libmicrohttpd2

tls_open_funcs.c (89064B)

---

 /* SPDX-License-Identifier: LGPL-2.1-or-later OR (GPL-2.0-or-later WITH eCos-exception-2.0) */
 /*
   This file is part of GNU libmicrohttpd.
   Copyright (C) 2024-2025 Evgeny Grin (Karlson2k)
 
   GNU libmicrohttpd is free software; you can redistribute it and/or
   modify it under the terms of the GNU Lesser General Public
   License as published by the Free Software Foundation; either
   version 2.1 of the License, or (at your option) any later version.
 
   GNU libmicrohttpd is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   Lesser General Public License for more details.
 
   Alternatively, you can redistribute GNU libmicrohttpd and/or
   modify it under the terms of the GNU General Public License as
   published by the Free Software Foundation; either version 2 of
   the License, or (at your option) any later version, together
   with the eCos exception, as follows:
 
     As a special exception, if other files instantiate templates or
     use macros or inline functions from this file, or you compile this
     file and link it with other works to produce a work based on this
     file, this file does not by itself cause the resulting work to be
     covered by the GNU General Public License. However the source code
     for this file must still be made available in accordance with
     section (3) of the GNU General Public License v2.
 
     This exception does not invalidate any other reasons why a work
     based on this file might be covered by the GNU General Public
     License.
 
   You should have received copies of the GNU Lesser General Public
   License and the GNU General Public License along with this library;
   if not, see <https://www.gnu.org/licenses/>.
 */
 
 /**
  * @file src/mhd2/tls_open_funcs.c
  * @brief  The implementation of OpenSSL wrapper functions
  * @author Karlson2k (Evgeny Grin)
  */
 
 #include "mhd_sys_options.h"
 
 #include "sys_bool_type.h"
 #include "sys_base_types.h"
 
 #include "compat_calloc.h"
 #include "sys_malloc.h"
 #include <string.h>
 
 #ifdef mhd_USE_TLS_DEBUG_MESSAGES
 #  include <stdio.h> /* For TLS debug printing */
 #endif
 
 #include "mhd_assert.h"
 #include "mhd_unreachable.h"
 #include "mhd_assume.h"
 #include "mhd_predict.h"
 
 #include "mhd_str.h"
 #include "mhd_str_types.h"
 #include "mhd_conn_socket.h"
 
 #include "mhd_tls_internal.h"
 
 #include "tls_open_tls_lib.h"
 
 #include "mhd_tls_ver_stct.h"
 
 #include "tls_open_daemon_data.h"
 #include "tls_open_conn_data.h"
 #include "tls_open_funcs.h"
 
 #include "daemon_options.h"
 
 #include "daemon_logger.h"
 
 #ifdef mhd_HAVE_OPENSSL_ACME
 #  include "mhd_tls_acme_func.h"
 #endif /* mhd_HAVE_OPENSSL_ACME */
 
 #include "microhttpd2_portability.h"
 #include "mhd_public_api.h"
 
 #if defined(HAVE_WUSED_BUT_MARKED_UNUSED) && defined(MHD_WARN_IGNORE_STYLE_GCC)
 #  define mhd_NOWARN_USED_UNUSED   \
           MHD_WARN_PUSH_ MHD_WARN_IGNORE_ ("-Wused-but-marked-unused")
 #  define mhd_RESTORE_WARN_USED_UNUSED MHD_WARN_POP_
 #else
 #  define mhd_NOWARN_USED_UNUSED   /* empty */
 #  define mhd_RESTORE_WARN_USED_UNUSED   /* empty */
 #endif
 
 #ifdef mhd_USE_TLS_DEBUG_MESSAGES
 
 static MHD_FN_PAR_NONNULL_ (1) int
 mhd_tls_open_dbg_print_errs (const char *msg,
                              size_t msg_len,
                              void *cls)
 {
   int ret;
   int print_size = (int)msg_len;
 
   (void)cls;  /* Not used */
 
   if ((print_size < 0)
       || (msg_len != (unsigned int)print_size))
     print_size = (int)((~((unsigned int)0u)) >> 1);
 
   ret = fprintf (stderr,
                  "## OpenSSL error: %.*s\n",
                  print_size, msg);
   (void)fflush (stderr);
   return ret;
 }
 
 
 #  define mhd_DBG_PRINT_TLS_ERRS() \
           ERR_print_errors_cb (&mhd_tls_open_dbg_print_errs, NULL)
 
 #  define mhd_DBG_PRINT_TLS_INFO_MSG(message) \
           do { (void) fprintf (stderr, "## OpenSSL info: %s\n", (message)); \
                (void) fflush (stderr);} while (0)
 #  define mhd_DBG_PRINT_TLS_INFO_PARAM1(message, param) \
      do { (void) fprintf (stderr, "## OpenSSL info: " message "\n", (param)); \
           (void) fflush (stderr);} while (0)
 #else
 #  define mhd_DBG_PRINT_TLS_ERRS()      ERR_clear_error ()
 #  define mhd_DBG_PRINT_TLS_INFO_MSG(message)       ((void) 0)
 #  define mhd_DBG_PRINT_TLS_INFO_PARAM1(message, param)  ((void) 0)
 #endif
 
 /* ** Global initialisation / de-initialisation ** */
 
 static bool openssl_lib_inited = false;
 
 #ifdef mhd_HAVE_OPENSSL_ACME
 /**
  * The index of the pointer to MHD connection TLS data in the "ex_data" storage
  * of the TLS session.
  * This leaves the "app_data" (index zero of the "ex_data" storage) for other
  * possible uses.
  */
 static int conn_mhd_ctls_idx = -1;
 #endif /* mhd_HAVE_OPENSSL_ACME */
 
 MHD_INTERNAL void
 mhd_tls_open_global_init_once (void)
 {
   const unsigned long ver_num = OpenSSL_version_num ();
   /* Make sure that used shared OpenSSL library has least the same version as
      MHD was configured for. Fail if the version is earlier. */
   openssl_lib_inited = ((0x900000UL < ver_num) /* Versions before 3.0 */
                         && (OPENSSL_VERSION_NUMBER <= ver_num));
 
   /* The call of OPENSSL_init_ssl() typically not needed, but it won't hurt
      if library was initialised automatically.
      In some exotic situations automatic initialisation could fail, and
      this call would make sure that the library is initialised before used. */
   openssl_lib_inited = openssl_lib_inited
                        && (0 < OPENSSL_init_ssl (0, NULL));
 
 #ifdef mhd_HAVE_OPENSSL_ACME
   if (openssl_lib_inited)
   {
     conn_mhd_ctls_idx = SSL_get_ex_new_index (0,
                                               NULL,
                                               NULL,
                                               NULL,
                                               NULL);
     openssl_lib_inited = (0 <= conn_mhd_ctls_idx);
   }
 #endif /* mhd_HAVE_OPENSSL_ACME */
 }
 
 
 MHD_INTERNAL MHD_FN_PURE_ bool
 mhd_tls_open_is_inited_fine (void)
 {
   return openssl_lib_inited;
 }
 
 
 /* ** Daemon initialisation / de-initialisation ** */
 
 /**
  * Check application-provided daemon TLS settings
  * @param d the daemon handle
  * @param sk_edge_trigg the sockets polling uses edge-triggering
  * @param s the application-provided settings
  * @return #MHD_SC_OK on success,
  *         error code otherwise
  */
 static MHD_FN_PAR_NONNULL_ALL_ MHD_FN_MUST_CHECK_RESULT_ enum MHD_StatusCode
 check_app_tls_settings (struct MHD_Daemon *restrict d,
                         bool sk_edge_trigg,
                         struct DaemonOptions *restrict s)
 {
   mhd_assert (MHD_TLS_BACKEND_NONE != s->tls);
   mhd_assert ((MHD_TLS_BACKEND_OPENSSL == s->tls) \
               || (MHD_TLS_BACKEND_ANY == s->tls));
   if (NULL == s->tls_cert_key.v_mem_cert)
   {
     mhd_LOG_MSG (d, MHD_SC_TLS_CONF_BAD_CERT, \
                  "No valid TLS certificate is provided");
     return MHD_SC_TLS_CONF_BAD_CERT;
   }
   mhd_assert (NULL != s->tls_cert_key.v_mem_key);
 
   if (sk_edge_trigg)
   {
     mhd_LOG_MSG (d, MHD_SC_TLS_BACKEND_DAEMON_INCOMPATIBLE_SETTINGS, \
                  "Edge-triggered sockets polling cannot be used "
                  "with OpenSSL backend");
     return MHD_SC_TLS_BACKEND_DAEMON_INCOMPATIBLE_SETTINGS;
   }
 
 #ifdef mhd_HAVE_TLS_ACME
   if (!mhd_tls_open_is_acme_alpn_supported (s)
       && s->acme_alpn_required)
   {
     mhd_LOG_MSG (d, MHD_SC_TLS_BACKEND_DAEMON_INCOMPATIBLE_SETTINGS,
                  "This build of OpenSSL backend does not support "
                  "ACME ALPN challenge protocol, but daemon settings "
                  "require it");
     return MHD_SC_TLS_BACKEND_DAEMON_INCOMPATIBLE_SETTINGS;
   }
 #endif
 
   return MHD_SC_OK;
 }
 
 
 /* Helper to prevent password prompts in terminal */
 static int
 null_passwd_cb (char *buf,
                 int size,
                 int rwflag,
                 void *cls)
 {
   (void)buf;
   (void)size;
   (void)rwflag;
   (void)cls;                                          /* Unused */
   mhd_DBG_PRINT_TLS_INFO_MSG ("The NULL passphrase callback is called\n");
   return 0;
 }
 
 
 /**
  * Create new empty OpenSSL library context
  * @param d the daemon handle
  * @param d_tls the daemon TLS settings
  * @return 'true' on success,
  *         'false' otherwise
  */
 static MHD_FN_PAR_NONNULL_ALL_ MHD_FN_MUST_CHECK_RESULT_ bool
 create_lib_ctx (struct MHD_Daemon *restrict d,
                 struct mhd_TlsOpenDaemonData *restrict d_tls)
 {
 #ifndef MHD_SUPPORT_LOG_FUNCTIONALITY
   (void)d;  /* Used for logging only */
 #endif /* MHD_SUPPORT_LOG_FUNCTIONALITY */
   mhd_assert (NULL == d_tls->libctx);
 
   d_tls->libctx = OSSL_LIB_CTX_new ();
 
   if (NULL == d_tls->libctx)
   {
     mhd_DBG_PRINT_TLS_ERRS ();
     mhd_LOG_MSG (d, MHD_SC_TLS_DAEMON_INIT_FAILED, \
                  "Failed to create TLS library context");
     return false;
   }
   return true;
 }
 
 
 /**
  * Reset OpenSSL library context.
  *
  * This function must not be called if library context is being used.
  * @param d the daemon handle
  * @param d_tls the daemon TLS settings
  * @return 'true' on success,
  *         'false' otherwise
  */
 static MHD_FN_PAR_NONNULL_ALL_ MHD_FN_MUST_CHECK_RESULT_ bool
 reset_lib_ctx (struct MHD_Daemon *restrict d,
                struct mhd_TlsOpenDaemonData *restrict d_tls)
 {
   mhd_assert (NULL != d_tls->libctx);
 
   OSSL_LIB_CTX_free (d_tls->libctx);
   d_tls->libctx = NULL;
 
   return create_lib_ctx (d,
                          d_tls);
 }
 
 
 /**
  * Get non-default pathname for OpenSSL configuration file
  * @param s the application-provided settings
  * @param[out] conf_pathname set to the pathname on success
  * @return #MHD_SC_OK on success,
  *         error code otherwise
  */
 static MHD_FN_PAR_NONNULL_ALL_
 MHD_FN_PAR_OUT_ (2) MHD_FN_MUST_CHECK_RESULT_ enum MHD_StatusCode
 daemon_get_conf_file (struct DaemonOptions *restrict s,
                       char **restrict conf_pathname)
 {
   size_t name_len;
   bool has_path;
 
   mhd_assert (NULL != s->tls_openssl_def_file.v_pathname);
 
 #ifndef MHD_SUPPORT_LOG_FUNCTIONALITY
   (void)d;  /* Used only for logging */
 #endif
 
   /* Handle custom pathname */
 
   name_len = strlen (s->tls_openssl_def_file.v_pathname);
   has_path = (NULL != memchr (s->tls_openssl_def_file.v_pathname,
                               '/',
                               name_len));
 #ifdef _WIN32
   has_path = has_path || (NULL != memchr (s->tls_openssl_def_file,
                                           '\\',
                                           name_len));
 #endif /* _WIN32 */
 
   if ((!has_path) && (0u != name_len))
   {
     const char *def_path;
     size_t def_path_len;
 
     def_path = X509_get_default_cert_area ();
     if (NULL == def_path)
     {
       mhd_DBG_PRINT_TLS_ERRS ();
       mhd_DBG_PRINT_TLS_INFO_MSG ("X509_get_default_cert_area() returned NULL");
       return MHD_SC_TLS_DAEMON_INIT_FAILED; /* Unrealistic */
     }
 
     def_path_len = strlen (def_path);
 
