, &kCFTypeArrayCallBacks);
+        for(int i = 0; i < chainLength; ++i)
         {
-            CFRelease(key);
+            CFArrayAppendValue(items, SecTrustGetCertificateAtIndex(trust, i));
         }
-        
-        if(identity)
+
+        //
+        // Replace the first certificate in the chain with the
+        // identity.
+        //
+        SecIdentityRef identity;
+        err = SecIdentityCreateWithCertificate(keychain, cert.get(), &identity);
+        if(err != noErr)
         {
-            CFRelease(identity);
+            ostringstream os;
+            os << "IceSSL: couldn't create identity for certificate found in the keychain:\n" << errorToString(err);
+            throw PluginInitializationException(__FILE__, __LINE__, os.str());
         }
-        
-        throw;
+        CFArraySetValueAtIndex(items, 0, identity);
+        CFRelease(identity);
+        _chain.reset(items);
     }
+
     //
     // DiffieHellmanParams in DER format.
     //
-    string dhFile = properties->getProperty(propPrefix + "DHParams");
+    string dhFile = properties->getProperty("IceSSL.DHParams");
     if(!dhFile.empty())
     {
-        if(!checkPath(dhFile, defaultDir, false))
+        string resolved;
+        if(!checkPath(dhFile, defaultDir, false, resolved))
         {
             throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: DH params file not found:\n" + dhFile);
         }
-        
-        readFile(dhFile, _dhParams);
+
+        readFile(resolved, _dhParams);
     }
-    
+
     //
     // Establish the cipher list.
     //
-    string ciphers = properties->getProperty(propPrefix + "Ciphers");
+    const string ciphers = properties->getProperty("IceSSL.Ciphers");
     CiphersHelper::initialize();
-    
+
     if(!ciphers.empty())
     {
         parseCiphers(ciphers);
     }
-    
+
     if(securityTraceLevel() >= 1)
     {
         ostringstream os;
         os << "enabling SSL ciphersuites:";
-        
+
         if(_ciphers.empty())
         {
             map<string, SSLCipherSuite> enabled = CiphersHelper::ciphers();
@@ -1203,20 +1098,20 @@ IceSSL::SecureTransportEngine::initialize()
         }
         getLogger()->trace(securityTraceCategory(), os.str());
     }
-    
+
     //
     // Parse protocols
     //
-    const string protocolVersionMax = properties->getProperty(propPrefix + "ProtocolVersionMax");
+    const string protocolVersionMax = properties->getProperty("IceSSL.ProtocolVersionMax");
     if(!protocolVersionMax.empty())
     {
         _protocolVersionMax = parseProtocol(protocolVersionMax);
     }
-    
+
     //
     // The default min protocol version is set to TLS1.0 to avoid security issues with SSLv3
-    // 
-    const string protocolVersionMin = properties->getPropertyWithDefault(propPrefix + "ProtocolVersionMin", "tls1_0");
+    //
+    const string protocolVersionMin = properties->getPropertyWithDefault("IceSSL.ProtocolVersionMin", "tls1_0");
     if(!protocolVersionMin.empty())
     {
         _protocolVersionMin = parseProtocol(protocolVersionMin);
@@ -1230,29 +1125,18 @@ IceSSL::SecureTransportEngine::initialize()
 void
 IceSSL::SecureTransportEngine::destroy()
 {
-    if(_certificateAuthorities)
-    {
-        CFRelease(_certificateAuthorities);
-        _certificateAuthorities = 0;
-    }
-    
-    if(_chain)
-    {
-        CFRelease(_chain);
-        _chain = 0;
-    }
 }
 
 SSLContextRef
 IceSSL::SecureTransportEngine::newContext(bool incoming)
 {
-    SSLContextRef ssl = SSLCreateContext(kCFAllocatorDefault, incoming ? kSSLServerSide : kSSLClientSide, 
+    SSLContextRef ssl = SSLCreateContext(kCFAllocatorDefault, incoming ? kSSLServerSide : kSSLClientSide,
                                          kSSLStreamType);
     if(!ssl)
     {
         throw SecurityException(__FILE__, __LINE__, "IceSSL: unable to create SSL context");
     }
-    
+
     OSStatus err = noErr;
     if(incoming)
     {
@@ -1279,23 +1163,22 @@ IceSSL::SecureTransportEngine::newContext(bool incoming)
                 break;
             }
         }
-        
+
         if(!_dhParams.empty())
         {
             if((err = SSLSetDiffieHellmanParams(ssl, &_dhParams[0], _dhParams.size())))
             {
-                throw SecurityException(__FILE__, __LINE__, 
+                throw SecurityException(__FILE__, __LINE__,
                                         "IceSSL: unable to create the trust object:\n" + errorToString(err));
             }
         }
     }
-    
-    if(_chain && (err = SSLSetCertificate(ssl, _chain)))
-    {        
-        throw SecurityException(__FILE__, __LINE__, 
+
+    if(_chain && (err = SSLSetCertificate(ssl, _chain.get())))
+    {
+        throw SecurityException(__FILE__, __LINE__,
                                 "IceSSL: error while setting the SSL context certificate:\n" + errorToString(err));
     }
-    
 