     *conf_pathname =
       (char *)OPENSSL_malloc (def_path_len + 1u + name_len + 1u);
     if (NULL == *conf_pathname)
       return MHD_SC_DAEMON_MEM_ALLOC_FAILURE;
 
     memcpy (*conf_pathname,
             def_path,
             def_path_len);
     (*conf_pathname)[def_path_len] = '/';
     memcpy ((*conf_pathname) + def_path_len + 1u,
             s->tls_openssl_def_file.v_pathname,
             name_len + 1u);
 
     return MHD_SC_OK;
   }
 
   *conf_pathname = (char *)OPENSSL_malloc (name_len + 1u);
   if (NULL == *conf_pathname)
     return MHD_SC_DAEMON_MEM_ALLOC_FAILURE;
 
   memcpy (*conf_pathname,
           s->tls_openssl_def_file.v_pathname,
           name_len + 1u);
 
   return MHD_SC_OK;
 }
 
 
 #ifdef mhd_TLS_OPEN_HAS_CONF_DIAG
 #  define mhd_LIBCTX_FORBIDS_FALLBACKS(d_tls) \
           (0 != OSSL_LIB_CTX_get_conf_diagnostics (d_tls->libctx))
 #else
 #  define mhd_LIBCTX_FORBIDS_FALLBACKS(d_tls)   ((void) (d_tls), ! ! 0)
 #endif /* ! mhd_TLS_OPEN_HAS_CONF_DIAG */
 
 
 static MHD_FN_PAR_NONNULL_ (1) MHD_FN_PAR_NONNULL_ (2)
 MHD_FN_PAR_NONNULL_ (4) bool
 daemon_load_conf_from_cfg (struct MHD_Daemon *restrict d,
                            const char *restrict filename,
                            const char *restrict app_name,
                            CONF *restrict cfg,
                            unsigned long load_flags,
                            bool log_missing_app_name)
 {
 #ifndef MHD_SUPPORT_LOG_FUNCTIONALITY
   (void)d;  /* Used for logging only */
 #  ifndef mhd_USE_TLS_DEBUG_MESSAGES
   (void)filename;  /* Used for logs only */
 #  endif /* mhd_USE_TLS_DEBUG_MESSAGES */
 #endif /* MHD_SUPPORT_LOG_FUNCTIONALITY */
 
   if (NULL != app_name)
   {
     if (NULL == NCONF_get_string (cfg,
                                   NULL,
                                   app_name))
     {
       if (log_missing_app_name)
         mhd_LOG_PRINT (d,
                        MHD_SC_TLS_LIB_CONF_WARNING,
                        mhd_LOG_FMT ("TLS library configuration '%s' "
                                     "was not found in file '%s'"),
                        app_name,
                        filename);
       else
         mhd_DBG_PRINT_TLS_INFO_PARAM1 ("TLS library configuration '%s' "
                                        "was not found in the configuration "
                                        "file",
                                        app_name);
       return false;
     }
     mhd_DBG_PRINT_TLS_INFO_PARAM1 ("Trying to load configuration section "
                                    "pointed by '%s'",
                                    app_name);
   }
   else
     mhd_DBG_PRINT_TLS_INFO_MSG ("Trying to load configuration section "
                                 "pointed by default OpenSSL configuration");
 
   if (1 != CONF_modules_load (cfg,
                               app_name,
                               load_flags))
   {
     mhd_DBG_PRINT_TLS_ERRS ();
 
     mhd_LOG_PRINT (d,
                    MHD_SC_TLS_LIB_CONF_WARNING,
                    mhd_LOG_FMT ("Error loading TLS library "
                                 "configuration '%s' "
                                 "from file '%s'"),
                    app_name,
                    filename);
 
     return false;
   }
 
   mhd_DBG_PRINT_TLS_INFO_MSG ("Successfully loaded OpenSSL configuration "
                               "from the configuration file");
 
   return true;
 }
 
 
 static MHD_FN_PAR_NONNULL_ALL_
 MHD_FN_PAR_INOUT_ (2) MHD_FN_PAR_INOUT_ (4) bool
 cfg_reset_and_reload (struct MHD_Daemon *restrict d,
                       struct mhd_TlsOpenDaemonData *restrict d_tls,
                       const char *restrict filename,
                       CONF **restrict cfg_ptr)
 {
 #ifndef MHD_SUPPORT_LOG_FUNCTIONALITY
   (void)d;  /* Used for logging only */
 #endif /* MHD_SUPPORT_LOG_FUNCTIONALITY */
   mhd_assert (NULL != *cfg_ptr);
 
   mhd_DBG_PRINT_TLS_INFO_MSG ("Resetting library CTX, CONF and reloading "
                               "configuration file");
 
   /* Destroy old cfg, which is connected to the library CTX */
   NCONF_free (*cfg_ptr);
   *cfg_ptr = NULL;
 
   /* Reset OpenSSL library CTX, which may have partially applied configuration */
   if (!reset_lib_ctx (d,
                       d_tls))
     return false;
 
   /* Create a new cfg connected to the new CTX */
   *cfg_ptr = NCONF_new_ex (d_tls->libctx,
                            NULL);
   if (NULL == *cfg_ptr)
   {
     mhd_DBG_PRINT_TLS_ERRS ();
 
     mhd_DBG_PRINT_TLS_INFO_MSG ("Failed to create a new OpenSSL CONF");
     return false;
   }
 
   if (0 >= NCONF_load (*cfg_ptr,
                        filename,
                        NULL))
   {
     mhd_DBG_PRINT_TLS_ERRS ();
 
     mhd_DBG_PRINT_TLS_INFO_PARAM1 ("Failed to reload configuration file '%s'",
                                    filename);
     return false;
   }
 
   return true;
 }
 
 
 static inline MHD_FN_PAR_NONNULL_ALL_ bool
 is_conf_file_fallback_allowed (
   const struct mhd_TlsOpenDaemonData *restrict d_tls,
   const struct DaemonOptions *restrict s)
 {
   mhd_assert (NULL != d_tls->libctx);
 
   if (!s->tls_openssl_def_file.v_disable_fallback)
     return false;
   if (mhd_LIBCTX_FORBIDS_FALLBACKS (d_tls))
     return false;
   return true;
 }
 
 
 static inline MHD_FN_PAR_NONNULL_ALL_ bool
 is_conf_fallback_allowed (const struct mhd_TlsOpenDaemonData *restrict d_tls,
                           const struct DaemonOptions *restrict s)
 {
   if (!s->tls_app_name.v_disable_fallback)
     return false;
 
   return is_conf_file_fallback_allowed (d_tls,
                                         s);
 }
 
 
 /**
  * Load OpenSSL configuration from OpenSSL configuration file
  * @param d the daemon handle
  * @param d_tls the daemon TLS settings
  * @param s the application-provided settings
  * @param use_custom_conf_pathname choose application-provided pathname or
  *                                 TLS backend default pathname
  * @return #MHD_SC_OK on success,
  *         #MHD_SC_TLS_LIB_CONF_WARNING if configuration was not loaded due to
  *                                      non-fatal error,
  *         error code otherwise
  */
 static MHD_FN_PAR_NONNULL_ (1) MHD_FN_PAR_NONNULL_ (2) MHD_FN_PAR_NONNULL_ (3)
 MHD_FN_MUST_CHECK_RESULT_ enum MHD_StatusCode
 daemon_load_lib_conf (struct MHD_Daemon *restrict d,
                       struct mhd_TlsOpenDaemonData *restrict d_tls,
                       struct DaemonOptions *restrict s,
                       bool use_custom_conf_pathname)
 {
   char *conf_pathname;
   CONF *conf;
   enum MHD_StatusCode ret;
 
   if (!use_custom_conf_pathname)
   {
     /* Use default pathname */
     conf_pathname = CONF_get1_default_config_file ();
 
     if (NULL == conf_pathname)
     {
       mhd_DBG_PRINT_TLS_ERRS ();
 
       ret = is_conf_fallback_allowed (d_tls,
                                       s)
              ? MHD_SC_TLS_LIB_CONF_WARNING : MHD_SC_TLS_DAEMON_INIT_FAILED;
 
       mhd_LOG_MSG (d, ret, \
                    "Failed to get default configuration file pathname");
     }
     else
       ret = MHD_SC_OK;
   }
   else
     ret = daemon_get_conf_file (s,
                                 &conf_pathname);
 
   if (MHD_SC_OK != ret)
   {
     mhd_DBG_PRINT_TLS_INFO_MSG ("Failed to get configuration file pathname");
     return ret;
   }
 
   mhd_ASSUME (NULL != conf_pathname);
   mhd_DBG_PRINT_TLS_INFO_PARAM1 ("Trying '%s' as OpenSSL configuration file",
                                  conf_pathname);
 
   if ('\0' == conf_pathname[0])
   {
     OPENSSL_free (conf_pathname); /* A short-cut */
 
     if (NULL == s->tls_app_name.v_app_name)
       return MHD_SC_OK; /* No special "application name" profile is needed */
 
     if (!s->tls_app_name.v_disable_fallback)
       return MHD_SC_OK; /* Initialisation allowed with default values */
 
     /* Load of special "application name" profile is required */
 
     if (!use_custom_conf_pathname)
       return MHD_SC_TLS_DAEMON_INIT_FAILED; /* No fallback pathname */
 
     mhd_assert (NULL != s->tls_openssl_def_file.v_pathname);
 
     if (s->tls_openssl_def_file.v_disable_fallback)
       return MHD_SC_TLS_DAEMON_INIT_FAILED; /* Fallback pathname is disallowed */
 
     /* Try to use fallback pathname to load special "application name" profile */
     return MHD_SC_TLS_LIB_CONF_WARNING;
   }
 
   conf = NCONF_new_ex (d_tls->libctx,
                        NULL);
   if (NULL == conf)
   {
     mhd_DBG_PRINT_TLS_ERRS ();
 
     ret = is_conf_fallback_allowed (d_tls,
                                     s)
           ? MHD_SC_TLS_LIB_CONF_WARNING : MHD_SC_TLS_DAEMON_INIT_FAILED;
     mhd_LOG_MSG (d, ret, \
                  "Failed to create OpenSSL empty configuration object");
   }
 
   if (MHD_SC_OK == ret)
   {
     long err_line_num;
     mhd_DBG_PRINT_TLS_INFO_PARAM1 ("Trying to load configuration file '%s'",
                                    conf_pathname);
 
     if (0 >= NCONF_load (conf,
                          conf_pathname,
                          &err_line_num))
     {
       mhd_DBG_PRINT_TLS_ERRS ();
 
       if (use_custom_conf_pathname)
         ret = is_conf_file_fallback_allowed (d_tls,
                                              s)
               ? MHD_SC_TLS_LIB_CONF_WARNING : MHD_SC_TLS_DAEMON_INIT_FAILED;
       else
         ret = is_conf_fallback_allowed (d_tls,
                                         s)
               ? MHD_SC_TLS_LIB_CONF_WARNING : MHD_SC_TLS_DAEMON_INIT_FAILED;
 
       mhd_LOG_PRINT (d,
                      ret,
                      mhd_LOG_FMT ("Error loading TLS library configuration "
                                   "file '%s' at line %ld"),
                      conf_pathname,
                      err_line_num);
     }
 
     if (MHD_SC_OK == ret)
     {
       bool conf_loaded;
       unsigned long flags;
 
       flags = 0u;
       if (!s->tls_app_name.v_disable_fallback)
         flags |= CONF_MFLAGS_IGNORE_ERRORS;
 
       conf_loaded = false;
 
       if (NULL != s->tls_app_name.v_app_name)
       {
         char app_name_lc[128];
         const size_t app_name_len = strlen (s->tls_app_name.v_app_name);
 
         /* Checked at the parameter processing */
         mhd_ASSUME ((128u) > app_name_len);
 
         mhd_str_to_lowercase_bin_n (app_name_len + 1u, /* '+1' for zero termination */
                                     s->tls_app_name.v_app_name,
                                     app_name_lc);
 
         mhd_ASSUME ('\0' ==  app_name_lc[app_name_len]);
 
         conf_loaded =
           daemon_load_conf_from_cfg (d,
                                      conf_pathname,
                                      app_name_lc,
                                      conf,
                                      flags,
                                      s->tls_app_name.v_disable_fallback
                                      || mhd_LIBCTX_FORBIDS_FALLBACKS (d_tls));
 
         if (!conf_loaded)
         {
           if (s->tls_app_name.v_disable_fallback
               || mhd_LIBCTX_FORBIDS_FALLBACKS (d_tls))
             ret = MHD_SC_TLS_DAEMON_INIT_FAILED;
           else if (!cfg_reset_and_reload (d,
                                           d_tls,
                                           conf_pathname,
                                           &conf))
             ret = MHD_SC_TLS_DAEMON_INIT_FAILED;
         }
       }
 
       if (!conf_loaded
           && (MHD_SC_OK == ret))
       {
 
         mhd_assert ((NULL == s->tls_app_name.v_app_name)
                     || !s->tls_app_name.v_disable_fallback);
 
         conf_loaded =
           daemon_load_conf_from_cfg (d,
                                      conf_pathname,
                                      "libmicrohttpd",
                                      conf,
                                      flags,
                                      false);
         if ((!conf_loaded)
             && (!cfg_reset_and_reload (d,
                                        d_tls,
                                        conf_pathname,
                                        &conf)))
           ret = MHD_SC_TLS_DAEMON_INIT_FAILED;
       }
 
       if (!conf_loaded
           && (MHD_SC_OK == ret))
       {
 
         mhd_assert ((NULL == s->tls_app_name.v_app_name)
                     || !s->tls_app_name.v_disable_fallback);
 
         conf_loaded =
           daemon_load_conf_from_cfg (d,
                                      conf_pathname,
                                      NULL,
                                      conf,
                                      flags,
                                      true);
       }
 
       if (!conf_loaded)
         ret = MHD_SC_TLS_LIB_CONF_WARNING;
     }
 
     NCONF_free (conf); /* Explicitly safe with NULL */
   }
 
   OPENSSL_free (conf_pathname);
 
   return ret;
 }
 
 
 /**
  * Initialise OpenSSL library context
  * @param d the daemon handle
  * @param d_tls the daemon TLS settings
  * @param s the application-provided settings
  * @return #MHD_SC_OK on success,
  *         error code otherwise
  */
 static MHD_FN_PAR_NONNULL_ALL_ MHD_FN_MUST_CHECK_RESULT_ enum MHD_StatusCode
 daemon_init_lib_ctx (struct MHD_Daemon *restrict d,
                      struct mhd_TlsOpenDaemonData *restrict d_tls,
                      struct DaemonOptions *restrict s)
 {
   enum MHD_StatusCode ret;
 
   if (!create_lib_ctx (d, d_tls))
     return MHD_SC_TLS_DAEMON_INIT_FAILED;
 
   if (NULL != s->tls_openssl_def_file.v_pathname)
   {
     ret = daemon_load_lib_conf (d,
                                 d_tls,
                                 s,
                                 true);
 
     if (MHD_SC_OK == ret)
       return MHD_SC_OK;
 
     if (MHD_SC_TLS_LIB_CONF_WARNING == ret)
       ret = s->tls_openssl_def_file.v_disable_fallback
             ? MHD_SC_TLS_DAEMON_INIT_FAILED : MHD_SC_OK;
   }
   else
     ret = MHD_SC_OK;
 
   mhd_assert (MHD_SC_TLS_LIB_CONF_WARNING != ret);
 
   if (MHD_SC_OK == ret)
   {
     mhd_assert ((NULL == s->tls_openssl_def_file.v_pathname)
                 || !s->tls_openssl_def_file.v_disable_fallback);
 
     ret = daemon_load_lib_conf (d,
                                 d_tls,
                                 s,
                                 false);
 
     if (MHD_SC_OK == ret)
       return MHD_SC_OK;
 
     if (MHD_SC_TLS_LIB_CONF_WARNING == ret)
     {
       if ((!s->tls_app_name.v_disable_fallback)
           && (!s->tls_openssl_def_file.v_disable_fallback))
         return MHD_SC_OK; /* Load without configuration file */
 
       ret = MHD_SC_TLS_DAEMON_INIT_FAILED;
     }
   }
 
   mhd_assert (MHD_SC_TLS_LIB_CONF_WARNING != ret);
 
   OSSL_LIB_CTX_free (d_tls->libctx); /* Explicitly safe with NULL */
   mhd_LOG_MSG (d, MHD_SC_TLS_DAEMON_INIT_FAILED, \
                "Failed to initialise TLS library context");
   return MHD_SC_TLS_DAEMON_INIT_FAILED;
 }
 
 
 /**
  * De-initialise OpenSSL library context
  * @param d_tls the daemon TLS settings
  */
 static MHD_FN_PAR_NONNULL_ALL_ void
 daemon_deinit_lib_ctx (struct mhd_TlsOpenDaemonData *restrict d_tls)
 {
   mhd_assert (NULL != d_tls->libctx);
   OSSL_LIB_CTX_free (d_tls->libctx);
 }
 
 
 #define mhd_ALPN_CODE_HTTP1_0 \
    'h', 't', 't', 'p', '/', '1', '.', '0' /* Registered value for HTTP/1.0 */
 #define mhd_ALPN_CODE_HTTP1_1 \
    'h', 't', 't', 'p', '/', '1', '.', '1' /* Registered value for HTTP/1.1 */
 #ifdef MHD_SUPPORT_HTTP2
 #  define mhd_ALPN_CODE_HTTP2 \
           'h', '2' /* Registered value for HTTP/2 over TLS */
 #endif /* MHD_SUPPORT_HTTP2 */
 #if 0  /* Disabled code */
 #  define mhd_ALPN_CODE_HTTP3 \
           'h', '3' /* Registered value for HTTP/3 */
 #endif /* Disabled code */
 #ifdef mhd_HAVE_OPENSSL_ACME
 /* Registered value for ACME TLS-ALPN-01 challenge */
 #  define mhd_ALPN_CODE_ACME \
           'a', 'c', 'm', 'e', '-', 't', 'l', 's', '/', '1'
 #endif /* mhd_HAVE_OPENSSL_ACME */
 
 
 #ifdef MHD_SUPPORT_HTTP2
 static const unsigned char alpn_list_http2_1x[] = {
   mhd_ALPN_H2_LEN, mhd_ALPN_CODE_HTTP2
   ,
   mhd_ALPN_H1_1_LEN, mhd_ALPN_CODE_HTTP1_1
   ,
   mhd_ALPN_H1_0_LEN, mhd_ALPN_CODE_HTTP1_0
 };
 static const unsigned char alpn_list_http2_only[] = {
   mhd_ALPN_H2_LEN, mhd_ALPN_CODE_HTTP2
 };
 #endif /* MHD_SUPPORT_HTTP2 */
 static const unsigned char alpn_list_http1x_only[] = {
   mhd_ALPN_H1_1_LEN, mhd_ALPN_CODE_HTTP1_1
   ,
   mhd_ALPN_H1_0_LEN, mhd_ALPN_CODE_HTTP1_0
 };
 #ifdef mhd_HAVE_OPENSSL_ACME
 /* RFC 8737, section 3: the ACME TLS-ALPN-01 challenge is answered with
    the "acme-tls/1" protocol and no other protocol */
 static const unsigned char alpn_list_acme_only[] = {
   mhd_ALPN_ACME_LEN, mhd_ALPN_CODE_ACME
 };
 #endif /* mhd_HAVE_OPENSSL_ACME */
 
 #ifndef OPENSSL_NO_NEXTPROTONEG
 /**
  * Provide the list of supported protocols for NPN extension
  * @param sess the TLS session (ignored)
  * @param[out] out the pointer to get the location of the data
  * @param[out] outlen the size of the data provided
  * @param cls the closure (ignored)
  * @return always SSL_TLSEXT_ERR_OK
  */
 static int
 get_npn_list (SSL *sess,
               const unsigned char **out,
               unsigned int *outlen,
               void *cls)
 {
   struct mhd_TlsOpenDaemonData *const d_tls =
     (struct mhd_TlsOpenDaemonData *)cls;
   (void)sess;  /* Unused */
   *out = d_tls->alpn_prots;
   *outlen = d_tls->alpn_prots_size;
   return SSL_TLSEXT_ERR_OK;
 }
 
 
 #endif /* ! OPENSSL_NO_NEXTPROTONEG */
 
 /**
  * Select protocol from the provided list for ALPN extension
  * @param sess the TLS session
  * @param[out] out the pointer to get the location of selected protocol value
  * @param[out] outlen the size of the selected protocol value
  * @param in the list of protocols values provided by the client
  * @param inlen the size of the list of protocols values provided by the client
  * @param cls the closure (ignored)
  * @return SSL_TLSEXT_ERR_OK if matching protocol found and selected,
  *         SSL_TLSEXT_ERR_ALERT_FATAL otherwise
  */
 static int
 select_alpn_prot (SSL *sess,
                   const unsigned char **out,
                   unsigned char *outlen,
                   const unsigned char *in,
                   unsigned int inlen,
                   void *cls)
 {
   struct mhd_TlsOpenDaemonData *const restrict d_tls =
     (struct mhd_TlsOpenDaemonData *)cls;
 
 #ifdef mhd_HAVE_OPENSSL_ACME
   if (!0)
   {
     const struct mhd_TlsOpenConnData *const restrict c_tls =
       (const struct mhd_TlsOpenConnData *)SSL_get_ex_data (sess,
                                                            conn_mhd_ctls_idx);
     mhd_assert (NULL != c_tls);
 
     if (c_tls->is_acme)
     {
       /* ALPN has been checked: ACME TLS-ALPN-01 only */
       mhd_assert (inlen == (unsigned int)sizeof(alpn_list_acme_only));
       mhd_assert (0 == memcmp (in, alpn_list_acme_only, inlen));
 
       *out = alpn_list_acme_only + 1; /* Skip the length byte */
       *outlen = (unsigned char)mhd_ALPN_ACME_LEN;
       return SSL_TLSEXT_ERR_OK; /* Success */
     }
   }
 #else  /* ! mhd_HAVE_OPENSSL_ACME */
   (void)sess;   /* Unused */
 #endif /* ! mhd_HAVE_OPENSSL_ACME */
 
   if (OPENSSL_NPN_NEGOTIATED ==
       SSL_select_next_proto ((unsigned char **)mhd_DROP_CONST (out),
                              outlen,
                              in,
                              inlen,
                              d_tls->alpn_prots,
                              d_tls->alpn_prots_size))
     return SSL_TLSEXT_ERR_OK; /* Success */
 
   return SSL_TLSEXT_ERR_ALERT_FATAL; /* Failure */
 }
 
 
 #ifdef mhd_USE_OPENSSL_CLIENT_HELLO_GET0_EXT
 #  ifndef mhd_HAVE_OPENSSL_ACME
 #    error mhd_USE_OPENSSL_CLIENT_HELLO_GET0_EXT requires mhd_HAVE_OPENSSL_ACME
 #  endif /* ! mhd_HAVE_OPENSSL_ACME */
 #endif /* mhd_USE_OPENSSL_CLIENT_HELLO_GET0_EXT */
 
 #ifdef mhd_HAVE_OPENSSL_ACME
 
 /**
  * The TLS session ID context for the ACME ALPN challenge connections.
  * The value is not interpreted by the TLS library, it only has to differ from
  * the context used for the normal connections, which is the empty default one.
  */
 static const unsigned char acme_sid_ctx[] = { 'A', 'C', 'M', 'E' };
 
 
 /**
  * Callback to prevent storing of the ACME ALPN challenge session
  * @param sess the TLS session (unused)
  * @param is_forward_secure set to non-zero if the session is forward secure
  *                          (unused)
  * @return always non-zero, the session must not be stored
  */
 static int
 acme_sess_not_resumable (SSL *sess,
                          int is_forward_secure)
 {
   (void)sess;                 /* Unused */
   (void)is_forward_secure;    /* Unused */
   return !0;
 }
 
 
 /**
  * Exclude the connection from the TLS sessions resumption.
  *
  * The ACME certificate is set for the single connection, while a resumed
  * handshake sends no certificate at all and the client keeps the certificate
  * of the original session. Therefore both directions must be blocked:
  * the session of this connection must not be stored, so that no normal
  * connection could resume it and get the ACME certificate, and this connection
  * must not resume any session stored for the normal connections, as it would
  * get the daemon certificate instead of the ACME certificate.
  *
  * The session ID context must be set before the TLS library looks up
  * the session requested by the client, the callback preventing the storing is
  * used later.
  *
  * @param sess the TLS session to exclude from the sessions resumption
  * @return 'true' on success,
  *         'false' otherwise
  */
 static MHD_FN_PAR_NONNULL_ALL_ MHD_FN_MUST_CHECK_RESULT_ bool
 mark_acme_no_resume (SSL *sess)
 {
   /* Any stored session has another session ID context, which is treated by
      the TLS library as a cache miss */
   if (0 == SSL_set_session_id_context (sess,
                                        acme_sid_ctx,
                                        (unsigned int)sizeof(acme_sid_ctx)))
     return false;
 
   SSL_set_not_resumable_session_callback (sess,
                                           &acme_sess_not_resumable);
   return true;
 }
 