     if(!_ciphers.empty())
     {
@@ -1304,39 +1187,39 @@ IceSSL::SecureTransportEngine::newContext(bool incoming)
             throw SecurityException(__FILE__, __LINE__, "IceSSL: error while setting ciphers:\n" + errorToString(err));
         }
     }
-    
-    if((err = SSLSetSessionOption(ssl, incoming ? kSSLSessionOptionBreakOnClientAuth : 
+
+    if((err = SSLSetSessionOption(ssl, incoming ? kSSLSessionOptionBreakOnClientAuth :
                                                   kSSLSessionOptionBreakOnServerAuth,
                                   true)))
     {
         throw SecurityException(__FILE__, __LINE__, "IceSSL: error while setting SSL option:\n" + errorToString(err));
     }
-    
+
     if(_protocolVersionMax != kSSLProtocolUnknown)
     {
         if((err = SSLSetProtocolVersionMax(ssl, _protocolVersionMax)))
         {
-            throw SecurityException(__FILE__, __LINE__, 
+            throw SecurityException(__FILE__, __LINE__,
                                     "IceSSL: error while setting SSL protocol version max:\n" + errorToString(err));
         }
     }
-    
+
     if(_protocolVersionMin != kSSLProtocolUnknown)
     {
         if((err = SSLSetProtocolVersionMin(ssl, _protocolVersionMin)))
         {
-            throw SecurityException(__FILE__, __LINE__, 
+            throw SecurityException(__FILE__, __LINE__,
                                     "IceSSL: error while setting SSL protocol version min:\n" + errorToString(err));
         }
     }
-    
+
     return ssl;
 }
 
 CFArrayRef
 IceSSL::SecureTransportEngine::getCertificateAuthorities() const
 {
-    return _certificateAuthorities;
+    return _certificateAuthorities.get();
 }
 
 string
@@ -1350,7 +1233,7 @@ IceSSL::SecureTransportEngine::parseCiphers(const string& ciphers)
 {
     vector<string> tokens;
     vector<CipherExpression> cipherExpressions;
-    
+
     bool allCiphers = false;
     IceUtilInternal::splitString(ciphers, " \t", tokens);
     for(vector<string>::const_iterator i = tokens.begin(); i != tokens.end(); ++i)
@@ -1360,7 +1243,7 @@ IceSSL::SecureTransportEngine::parseCiphers(const string& ciphers)
         {
             if(i != tokens.begin())
             {
-                throw PluginInitializationException(__FILE__, __LINE__, 
+                throw PluginInitializationException(__FILE__, __LINE__,
                                                     "IceSSL: `ALL' must be first in cipher list `" + ciphers + "'");
             }
             allCiphers = true;
@@ -1369,7 +1252,7 @@ IceSSL::SecureTransportEngine::parseCiphers(const string& ciphers)
         {
             if(i != tokens.begin())
             {
-                throw PluginInitializationException(__FILE__, __LINE__, 
+                throw PluginInitializationException(__FILE__, __LINE__,
                                                     "IceSSL: `NONE' must be first in cipher list `" + ciphers + "'");
             }
         }
@@ -1385,7 +1268,7 @@ IceSSL::SecureTransportEngine::parseCiphers(const string& ciphers)
                 }
                 else
                 {
-                    throw PluginInitializationException(__FILE__, __LINE__, 
+                    throw PluginInitializationException(__FILE__, __LINE__,
                                                         "IceSSL: invalid cipher expression `" + token + "'");
                 }
             }
@@ -1393,12 +1276,12 @@ IceSSL::SecureTransportEngine::parseCiphers(const string& ciphers)
             {
                 ce.negation = false;
             }
-            
+
             if(token.find('(') == 0)
             {
                 if(token.rfind(')') != token.size() - 1)
                 {
-                    throw PluginInitializationException(__FILE__, __LINE__, 
+                    throw PluginInitializationException(__FILE__, __LINE__,
                                                         "IceSSL: invalid cipher expression `" + token + "'");
                 }
 
@@ -1408,7 +1291,7 @@ IceSSL::SecureTransportEngine::parseCiphers(const string& ciphers)
                 }
                 catch(const Ice::SyscallException&)
                 {
-                    throw PluginInitializationException(__FILE__, __LINE__, 
+                    throw PluginInitializationException(__FILE__, __LINE__,
                                                         "IceSSL: invalid cipher expression `" + token + "'");
                 }
             }
@@ -1416,34 +1299,35 @@ IceSSL::SecureTransportEngine::parseCiphers(const string& ciphers)
             {
                 ce.cipher = token;
             }
-            
+
             cipherExpressions.push_back(ce);
         }
     }
-    
+
     //
     // Context used to get the cipher list
     //
     SSLContextRef ctx = SSLCreateContext(kCFAllocatorDefault, kSSLServerSide, kSSLStreamType);
     size_t numSupportedCiphers = 0;
     SSLGetNumberSupportedCiphers(ctx, &numSupportedCiphers);
-    
+
     vector<SSLCipherSuite> supported;
     supported.resize(numSupportedCiphers);
-    
+
     OSStatus err = SSLGetSupportedCiphers(ctx, &supported[0], &numSupportedCiphers);
+    CFRelease(ctx);
     if(err)
     {
-        throw PluginInitializationException(__FILE__, __LINE__, 
+        throw PluginInitializationException(__FILE__, __LINE__,
                                             "IceSSL: unable to get supported ciphers list:\n" + errorToString(err));
     }
-    
+
     vector<SSLCipherSuite> enabled;
     if(allCiphers)
     {
         enabled = supported;
     }
-    
+
     for(vector<CipherExpression>::const_iterator i = cipherExpressions.begin(); i != cipherExpressions.end(); ++i)
     {
         CipherExpression ce = *i;
@@ -1453,7 +1337,7 @@ IceSSL::SecureTransportEngine::parseCiphers(const string& ciphers)
             {
                 SSLCipherSuite cipher = *j;
                 string name = CiphersHelper::cipherName(cipher);
-                
+
                 if(ce.cipher.empty())
                 {
                     if(ce.re->match(name))