 
 /**
  * Result of the application of the ACME ALPN challenge check to a connection
  */
 enum mhd_TlsOpenConnAcmeCheckFinishResult
 {
   /**
    * The connection is prepared and the handshake can be continued, either as
    * a normal HTTPS connection or as an ACME ALPN challenge connection
    */
   mhd_TLS_OPEN_ACME_CHECK_FINISH_OK = 0,
   /**
    * The TLS library failed to use the ACME credentials for the connection.
    * The handshake must be aborted, the "internal error" alert matches
    * the failure.
    */
   mhd_TLS_OPEN_ACME_CHECK_FINISH_ERROR,
   /**
    * The second ClientHello message, received after TLS 1.3 HelloRetryRequest,
    * has been recognised differently than the first one.
    * The handshake must be aborted, the "illegal parameter" alert matches
    * the failure.
    */
   mhd_TLS_OPEN_ACME_CHECK_FINISH_MISMATCH_HRR
 };
 
 
 /**
  * Apply the result of the ACME ALPN challenge check to the connection.
  *
  * If the ClientHello message has been recognised as the challenge, the ACME
  * certificate, the private key and the certificates chain are set for
  * the connection and the connection is excluded from the TLS sessions
  * resumption. Otherwise only the state of the connection is updated, as
  * the ALPN protocols for a normal HTTPS connection are set for the TLS
  * context.
  *
  * The function must be called for every checked ClientHello message,
  * including the second one received after TLS 1.3 HelloRetryRequest.
  *
  * @param[in,out] c_tls the connection TLS handle
  * @param acme_certs the list of the ACME certificates used for the check
  * @param acme_cred the credentials selected by the check,
  *                  or NULL if the ClientHello message is not
  *                  an ACME ALPN challenge
  * @return #mhd_TLS_OPEN_ACME_CHECK_FINISH_OK if the handshake can be
  *         continued,
  *         other values if the handshake must be aborted
  * @warning If @p acme_cred is not NULL, the list of the ACME certificates is
  *          read-locked by the check and is unlocked by this function
  */
 static MHD_FN_MUST_CHECK_RESULT_ MHD_FN_PAR_NONNULL_ (1)
 MHD_FN_PAR_NONNULL_ (2) enum mhd_TlsOpenConnAcmeCheckFinishResult
 mhd_tls_open_conn_acme_check_finish (
   struct mhd_TlsOpenConnData *restrict c_tls,
   struct mhd_TlsCertsList *restrict acme_certs,
   const union mhd_TlsCredDataPtr *restrict acme_cred)
 {
   enum mhd_TlsOpenConnAcmeCheckFinishResult res;
 
   mhd_assert (NULL != c_tls);
 
   if (NULL == acme_cred)
   {
     /* Normal (not ACME ALPN challenge) connection */
     if (c_tls->is_acme) /* Second ClientHello after TLS 1.3 HRR with another result */
     {
       mhd_assert (c_tls->clienthello_processed);
       c_tls->is_acme = false; /* Reset to non-ACME connection */
       return mhd_TLS_OPEN_ACME_CHECK_FINISH_MISMATCH_HRR; /* Unmatched ClientHello, abort handshake */
     }
 
     /* Process the connection as a normal HTTPS connection. */
     c_tls->clienthello_processed = true;
     return mhd_TLS_OPEN_ACME_CHECK_FINISH_OK; /* Non-ACME connection exit point */
   }
 
   /* Assume OK unless the checks below fail */
   res = mhd_TLS_OPEN_ACME_CHECK_FINISH_OK;
 
   if (c_tls->clienthello_processed && !c_tls->is_acme)
     res = mhd_TLS_OPEN_ACME_CHECK_FINISH_MISMATCH_HRR;
 
   if (mhd_TLS_OPEN_ACME_CHECK_FINISH_OK == res)
   {
     struct mhd_TlsOpenCredData *const restrict acme_open_cred =
       acme_cred->open;
 
     mhd_assert (NULL != acme_open_cred);
 
     ERR_clear_error ();
     /* Remove the daemon certificate: the certificate of another key type
        would not be replaced by the ACME certificate and could be selected
        by the TLS library instead of it. */
     SSL_certs_clear (c_tls->sess);
     /* The TLS library takes its own references for the objects, therefore
        the ACME credentials could be removed by the application at any moment
        after this point */
     if (!mark_acme_no_resume (c_tls->sess)
         || (0 >= SSL_use_certificate (c_tls->sess,
                                       acme_open_cred->cert))
         || (0 >= SSL_set1_chain (c_tls->sess,
                                  acme_open_cred->chain))
         || (0 >= SSL_use_PrivateKey (c_tls->sess,
                                      acme_open_cred->key)))
     {
       mhd_DBG_PRINT_TLS_ERRS ();
       res = mhd_TLS_OPEN_ACME_CHECK_FINISH_ERROR;
     }
   }
   mhd_daemon_acme_cert_r_unlock (acme_certs);
 
   c_tls->clienthello_processed = true;
   c_tls->is_acme = (mhd_TLS_OPEN_ACME_CHECK_FINISH_OK == res);
   return res;
 }
 
 
 #  ifdef mhd_USE_OPENSSL_CLIENT_HELLO_GET0_EXT
 
 
 /**
  * Check whether the ClientHello message is the ACME TLS-ALPN-01 challenge and
  * select the ACME credentials for the indicated domain.
  *
  * The extensions are taken from the ClientHello message parsed by the TLS
  * library. The TLS library rejects any duplicated extension before this
  * function is called.
  *
  * @param sess the TLS session processing the ClientHello message
  * @param acme_certs the list of the ACME certificates to check against
  * @return non-NULL if the ClientHello message is recognised as a TLS-ALPN-01
  *         challenge and the ACME credentials are selected,
  *         NULL otherwise
  * @warning If a non-NULL pointer is returned, the daemon's ACME certificate
  *          list remains read-locked and must be unlocked with
  *          #mhd_daemon_acme_cert_r_unlock().
  */
 static MHD_FN_MUST_CHECK_RESULT_ MHD_FN_PAR_NONNULL_ALL_
 const union mhd_TlsCredDataPtr *
 clnthello_check_acme (SSL *sess,
                       struct mhd_TlsCertsList *restrict acme_certs)
 {
   struct mhd_TlsClientHelloAcmeCheckData check;
   bool all_checks_ok;
 
   mhd_tls_acme_check_ext_init (&check,
                                acme_certs);
 
   all_checks_ok = true;
 
   /* The ALPN extension is checked first as it is checked without locking
      the list of the ACME certificates. Any typical HTTPS ClientHello is
      rejected by this check alone. */
   if (all_checks_ok)
   {
     static const unsigned int ext_alpn_id =
       TLSEXT_TYPE_application_layer_protocol_negotiation;
     const unsigned char *ext_alpn_data;
     size_t ext_alpn_size;
 
     all_checks_ok = (0 != SSL_client_hello_get0_ext (sess,
                                                      ext_alpn_id,
                                                      &ext_alpn_data,
                                                      &ext_alpn_size));
     if (all_checks_ok)
       all_checks_ok = mhd_tls_acme_check_ext (ext_alpn_id,
                                               ext_alpn_size,
                                               ext_alpn_data,
                                               &check);
   }
 
   if (all_checks_ok)
   {
     static const unsigned int ext_sni_id = TLSEXT_TYPE_server_name;
     const unsigned char *ext_sni_data;
     size_t ext_sni_size;
 
     all_checks_ok = (0 != SSL_client_hello_get0_ext (sess,
                                                      ext_sni_id,
                                                      &ext_sni_data,
                                                      &ext_sni_size));
     if (all_checks_ok)
       all_checks_ok = mhd_tls_acme_check_ext (ext_sni_id,
                                               ext_sni_size,
                                               ext_sni_data,
                                               &check);
   }
 
   /* The TLS library parsed the complete ClientHello message before calling
      this function, no need to make additional check for parse completeness */
   return mhd_tls_acme_check_ext_finish (&check,
                                         all_checks_ok);
 }
 
 
 /**
  * The TLS library callback for checking the ClientHello message for
  * the ACME ALPN challenge.
  *
  * The callback is registered for the TLS context as the TLS library has no
  * session-specific version of this callback.
  *
  * @param sess the TLS session processing the ClientHello message
  * @param[out] alert the TLS alert to send if the handshake is aborted
  * @param cls the closure, the pointer to the daemon TLS settings
  * @return #SSL_CLIENT_HELLO_SUCCESS for a normal HTTPS ClientHello or after
  *         successful ACME setup,
  *         #SSL_CLIENT_HELLO_ERROR to abort the handshake otherwise
  */
 static int
 check_clnt_hello_cb (SSL *sess,
                      int *alert,
                      void *cls)
 {
   struct mhd_TlsOpenDaemonData *const restrict d_tls =
     (struct mhd_TlsOpenDaemonData *)cls;
   struct mhd_TlsOpenConnData *const restrict c_tls =
     (struct mhd_TlsOpenConnData *)SSL_get_ex_data (sess,
                                                    conn_mhd_ctls_idx);
   const union mhd_TlsCredDataPtr *acme_cred; /* Set to non-NULL if request is recognised ACME challenge */
   enum mhd_TlsOpenConnAcmeCheckFinishResult res;
 
   mhd_assert (NULL != c_tls);
   mhd_assert (c_tls->sess == sess);
 
   acme_cred = NULL;
   if (mhd_daemon_has_acme_certs (d_tls->acme_certs))
     acme_cred = clnthello_check_acme (sess,
                                       d_tls->acme_certs);
 
   res = mhd_tls_open_conn_acme_check_finish (c_tls,
                                              d_tls->acme_certs,
                                              acme_cred);
 
   switch (res)
   {
   case mhd_TLS_OPEN_ACME_CHECK_FINISH_OK:
     return SSL_CLIENT_HELLO_SUCCESS;   /* Success exit point */
 
   case mhd_TLS_OPEN_ACME_CHECK_FINISH_ERROR:
     *alert = SSL_AD_INTERNAL_ERROR;
     break;
 
   case mhd_TLS_OPEN_ACME_CHECK_FINISH_MISMATCH_HRR:
     *alert = SSL_AD_ILLEGAL_PARAMETER;
     break;
 
   default:
     mhd_UNREACHABLE ();
     *alert = SSL_AD_INTERNAL_ERROR;
     break;
   }
 
   return SSL_CLIENT_HELLO_ERROR; /* Failure exit point */
 }
 
 
 #  else  /* ! mhd_USE_OPENSSL_CLIENT_HELLO_GET0_EXT */
 
 /**
  * Callback to abort the TLS handshake.
  *
  * The messages callback cannot report any failure, therefore this callback is
  * set by the messages callback when the handshake must be aborted. The TLS
  * library calls it after the ClientHello message has been processed and
  * before the response is constructed.
  *
  * @param sess the TLS session (unused)
  * @param cls the closure (unused)
  * @return always zero, the handshake is aborted with the "internal error"
  *         alert
  */
 static int
 cert_cb_always_fail (SSL *sess,
                      void *cls)
 {
   (void)sess;   /* Unused */
   (void)cls;    /* Unused */
   return 0;
 }
 
 
 /**
  * The TLS library callback for checking the ClientHello message for
  * the ACME ALPN challenge.
  *
  * The callback is set for the session, but only when the daemon has any ACME
  * certificate. The body of the ClientHello message is parsed by MHD.
  *
  * The callback removes itself as soon as no ClientHello message can be
  * received on the connection any more.
  *
  * @param write_p zero if the message is received, non-zero if it is sent
  * @param version the TLS protocol version (unused)
  * @param content_type the type of the record carrying the message
  * @param buf the message data, including the handshake header
  * @param len the size of the data pointed by @a buf
  * @param sess the TLS session processing the message
  * @param cls the closure, the list of the ACME certificates
  */
 static void
 check_hello_msg_acme (int write_p,
                       int version,
                       int content_type,
                       const void *buf,
                       size_t len,
                       SSL *sess,
                       void *cls)
 {
   struct mhd_TlsCertsList *const restrict acme_certs =
     (struct mhd_TlsCertsList *)cls;
   struct mhd_TlsOpenConnData *const restrict c_tls =
     (struct mhd_TlsOpenConnData *)SSL_get_ex_data (sess,
                                                    conn_mhd_ctls_idx);
   const unsigned char *const restrict msg = (const unsigned char *)buf;
   const union mhd_TlsCredDataPtr *acme_cred; /* Set to non-NULL if request is recognised ACME challenge */
 
   (void)version;   /* Unused */
   mhd_assert (NULL != c_tls);
   mhd_assert (c_tls->sess == sess);
 
   if ((0 != write_p) || (SSL3_RT_HANDSHAKE != content_type))
     return; /* Not an incoming handshake message */
 
   /* The first byte of the handshake header is the type of the message,
      the body of the message follows the header */
   if ((((size_t)SSL3_HM_HEADER_LENGTH) >= len)
       || (SSL3_MT_CLIENT_HELLO != msg[0]))
   {
     /* The client has sent another handshake message, no ClientHello can be
        received on this connection any more: TLS1.3 has no renegotiation and
        TLS1.2 renegotiation is rejected by #SSL_OP_NO_RENEGOTIATION */
     SSL_set_msg_callback (sess,
                           NULL);
     return;
   }
 
   /* If this is the second ClientHello then stop the callback,
      the TLS library accepts no more ClientHello */
   if (c_tls->clienthello_processed)
     SSL_set_msg_callback (sess,
                           NULL);
 
   acme_cred =
     mhd_tls_acme_check_clienthello_body (len - SSL3_HM_HEADER_LENGTH,
                                          msg + SSL3_HM_HEADER_LENGTH,
                                          acme_certs);
 
   if (mhd_TLS_OPEN_ACME_CHECK_FINISH_OK !=
       mhd_tls_open_conn_acme_check_finish (c_tls,
                                            acme_certs,
                                            acme_cred))
   {
     /* This callback cannot abort the handshake, the abort is performed by
        the certificates callback after the ClientHello message is processed.
        The alert cannot be selected this way: the client always receives
        the "internal error" alert. The "illegal parameter" alert, used for
        the unmatched ClientHello when the ClientHello callback is available,
        is not delivered to the client. */
     SSL_set_cert_cb (sess,
                      &cert_cb_always_fail,
                      NULL);
   }
 }
 
 
 #  endif /* ! mhd_USE_OPENSSL_CLIENT_HELLO_GET0_EXT */
 
 #endif /* mhd_HAVE_OPENSSL_ACME */
 
 /**
  * Initialise TLS server context
  * @param d the daemon handle
  * @param d_tls the daemon TLS settings
  * @param s the application-provided settings
  * @return #MHD_SC_OK on success,
  *         error code otherwise
  */
 static MHD_FN_PAR_NONNULL_ALL_ MHD_FN_MUST_CHECK_RESULT_ enum MHD_StatusCode
 daemon_init_ctx (struct MHD_Daemon *restrict d,
                  struct mhd_TlsOpenDaemonData *restrict d_tls,
                  struct DaemonOptions *restrict s)
 {
   uint64_t ctx_opts;
 
 #ifndef MHD_SUPPORT_LOG_FUNCTIONALITY
   (void)d;  /* Mute compiler warning */
 #endif
   (void)s;  // TODO: support configuration options
 
   mhd_assert (NULL != d_tls->libctx);
 
   ERR_clear_error ();
 
   d_tls->ctx = SSL_CTX_new_ex (d_tls->libctx,
                                NULL,
                                TLS_server_method ());
   if (NULL == d_tls->ctx)
   {
     mhd_DBG_PRINT_TLS_ERRS ();
     mhd_LOG_MSG (d, MHD_SC_TLS_DAEMON_INIT_FAILED, \
                  "Failed to initialise TLS server context");
     return MHD_SC_TLS_DAEMON_INIT_FAILED;
   }
 
   /* Enable some safe and useful workarounds */
   ctx_opts = SSL_OP_SAFARI_ECDHE_ECDSA_BUG | SSL_OP_TLSEXT_PADDING;
 
   // TODO: add configuration option
   // ctx_opts |= SSL_OP_CIPHER_SERVER_PREFERENCE;
 
 #ifndef OPENSSL_NO_KTLS
   /* Enable kernel TLS */ // TODO: add configuration option
   ctx_opts |= SSL_OP_ENABLE_KTLS;
 #  ifdef SSL_OP_ENABLE_KTLS_TX_ZEROCOPY_SENDFILE
   ctx_opts |= SSL_OP_ENABLE_KTLS_TX_ZEROCOPY_SENDFILE;
 #  endif
 #endif
 
   /* HTTP defines strict framing for the client-side data,
      no risk of attack on server on unexpected connection interruption */
   /* ctx_opts |= SSL_OP_IGNORE_UNEXPECTED_EOF; */ // TODO: recheck
 
   /* There is no reason to use re-negotiation with HTTP */
   ctx_opts |= SSL_OP_NO_RENEGOTIATION;
 
   /* Do not use TLS 1.3 resumption for now */
   ctx_opts |= SSL_OP_NO_TICKET;
 
   (void)SSL_CTX_set_options (d_tls->ctx,
                              ctx_opts);
 
   /* Prevent interactive password prompts */
   SSL_CTX_set_default_passwd_cb (d_tls->ctx,
                                  &null_passwd_cb);
 
   // TODO: make the setting configurable
   /* SSL_CTX_set_security_level (d_tls->ctx, 0); */
 
   /* recv()- and send()-related options */
   (void)SSL_CTX_set_mode (d_tls->ctx,
                           SSL_MODE_ENABLE_PARTIAL_WRITE
                           | SSL_MODE_AUTO_RETRY);
   (void)SSL_CTX_clear_mode (d_tls->ctx,
                             SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER
                             | SSL_MODE_ASYNC);
 
   SSL_CTX_set_read_ahead (d_tls->ctx,
                           !0);
 
   /* ALPN and NPN */
   // TODO: use daemon option to disable ALPN
   // TODO: use daemon option to select protocols for ALPN
 #ifdef MHD_SUPPORT_HTTP2
   if (1 /* enabled both HTTP/2 and HTTP/1.x */)
   {
     d_tls->alpn_prots = alpn_list_http2_1x;
     d_tls->alpn_prots_size = sizeof(alpn_list_http2_1x);
   }
   else if (0 /* HTTP/2 only */)
   {
     d_tls->alpn_prots = alpn_list_http2_only;
     d_tls->alpn_prots_size = sizeof(alpn_list_http2_only);
   }
   else
 #endif /* MHD_SUPPORT_HTTP2 */
   if (1 /* HTTP/1.x only */)
   {
     d_tls->alpn_prots = alpn_list_http1x_only;
     d_tls->alpn_prots_size = sizeof(alpn_list_http1x_only);
   }
   else
   {
     mhd_UNREACHABLE ();
   }
   SSL_CTX_set_alpn_select_cb (d_tls->ctx,
                               &select_alpn_prot,
                               d_tls);
 #ifdef mhd_USE_OPENSSL_CLIENT_HELLO_GET0_EXT
   /* The ACME ALPN challenge is detected by the ClientHello message.
      The callback is set unconditionally as OpenSSL does not allow to set
      it on connection (session) basis. */
   SSL_CTX_set_client_hello_cb (d_tls->ctx,
                                &check_clnt_hello_cb,
                                d_tls);
 #endif /* mhd_USE_OPENSSL_CLIENT_HELLO_GET0_EXT */
 #ifndef OPENSSL_NO_NEXTPROTONEG
   SSL_CTX_set_next_protos_advertised_cb (d_tls->ctx,
                                          &get_npn_list,
                                          d_tls);
 #endif /* ! OPENSSL_NO_NEXTPROTONEG */
 
   return MHD_SC_OK;
 }
 
 
 /**
  * De-initialise TLS server context
  * @param d_tls the daemon TLS settings
  */
 static MHD_FN_PAR_NONNULL_ALL_ void
 daemon_deinit_ctx (struct mhd_TlsOpenDaemonData *restrict d_tls)
 {
   mhd_assert (NULL != d_tls->ctx);
   SSL_CTX_free (d_tls->ctx);
 }
 
 
 /**
  * Load the certificates chain from the OpenSSL BIO
  * @param d the daemon handle
  * @param d_tls the daemon TLS settings
  * @param bio the certificates chain data opened in OpenSSL BIO
  * @return #MHD_SC_OK on success,
  *         error code otherwise
  */
 static MHD_FN_PAR_NONNULL_ALL_ MHD_FN_MUST_CHECK_RESULT_ enum MHD_StatusCode
 daemon_load_certs_chain_obio (struct MHD_Daemon *restrict d,
                               struct mhd_TlsOpenDaemonData *restrict d_tls,
                               BIO *restrict bio)
 {
   enum MHD_StatusCode ret;
   X509 *cert;
 
   ret = MHD_SC_OK;
 
   /* The certificate object must be pre-allocated to associate it with
    * the lib context */
   cert = X509_new_ex (d_tls->libctx,
                       NULL);
   if (NULL == cert)
   {
     mhd_DBG_PRINT_TLS_ERRS ();
     mhd_LOG_MSG (d, MHD_SC_TLS_DAEMON_INIT_FAILED, \
                  "Failed to create new certificate object");
     return MHD_SC_TLS_DAEMON_INIT_FAILED;
   }
 
   if (NULL == PEM_read_bio_X509_AUX (bio,
                                      &cert,
                                      &null_passwd_cb,
                                      NULL))
   {
     mhd_DBG_PRINT_TLS_ERRS ();
     mhd_LOG_MSG (d, MHD_SC_TLS_DAEMON_INIT_FAILED, \
                  "Failed to process the certificate");
     ret = MHD_SC_TLS_DAEMON_INIT_FAILED;
   }
   else
   {
     if (0 >= SSL_CTX_use_certificate (d_tls->ctx,
                                       cert))
     {
       mhd_DBG_PRINT_TLS_ERRS ();
       mhd_LOG_MSG (d, MHD_SC_TLS_DAEMON_INIT_FAILED, \
                    "Failed to set the certificate");
       ret = MHD_SC_TLS_DAEMON_INIT_FAILED;
     }
     else
     {
       if (0 != ERR_peek_error ())
         mhd_DBG_PRINT_TLS_ERRS ();
     }
   }
   /* Free certificate: if it was successfully read, it has been "copied" to CTX */
   X509_free (cert);
   if (MHD_SC_OK != ret)
     return ret;
 
   do
   {
     X509 *inter_ca; /* Certifying certificate */
     inter_ca = X509_new_ex (d_tls->libctx,
                             NULL);
     if (NULL == inter_ca)
     {
       mhd_DBG_PRINT_TLS_ERRS ();
       mhd_LOG_MSG (d, MHD_SC_TLS_DAEMON_INIT_FAILED, \
                    "Failed to create new chain certificate object");
       return MHD_SC_TLS_DAEMON_INIT_FAILED;
     }
     if (NULL == PEM_read_bio_X509 (bio,
                                    &inter_ca,
                                    &null_passwd_cb,
                                    NULL))
     {
       unsigned long err;
       err = ERR_peek_last_error ();
 
       mhd_NOWARN_USED_UNUSED
 
       if ((ERR_LIB_PEM == ERR_GET_LIB (err))
           && (PEM_R_NO_START_LINE == ERR_GET_REASON (err)))
       {
         /* End of data */
         ERR_clear_error ();
         X509_free (inter_ca); /* Empty, not needed */
 
         mhd_assert (MHD_SC_OK == ret);
         return MHD_SC_OK; /* Success exit point */
       }
 
       mhd_RESTORE_WARN_USED_UNUSED
       mhd_DBG_PRINT_TLS_ERRS ();
 
       mhd_LOG_MSG (d, MHD_SC_TLS_DAEMON_INIT_FAILED, \
                    "Failed to load next object in the certificates " \
                    "chain");
       ret = MHD_SC_TLS_DAEMON_INIT_FAILED;
     }
     else
     {
       if (SSL_CTX_add0_chain_cert (d_tls->ctx,
                                    inter_ca))
       {
         /* Success, do not free the certificate as
          * function '_add0_' was used to add it. */
         /* Read the next certificate in the chain. */
         continue;
       }
 
       mhd_DBG_PRINT_TLS_ERRS ();
       mhd_LOG_MSG (d, MHD_SC_TLS_DAEMON_INIT_FAILED, \
                    "Failed to add the new certificate object "
                    "to the chain");
       ret = MHD_SC_TLS_DAEMON_INIT_FAILED;
     }
 
     X509_free (inter_ca); /* Failed, the object is not needed */
     mhd_assert (MHD_SC_OK != ret);
   } while (MHD_SC_OK == ret);
   mhd_assert (MHD_SC_OK != ret);
   return ret;
 }
 
 
 /**
  * Load the certificates chain based on application-provided settings
  * @param d the daemon handle
  * @param d_tls the daemon TLS settings
  * @param s the application-provided settings
  * @return #MHD_SC_OK on success,
  *         error code otherwise
  */
 static MHD_FN_PAR_NONNULL_ALL_ MHD_FN_MUST_CHECK_RESULT_ enum MHD_StatusCode
 daemon_load_certs_chain (struct MHD_Daemon *restrict d,
                          struct mhd_TlsOpenDaemonData *restrict d_tls,
                          struct DaemonOptions *restrict s)
 {
   enum MHD_StatusCode ret;
   BIO *m_bio;
 
   mhd_assert (NULL != d_tls->libctx);
   mhd_assert (NULL != d_tls->ctx);
 
   ERR_clear_error ();
 
   m_bio = BIO_new_mem_buf (s->tls_cert_key.v_mem_cert,
                            -1);
   if (NULL == m_bio)
   {
     mhd_DBG_PRINT_TLS_ERRS ();
     return MHD_SC_DAEMON_MEM_ALLOC_FAILURE;
   }
   ret = daemon_load_certs_chain_obio (d,
                                       d_tls,
                                       m_bio);
   BIO_free (m_bio);
   return ret;
 }
 
 
 /**
  * Initialise TLS certificate
  * The function loads the certificate chain and the private key.
  * @param d the daemon handle
  * @param d_tls the daemon TLS settings
  * @param s the application-provided settings
  * @return #MHD_SC_OK on success,
  *         error code otherwise
  */
 static MHD_FN_PAR_NONNULL_ALL_ MHD_FN_MUST_CHECK_RESULT_ enum MHD_StatusCode
 daemon_init_cert (struct MHD_Daemon *restrict d,
                   struct mhd_TlsOpenDaemonData *restrict d_tls,
                   struct DaemonOptions *restrict s)
 {
   enum MHD_StatusCode ret;
   BIO *m_bio;
   EVP_PKEY *pr_key;
   int res_i;
   long res_l;
 
   mhd_assert (NULL != d_tls->libctx);
   mhd_assert (NULL != d_tls->ctx);
 
   ERR_clear_error ();
 
   ret = daemon_load_certs_chain (d,
                                  d_tls,
                                  s);
   if (MHD_SC_OK != ret)
     return ret;
 
   /* Check and cache the certificates chain.
      This also prevents automatic chain re-building for each session. */
   res_l =
     SSL_CTX_build_cert_chain (
       d_tls->ctx,
       SSL_BUILD_CHAIN_FLAG_CHECK /* Use only certificates in the chain */
       | SSL_BUILD_CHAIN_FLAG_UNTRUSTED /* Intermediate CA certs does not need to be trusted */
       | SSL_BUILD_CHAIN_FLAG_NO_ROOT /* The root CA should not be added to the chain */
       | SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR /* Allow the root CA to be not trusted */
       );
   if (0 >= res_l)
   {
     mhd_DBG_PRINT_TLS_ERRS ();
     mhd_LOG_MSG (d, MHD_SC_TLS_DAEMON_INIT_FAILED, \
                  "Failed rebuild certificate chain");
     return MHD_SC_TLS_DAEMON_INIT_FAILED;
   }
   if (2 == res_l)
     mhd_DBG_PRINT_TLS_ERRS ();
 
   m_bio = BIO_new_mem_buf (s->tls_cert_key.v_mem_key,
                            -1);
   if (NULL == m_bio)
   {
     mhd_DBG_PRINT_TLS_ERRS ();
     return MHD_SC_DAEMON_MEM_ALLOC_FAILURE;
   }
   pr_key =
     PEM_read_bio_PrivateKey_ex (m_bio,
                                 NULL,
                                 NULL == s->tls_cert_key.v_mem_pass ?
                                 &null_passwd_cb : NULL,
                                 mhd_DROP_CONST (s->tls_cert_key.v_mem_pass),
                                 d_tls->libctx,
                                 NULL);
   BIO_free (m_bio);
   if (NULL == pr_key)
   {
     mhd_DBG_PRINT_TLS_ERRS ();
     mhd_LOG_MSG (d, MHD_SC_TLS_DAEMON_INIT_FAILED, \
                  "Failed to read the private key");
     return MHD_SC_TLS_DAEMON_INIT_FAILED;
   }
 
   res_i = SSL_CTX_use_PrivateKey (d_tls->ctx,
                                   pr_key);
   EVP_PKEY_free (pr_key); /* The key has been "copied" or failed */
   if (1 != res_i)
   {
     mhd_DBG_PRINT_TLS_ERRS ();
     mhd_LOG_MSG (d, MHD_SC_TLS_DAEMON_INIT_FAILED, \
                  "Failed to set the private key");
     return MHD_SC_TLS_DAEMON_INIT_FAILED;
   }
   /* This actually RE-checks the key.
      The key should be already checked automatically when it was set after
      setting the certificate. */
   if (1 != SSL_CTX_check_private_key (d_tls->ctx))
   {
     mhd_DBG_PRINT_TLS_ERRS ();
     mhd_LOG_MSG (d, MHD_SC_TLS_DAEMON_INIT_FAILED, \
                  "The private key does not match the certificate");
     return MHD_SC_TLS_DAEMON_INIT_FAILED;
   }
 
   return MHD_SC_OK;
 }
 
 
 MHD_INTERNAL MHD_FN_MUST_CHECK_RESULT_ MHD_FN_PAR_NONNULL_ALL_
 MHD_FN_PAR_OUT_ (4) mhd_StatusCodeInt
 mhd_tls_open_daemon_init (struct MHD_Daemon *restrict d,
                           bool sk_edge_trigg,
                           struct DaemonOptions *restrict s,
                           struct mhd_TlsOpenDaemonData **restrict p_d_tls)
 {
   mhd_StatusCodeInt res;
   struct mhd_TlsOpenDaemonData *restrict d_tls;
 
   /* Successful initialisation must be checked earlier */
   mhd_assert (openssl_lib_inited);
 
   res = check_app_tls_settings (d, sk_edge_trigg, s);
   if (MHD_SC_OK != res)
     return res;
 
   d_tls = (struct mhd_TlsOpenDaemonData *)
           mhd_calloc (1, sizeof (struct mhd_TlsOpenDaemonData));
   *p_d_tls = d_tls;
   if (NULL == d_tls)
     return MHD_SC_DAEMON_MEM_ALLOC_FAILURE;
 
 #ifndef HAVE_NULL_PTR_ALL_ZEROS
   d_tls->libctx = NULL;
   d_tls->ctx = NULL;
   d_tls->alpn_prots = NULL;
 #  ifdef mhd_HAVE_OPENSSL_ACME
   d_tls->acme_certs = NULL;
 #  endif /* mhd_HAVE_OPENSSL_ACME */
 #endif /* ! HAVE_NULL_PTR_ALL_ZEROS */
 
 #ifdef mhd_HAVE_OPENSSL_ACME
   d_tls->acme_certs = mhd_daemon_get_acme_certs (d);
 #endif /* mhd_HAVE_OPENSSL_ACME */
 
   res = daemon_init_lib_ctx (d,
                              d_tls,
                              s);
   if (MHD_SC_OK == res)
   {
     res = daemon_init_ctx (d,
                            d_tls,
                            s);
     if (MHD_SC_OK == res)
     {
       res = daemon_init_cert (d,
                               d_tls,
                               s);
       if (MHD_SC_OK == res)
         return MHD_SC_OK; /* Success exit point */
 
       /* Below is a clean-up code path */
       daemon_deinit_ctx (d_tls);
     }
     daemon_deinit_lib_ctx (d_tls);
   }
   free (d_tls);
   *p_d_tls = NULL;
   mhd_assert (MHD_SC_OK != res);
   return res; /* Failure exit point */
 }
 
 
 MHD_INTERNAL MHD_FN_PAR_NONNULL_ALL_
 MHD_FN_PAR_INOUT_ (1) void
 mhd_tls_open_daemon_deinit (struct mhd_TlsOpenDaemonData *restrict d_tls)
 {
   mhd_assert (NULL != d_tls);
   daemon_deinit_ctx (d_tls);
   daemon_deinit_lib_ctx (d_tls);
   free (d_tls);
 }
 
 
 MHD_INTERNAL MHD_FN_PAR_NONNULL_ALL_
 MHD_FN_PAR_INOUT_ (1) void
 mhd_tls_open_thread_cleanup (struct mhd_TlsOpenDaemonData *restrict d_tls)
 {
   OPENSSL_thread_stop_ex (d_tls->libctx);
 }
 
 
 /* ** Credentials creation / destruction ** */
 
 #ifdef mhd_HAVE_OPENSSL_ACME
 
 /**
  * Read the end-entity certificate and the chain of the signing certificates
  * from the provided PEM data.
  * @param d_tls the pointer to the daemon's TLS settings
  * @param[in,out] cred the credentials data with the initialised (empty)
  *                     @a chain member, the @a cert member is set on success
  * @param cert_len the length of the @p cert buffer
  * @param cert the certificates data in PEM format
  * @return #mhd_TLS_CRED_CREATE_OK on success,
  *         other enum mhd_TlsCredCreateResult values on failure
  */
 static MHD_FN_PAR_NONNULL_ALL_ MHD_FN_MUST_CHECK_RESULT_
 MHD_FN_PAR_IN_SIZE_ (4, 3) enum mhd_TlsCredCreateResult
 cred_read_certs (struct mhd_TlsOpenDaemonData *restrict d_tls,
                  struct mhd_TlsOpenCredData *restrict cred,
                  int cert_len,
                  const char *restrict cert)
 {
   BIO *bio;
   enum mhd_TlsCredCreateResult res;
 
   mhd_assert (NULL == cred->cert);
   mhd_assert (NULL != cred->chain);
 
   res = mhd_TLS_CRED_CREATE_OK;
   bio = BIO_new_mem_buf (cert,
                          cert_len);
   if (NULL == bio)
   {
     mhd_DBG_PRINT_TLS_ERRS ();
     res = mhd_TLS_CRED_CREATE_ALLOC_FAILED;
   }
   else
   {
     cred->cert = X509_new_ex (d_tls->libctx,
                               NULL);
     if (NULL == cred->cert)
     {
       mhd_DBG_PRINT_TLS_ERRS ();
       res = mhd_TLS_CRED_CREATE_ALLOC_FAILED;
     }
     else
     {
       if (NULL == PEM_read_bio_X509_AUX (bio,
                                          &(cred->cert),
                                          &null_passwd_cb,
                                          NULL))
       {
         mhd_DBG_PRINT_TLS_ERRS ();
         res = mhd_TLS_CRED_CREATE_BAD_CRED_DATA;
       }
       else
       {
         do
         {
           X509 *inter_ca; /* Certifying certificate */
 
           inter_ca = X509_new_ex (d_tls->libctx,
                                   NULL);
           if (NULL == inter_ca)
           {
             mhd_DBG_PRINT_TLS_ERRS ();
             res = mhd_TLS_CRED_CREATE_ALLOC_FAILED;
             break;
           }
 
           if (NULL != PEM_read_bio_X509 (bio,
                                          &inter_ca,
                                          &null_passwd_cb,
                                          NULL))
           {
             mhd_NOWARN_USED_UNUSED
 
             if (0 < sk_X509_push (cred->chain,
                                   inter_ca))
             {
               /* The certificate 'inter_ca' is owned by the chain now.
                  Read the next certificate in the chain. */
               continue;
             }
 
             mhd_RESTORE_WARN_USED_UNUSED
 
             /* The cleanup path */
             res = mhd_TLS_CRED_CREATE_ALLOC_FAILED;
           }
           else
           {
             unsigned long err;
             err = ERR_peek_last_error ();
 
             mhd_NOWARN_USED_UNUSED
 
             if ((ERR_LIB_PEM == ERR_GET_LIB (err))
                 && (PEM_R_NO_START_LINE == ERR_GET_REASON (err)))
             {
               X509_free (inter_ca); /* Allocated but not used, not needed */
               ERR_clear_error (); /* End of data, all certificates are read */
               BIO_free (bio);
               return mhd_TLS_CRED_CREATE_OK; /* Success exit point */
             }
 
             /* The cleanup path */
             res = mhd_TLS_CRED_CREATE_BAD_CRED_DATA;
 
             mhd_RESTORE_WARN_USED_UNUSED
           }
           mhd_DBG_PRINT_TLS_ERRS ();
           mhd_assert (mhd_TLS_CRED_CREATE_OK != res);
           X509_free (inter_ca); /* Empty or unusable, not needed */
           break;
         } while (!0);
         mhd_assert (mhd_TLS_CRED_CREATE_OK != res);
       }
       X509_free (cred->cert);
     }
     BIO_free (bio);
   }
 
   mhd_assert (mhd_TLS_CRED_CREATE_OK != res);
   return res;
 }
 
 
 /**
  * Provide the application-supplied password for the private key.
  *
  * Unlike the OpenSSL built-in callback, this one uses the length known by MHD
  * instead of deriving it from the zero-termination and refuses to truncate
  * the password silently.
  * @param[out] buf the buffer to put the password to
  * @param size the size of the @a buf
  * @param rwflag not used, the password is used for decryption only
  * @param cls the pointer to the password string
  * @return the number of characters put to the @a buf,
  *         -1 if the password does not fit the @a buf
  */
 static int
 mem_passwd_cb (char *buf,
                int size,
                int rwflag,
                void *cls)
 {
   const struct MHD_String *const pass = (const struct MHD_String *)cls;
 
   (void)rwflag;  /* Unused */
 
   if ((0 > size) || (pass->len > (size_t)size))
     return -1; /* The password does not fit, do not truncate it silently */
 
   memcpy (buf,
           pass->cstr,
           pass->len);
   return (int)pass->len;
 }
 
 
 /**
  * Read the private key from the provided PEM data and check that it matches
  * the certificate.
  * @param d_tls the pointer to the daemon's TLS settings
  * @param[in,out] cred the credentials data with the set @a cert member,
  *                     the @a key member is set on success
  * @param key_len the length of the @p key buffer
  * @param key the private key data in PEM format
  * @param pass_len the length of the @p pass buffer, must be zero if the @p pass
  *                 is NULL
  * @param pass the password for the private key, zero-terminated,
  *             may be NULL
  * @return #mhd_TLS_CRED_CREATE_OK on success,
  *         other enum mhd_TlsCredCreateResult values on failure
  */
 static MHD_FN_PAR_NONNULL_ (1) MHD_FN_PAR_NONNULL_ (2)
 MHD_FN_PAR_NONNULL_ (4) MHD_FN_MUST_CHECK_RESULT_
 MHD_FN_PAR_IN_SIZE_ (4, 3) MHD_FN_PAR_IN_SIZE_ (6, 5) MHD_FN_PAR_CSTR_ (6)
 enum mhd_TlsCredCreateResult
 cred_read_key (struct mhd_TlsOpenDaemonData *restrict d_tls,
                struct mhd_TlsOpenCredData *restrict cred,
                int key_len,
                const char *restrict key,
                size_t pass_len,
                const char *restrict pass)
 {
   enum mhd_TlsCredCreateResult res;
   BIO *bio;
   EVP_PKEY *key_obj;
   struct MHD_String pass_str;
 
   mhd_assert (NULL != cred->cert);
   mhd_assert (NULL == cred->key);
   mhd_assert ((NULL != pass) || (0 == pass_len));
 
   res = mhd_TLS_CRED_CREATE_OK;
   pass_str.len = pass_len;
   pass_str.cstr = pass;
 
   bio = BIO_new_mem_buf (key,
                          key_len);
   if (NULL == bio)
   {
     mhd_DBG_PRINT_TLS_ERRS ();
     res = mhd_TLS_CRED_CREATE_ALLOC_FAILED;
   }
   else
   {
     key_obj =
       PEM_read_bio_PrivateKey_ex (bio,
                                   NULL,
                                   (NULL == pass) ? &null_passwd_cb :
                                   &mem_passwd_cb,
                                   (NULL == pass) ? NULL : &pass_str,
                                   d_tls->libctx,
                                   NULL);
     BIO_free (bio);
 
     if (NULL == key_obj)
     {
       mhd_DBG_PRINT_TLS_ERRS ();
       res = mhd_TLS_CRED_CREATE_BAD_CRED_DATA;
     }
     else
     {
       ERR_clear_error ();
       if (1 != X509_check_private_key (cred->cert,
                                        key_obj))
       {
         mhd_DBG_PRINT_TLS_ERRS ();
         res = mhd_TLS_CRED_CREATE_BAD_CRED_DATA;
       }
       else
       {
         ERR_clear_error ();
         cred->key = key_obj;
         return mhd_TLS_CRED_CREATE_OK; /* Success exit point */
       }
       EVP_PKEY_free (key_obj);
     }
   }
 
   return res; /* Failure exit point */
 }
 
 
 MHD_INTERNAL MHD_FN_MUST_CHECK_RESULT_
 MHD_FN_PAR_NONNULL_ (1) MHD_FN_PAR_NONNULL_ (2)
 MHD_FN_PAR_NONNULL_ (4) MHD_FN_PAR_NONNULL_ (6)
 MHD_FN_PAR_OUT_ (2)
 MHD_FN_PAR_IN_SIZE_ (4, 3) MHD_FN_PAR_IN_SIZE_ (6, 5)
 MHD_FN_PAR_IN_SIZE_ (8, 7)
 MHD_FN_PAR_CSTR_ (4) MHD_FN_PAR_CSTR_ (6) MHD_FN_PAR_CSTR_ (8)
 enum mhd_TlsCredCreateResult
 mhd_tls_open_cred_create (struct mhd_TlsOpenDaemonData *restrict d_tls,
                           union mhd_TlsCredDataPtr *restrict pp_cred,
                           size_t cert_len,
                           const char *restrict cert,
                           size_t key_len,
                           const char *restrict key,
                           size_t pass_len,
                           const char *restrict pass)
 {
   struct mhd_TlsOpenCredData *cred;
   enum mhd_TlsCredCreateResult res;
   int cert_len_i;
   int key_len_i;
 
   mhd_assert (0 != cert_len);
   mhd_assert (0 != key_len);
   mhd_assert ((NULL != pass) || (0 == pass_len));
 
   pp_cred->open = NULL;
 
   cert_len_i = (int)cert_len;
   key_len_i = (int)key_len;
   if (mhd_COND_HARDLY_EVER (cert_len != (size_t)cert_len_i)
       || mhd_COND_HARDLY_EVER (0 > cert_len_i)
       || mhd_COND_HARDLY_EVER (key_len != (size_t)key_len_i)
       || mhd_COND_HARDLY_EVER (0 > key_len_i))
     return mhd_TLS_CRED_CREATE_BAD_CRED_DATA; /* The data is too large */
 
   cred = (struct mhd_TlsOpenCredData *)
          mhd_calloc (1,
                      sizeof(struct mhd_TlsOpenCredData));
   if (NULL == cred)
     return mhd_TLS_CRED_CREATE_ALLOC_FAILED;
 
 #  ifndef NDEBUG
 #    ifndef HAVE_NULL_PTR_ALL_ZEROS
   cred->cert = NULL;
   cred->key = NULL;
   cred->chain = NULL;
 #    endif /* HAVE_NULL_PTR_ALL_ZEROS */
 #  endif /* NDEBUG */
 
   ERR_clear_error ();
   /* The chain is always allocated (and stays empty if no chain is provided) as
      the empty chain must replace the chain inherited from the daemon's context
      when the credentials are used for the connection. */
   cred->chain = sk_X509_new_null ();
   if (NULL == cred->chain)
   {
     mhd_DBG_PRINT_TLS_ERRS ();
     res = mhd_TLS_CRED_CREATE_ALLOC_FAILED;
   }
   else
   {
     ERR_clear_error ();
 
     res = cred_read_certs (d_tls,
                            cred,
                            cert_len_i,
                            cert);
     if (mhd_TLS_CRED_CREATE_OK == res)
     {
       res = cred_read_key (d_tls,
                            cred,
                            key_len_i,
                            key,
                            pass_len,
                            pass);
       if (mhd_TLS_CRED_CREATE_OK == res)
       {
         pp_cred->open = cred;
         return mhd_TLS_CRED_CREATE_OK; /* Success exit point */
       }
 
       /* Below is a clean-up code path */
       X509_free (cred->cert);
     }
     mhd_NOWARN_USED_UNUSED
     sk_X509_pop_free (cred->chain,
                       X509_free);
 
     mhd_RESTORE_WARN_USED_UNUSED
   }
 
   free (cred);
   mhd_assert (mhd_TLS_CRED_CREATE_OK != res);
   return res; /* Failure exit point */
 }
 
 
 MHD_INTERNAL void
 mhd_tls_open_cred_destroy_nodmn (union mhd_TlsCredDataPtr cred)
 {
   mhd_ASSUME (NULL != cred.open);
   mhd_assert (NULL != cred.open->key);
   mhd_assert (NULL != cred.open->cert);
   mhd_assert (NULL != cred.open->chain);
 
   /* Release in the reverse order of the creation.
      The objects still used by any TLS session or context are not destroyed
      here as OpenSSL holds its own references for them. */
   EVP_PKEY_free (cred.open->key);
   X509_free (cred.open->cert);
   mhd_NOWARN_USED_UNUSED
   sk_X509_pop_free (cred.open->chain,
                     &X509_free);
 
   mhd_RESTORE_WARN_USED_UNUSED
   free (cred.open);
 
 }
 
 
 #endif /* mhd_HAVE_OPENSSL_ACME */
 
 
 /* ** Connection initialisation / de-initialisation ** */
 
 MHD_INTERNAL size_t
 mhd_tls_open_conn_get_tls_size_v (void)
 {
   return sizeof (struct mhd_TlsOpenConnData);
 }
 
 
 #ifdef mhd_HAVE_OPENSSL_ACME
 /**
  * Prepare the connection data for the detection of the ACME ALPN challenge
  * @param d_tls the daemon TLS settings
  * @param[in,out] c_tls the connection TLS handle with the initialised session
  * @return 'true' on success,
  *         'false' otherwise
  */
 static MHD_FN_PAR_NONNULL_ALL_ MHD_FN_MUST_CHECK_RESULT_ bool
 conn_init_acme_data (const struct mhd_TlsOpenDaemonData *restrict d_tls,
                      struct mhd_TlsOpenConnData *restrict c_tls)
 {
   bool res;
 
   /* c_tls is created by calloc(), all bool member must be 'false' */
   mhd_assert (!c_tls->clienthello_processed);
   mhd_assert (!c_tls->is_acme);
 
   /* The additional context for ClientHello and ALPN callbacks */
   res = (0 != SSL_set_ex_data (c_tls->sess,
                                conn_mhd_ctls_idx,
                                c_tls));
 
 #  ifdef mhd_USE_OPENSSL_CLIENT_HELLO_GET0_EXT
   (void)d_tls;   /* Unused, the ClientHello callback is set for the context */
 #  else  /* ! mhd_USE_OPENSSL_CLIENT_HELLO_GET0_EXT */
   /* Conditionally process ClientHello message - only if any ACME certificates
     are present */
   if (res
       && (mhd_daemon_has_acme_certs (d_tls->acme_certs)))
   {
     /* The unparsed ClientHello message is provided only by the messages
        callback */
     (void)SSL_set_msg_callback_arg (c_tls->sess,  /* does not actually return a value */
                                     d_tls->acme_certs);
     SSL_set_msg_callback (c_tls->sess,
                           &check_hello_msg_acme);
   }
 #  endif /* ! mhd_USE_OPENSSL_CLIENT_HELLO_GET0_EXT */
   return res;
 }
 
 
 #else  /* ! mhd_HAVE_OPENSSL_ACME */
 #  define conn_init_acme_data(d_tls, c_tls) \
         (((void) (d_tls)), ((void) (c_tls)), (! 0))
 #endif /* ! mhd_HAVE_OPENSSL_ACME */
 
 MHD_INTERNAL MHD_FN_MUST_CHECK_RESULT_ MHD_FN_PAR_NONNULL_ALL_
 MHD_FN_PAR_OUT_ (3) bool
 mhd_tls_open_conn_init (const struct mhd_TlsOpenDaemonData *restrict d_tls,
                         const struct mhd_ConnSocket *sk,
                         struct mhd_TlsOpenConnData *restrict c_tls)
 {
   int fd;
 
   ERR_clear_error ();
 
   fd = (int)sk->fd;
   if (sk->fd != (MHD_Socket)fd)
     return false; /* OpenSSL docs clam that it should not be possible */
 
   c_tls->sess = SSL_new (d_tls->ctx);
 
   if (NULL == c_tls->sess)
   {
     mhd_DBG_PRINT_TLS_ERRS ();
     return false;
   }
 
   if ((0 < SSL_set_fd (c_tls->sess, fd))
       && conn_init_acme_data (d_tls,
                               c_tls))
   {
     SSL_set_accept_state (c_tls->sess); /* Force server mode */
 
 #ifndef NDEBUG
     c_tls->dbg.is_inited = true;
 #endif
     return true; /* Success exit point */
   }
 
   SSL_free (c_tls->sess);
   c_tls->sess = NULL;
   return false;
 }
 
 
 MHD_INTERNAL MHD_FN_PAR_NONNULL_ALL_ void
 mhd_tls_open_conn_deinit (struct mhd_TlsOpenConnData *restrict c_tls)
 {
   mhd_assert (NULL != c_tls->sess);
   mhd_assert (c_tls->dbg.is_inited);
   SSL_free (c_tls->sess);
 }
 
 
 /* ** TLS connection establishing ** */
 
 MHD_INTERNAL MHD_FN_MUST_CHECK_RESULT_ MHD_FN_PAR_NONNULL_ALL_
 enum mhd_TlsProcedureResult
 mhd_tls_open_conn_handshake (struct mhd_TlsOpenConnData *restrict c_tls)
 {
   int res;
 
   mhd_assert (c_tls->dbg.is_inited);
   mhd_assert (!c_tls->dbg.is_tls_handshake_completed);
   mhd_assert (!c_tls->shut_tls_wr_sent);
   mhd_assert (!c_tls->shut_tls_wr_received);
   mhd_assert (!c_tls->dbg.is_failed);
 
   ERR_clear_error ();
 
   res = SSL_do_handshake (c_tls->sess);
 
   if (1 == res)
   {
 #ifndef NDEBUG
     c_tls->dbg.is_tls_handshake_completed = true;
 #endif /* ! NDEBUG */
     return mhd_TLS_PROCED_SUCCESS; /* Success exit point */
   }
 
   switch (SSL_get_error (c_tls->sess, res))
   {
   case SSL_ERROR_WANT_READ:
     /* OpenSSL does not distinguish between "interrupted" and "try again" codes.
        Based on OpenSSL result it is unclear whether the "recv-ready" flag
        should be reset or not.
        If edge-triggered sockets polling is used and the flag is cleared, but
        it should not (because the process has been "interrupted") then already
        pending data could be never processed.
        If the flag is not cleared, but it should be cleared (because all
        received data has been processed) then it would create busy-waiting loop
        with edge-triggered sockets polling.
        Temporal solution: disallow edge-triggered sockets polling with OpenSSL
        backend and use clear of "ready" flag. */
     // TODO: replace "BIO" with custom version and track returned errors.
     return mhd_TLS_PROCED_SEND_MORE_NEEDED;
   case SSL_ERROR_WANT_WRITE:
     /* OpenSSL does not distinguish between "interrupted" and "try again" codes.
        Based on OpenSSL result it is unclear whether the "send-ready" flag
        should be reset or not.
        If edge-triggered sockets polling is used and the flag is cleared, but
        it should not (because the process has been "interrupted") then already
        pending data could be never sent.
        If the flag is not cleared, but it should be cleared (because all
        received data has been processed) then it would create busy-waiting loop
        with edge-triggered sockets polling.
        Temporal solution: disallow edge-triggered sockets polling with OpenSSL
        backend and use clear of "ready" flag. */
     // TODO: replace "BIO" with custom version and track returned errors.
     return mhd_TLS_PROCED_RECV_MORE_NEEDED;
   case SSL_ERROR_NONE:
     mhd_assert (0 && "This should not be possible");
     mhd_UNREACHABLE ();
     break;
   default: /* Handled with all other errors below */
     break;
   }
   mhd_DBG_PRINT_TLS_ERRS ();
 #ifndef NDEBUG
   c_tls->dbg.is_failed = true;
 #endif /* ! NDEBUG */
   return mhd_TLS_PROCED_FAILED;
 }
 
 
 MHD_INTERNAL MHD_FN_MUST_CHECK_RESULT_ MHD_FN_PAR_NONNULL_ALL_
 enum mhd_TlsProcedureResult
 mhd_tls_open_conn_shutdown (struct mhd_TlsOpenConnData *restrict c_tls)
 {
   int res;
 
   mhd_assert (c_tls->dbg.is_inited);
   mhd_assert (c_tls->dbg.is_tls_handshake_completed);
   mhd_assert (!c_tls->dbg.is_failed);
 
   ERR_clear_error ();
 
   res = SSL_shutdown (c_tls->sess);
 
   if (1 == res)
   {
     c_tls->shut_tls_wr_sent = true;
     c_tls->shut_tls_wr_received = true;
     return mhd_TLS_PROCED_SUCCESS; /* Success exit point */
   }
 
   /* The OpenSSL documentation contradicts itself: there are two mutually
      exclusive statements on a single page.
    * https://docs.openssl.org/master/man3/SSL_shutdown/#shutdown-lifecycle
      indicates that for nonblocking socket ZERO could be returned when
      "close_notify" is GOING to be sent, but NOT sent yet.
      It also suggests to CALL SSL_get_error(3) when ZERO is returned.
    * https://docs.openssl.org/master/man3/SSL_shutdown/#return-values
      indicates ZERO is returned ONLY when "close_notify" HAS BEEN sent.
      It also suggests to NOT CALL SSL_get_error(3) when ZERO is returned.
    */
   switch (SSL_get_error (c_tls->sess, res))
   {
   case SSL_ERROR_WANT_READ:
     /* OpenSSL does not distinguish between "interrupted" and "try again" codes.
        Based on OpenSSL result it is unclear whether the "recv-ready" flag
        should be reset or not.
        If edge-triggered sockets polling is used and the flag is cleared, but
        it should not (because the process has been "interrupted") then already
        pending data could be never processed.
        If the flag is not cleared, but it should be cleared (because all
        received data has been processed) then it would create busy-waiting loop
        with edge-triggered sockets polling.
        Temporal solution: disallow edge-triggered sockets polling with OpenSSL
        backend and use clear of "ready" flag. */
     // TODO: replace "BIO" with custom version and track returned errors.
     return mhd_TLS_PROCED_SEND_MORE_NEEDED;
   case SSL_ERROR_WANT_WRITE:
     c_tls->shut_tls_wr_sent = true;
     /* OpenSSL does not distinguish between "interrupted" and "try again" codes.
        Based on OpenSSL result it is unclear whether the "send-ready" flag
        should be reset or not.
        If edge-triggered sockets polling is used and the flag is cleared, but
        it should not (because the process has been "interrupted") then already
        pending data could be never sent.
        If the flag is not cleared, but it should be cleared (because all
        received data has been processed) then it would create busy-waiting loop
        with edge-triggered sockets polling.
        Temporal solution: disallow edge-triggered sockets polling with OpenSSL
        backend and use clear of "ready" flag. */
     // TODO: replace "BIO" with custom version and track returned errors.
     return mhd_TLS_PROCED_RECV_MORE_NEEDED;
   case SSL_ERROR_NONE:
     mhd_assert (res != 0 && "Should not be possible");
     c_tls->shut_tls_wr_sent = true;
     return mhd_TLS_PROCED_RECV_INTERRUPTED;
   default: /* Handled with all other errors below */
     break;
   }
   mhd_DBG_PRINT_TLS_ERRS ();
 #ifndef NDEBUG
   c_tls->dbg.is_failed = true;
 #endif /* ! NDEBUG */
   return mhd_TLS_PROCED_FAILED;
 }
 
 
 /* ** Data receiving and sending ** */
 
 MHD_INTERNAL MHD_FN_PAR_NONNULL_ALL_
 MHD_FN_PAR_OUT_SIZE_ (3, 2)
 MHD_FN_PAR_OUT_ (4) enum mhd_SocketError
 mhd_tls_open_conn_recv (struct mhd_TlsOpenConnData *restrict c_tls,
                         size_t buf_size,
                         char buf[MHD_FN_PAR_DYN_ARR_SIZE_ (buf_size)],
                         size_t *restrict received)
 {
   int res;
 
   mhd_assert (c_tls->dbg.is_inited);
   mhd_assert (c_tls->dbg.is_tls_handshake_completed);
   mhd_assert (!c_tls->shut_tls_wr_sent);
   mhd_assert (!c_tls->dbg.is_failed);
 #ifdef mhd_HAVE_OPENSSL_ACME
   mhd_assert (!c_tls->is_acme); /* ACME ALPN challenge connection is not used
                                    for the data exchange */
 #endif /* mhd_HAVE_OPENSSL_ACME */
 
   ERR_clear_error ();
 
   res = SSL_read_ex (c_tls->sess,
                      buf,
                      buf_size,
                      received);
   if (1 == res)
   {
     mhd_assert (0 != *received);
     return mhd_SOCKET_ERR_NO_ERROR; /* Success exit point */
   }
 
   mhd_assert (0 == res);
   *received = 0;
   switch (SSL_get_error (c_tls->sess, res))
   {
   case SSL_ERROR_ZERO_RETURN: /* Not an error */
     c_tls->shut_tls_wr_received = true;
     return mhd_SOCKET_ERR_NO_ERROR;   /* Success exit point */
   case SSL_ERROR_WANT_READ:
     /* OpenSSL does not distinguish between "interrupted" and "try again" codes.
        Based on OpenSSL result it is unclear whether the "recv-ready" flag
        should be reset or not.
        If edge-triggered sockets polling is used and the flag is cleared, but
        it should not (because the process has been "interrupted") then already
        pending data could be never processed.
        If the flag is not cleared, but it should be cleared (because all
        received data has been processed) then it would create busy-waiting loop
        with edge-triggered sockets polling.
        Temporal solution: disallow edge-triggered sockets polling with OpenSSL
        backend and use clear of "ready" flag. */
     // TODO: replace "BIO" with custom version and track returned errors.
     return mhd_SOCKET_ERR_AGAIN;
   case SSL_ERROR_NONE:
     mhd_assert (0 && "Should not be possible");
     break;
   case SSL_ERROR_WANT_WRITE:
     mhd_assert (0 && "Should not be possible as re-handshakes are disallowed");
     break;
   case SSL_ERROR_SYSCALL:
     mhd_DBG_PRINT_TLS_ERRS ();
 #ifndef NDEBUG
     c_tls->dbg.is_failed = true;
 #endif /* ! NDEBUG */
     return mhd_SOCKET_ERR_CONN_BROKEN;
   case SSL_ERROR_SSL:
   default:
     break;
   }
   /* Treat all other kinds of errors as hard errors */
   mhd_DBG_PRINT_TLS_ERRS ();
 #ifndef NDEBUG
   c_tls->dbg.is_failed = true;
 #endif /* ! NDEBUG */
   return mhd_SOCKET_ERR_TLS;
 }
 
 
 MHD_INTERNAL MHD_FN_PAR_NONNULL_ALL_ bool
 mhd_tls_open_conn_has_data_in (struct mhd_TlsOpenConnData *restrict c_tls)
 {
   return 0 != SSL_pending (c_tls->sess);
 }
 
 
 MHD_INTERNAL MHD_FN_PAR_NONNULL_ALL_
 MHD_FN_PAR_IN_SIZE_ (3, 2)
 MHD_FN_PAR_OUT_ (4) enum mhd_SocketError
 mhd_tls_open_conn_send4 (struct mhd_TlsOpenConnData *restrict c_tls,
                          size_t buf_size,
                          const char buf[MHD_FN_PAR_DYN_ARR_SIZE_ (buf_size)],
                          size_t *restrict sent)
 {
   int res;
 
   mhd_assert (c_tls->dbg.is_inited);
   mhd_assert (c_tls->dbg.is_tls_handshake_completed);
   mhd_assert (!c_tls->shut_tls_wr_sent);
   mhd_assert (!c_tls->dbg.is_failed);
 #ifdef mhd_HAVE_OPENSSL_ACME
   mhd_assert (!c_tls->is_acme); /* ACME ALPN challenge connection is not used
                                    for the data exchange */
 #endif /* mhd_HAVE_OPENSSL_ACME */
 
   ERR_clear_error ();
 
   res = SSL_write_ex (c_tls->sess,
                       buf,
                       buf_size,
                       sent);
   if (1 == res)
   {
     mhd_assert (0 != *sent);
     return mhd_SOCKET_ERR_NO_ERROR; /* Success exit point */
   }
 
   mhd_assert (0 == res);
   *sent = 0;
   switch (SSL_get_error (c_tls->sess, res))
   {
   case SSL_ERROR_WANT_WRITE:
     /* OpenSSL does not distinguish between "interrupted" and "try again" codes.
        Based on OpenSSL result it is unclear whether the "send-ready" flag
        should be reset or not.
        If edge-triggered sockets polling is used and the flag is cleared, but
        it should not (because the process has been "interrupted") then already
        pending data could be never sent.
        If the flag is not cleared, but it should be cleared (because all
        received data has been processed) then it would create busy-waiting loop
        with edge-triggered sockets polling.
        Temporal solution: disallow edge-triggered sockets polling with OpenSSL
        backend and use clear of "ready" flag. */
     // TODO: replace "BIO" with custom version and track returned errors.
     return mhd_SOCKET_ERR_AGAIN;
   case SSL_ERROR_NONE:
     mhd_assert (0 && "Should not be possible");
     break;
   case SSL_ERROR_WANT_READ:
     mhd_assert (0 && "Should not be possible as re-handshakes are disallowed");
     break;
   case SSL_ERROR_ZERO_RETURN:
     c_tls->shut_tls_wr_received = true;
     return mhd_SOCKET_ERR_AGAIN;
   case SSL_ERROR_SYSCALL:
     mhd_DBG_PRINT_TLS_ERRS ();
 #ifndef NDEBUG
     c_tls->dbg.is_failed = true;
 #endif /* ! NDEBUG */
     return mhd_SOCKET_ERR_CONN_BROKEN;
   case SSL_ERROR_SSL:
   default:
     break;
   }
   /* Treat all other kinds of errors as hard errors */
   mhd_DBG_PRINT_TLS_ERRS ();
 #ifndef NDEBUG
   c_tls->dbg.is_failed = true;
 #endif /* ! NDEBUG */
   return mhd_SOCKET_ERR_TLS;
 }
 
 
 /* ** TLS connection information ** */
 
 MHD_INTERNAL MHD_FN_PAR_NONNULL_ALL_
 MHD_FN_PAR_OUT_ (2) void
 mhd_tls_open_conn_get_tls_sess (
   struct mhd_TlsOpenConnData *restrict c_tls,
   union MHD_ConnInfoDynamicTlsSess *restrict tls_sess_out)
 {
   tls_sess_out->v_openssl_session = c_tls->sess;
 }
 
 
 MHD_INTERNAL MHD_FN_PAR_NONNULL_ALL_
 MHD_FN_PAR_OUT_ (2) bool
 mhd_tls_open_conn_get_tls_ver (struct mhd_TlsOpenConnData *restrict c_tls,
                                struct mhd_StctTlsVersion *restrict tls_ver_out)
 {
   int openssl_tls_ver;
 
   mhd_assert (c_tls->dbg.is_tls_handshake_completed);
 
   openssl_tls_ver = SSL_version (c_tls->sess);
   switch (openssl_tls_ver)
   {
   case TLS1_VERSION:
     tls_ver_out->tls_ver = MHD_TLS_VERSION_1_0;
     break;
   case TLS1_1_VERSION:
     tls_ver_out->tls_ver = MHD_TLS_VERSION_1_1;
     break;
   case TLS1_2_VERSION:
     tls_ver_out->tls_ver = MHD_TLS_VERSION_1_2;
     break;
   case TLS1_3_VERSION:
     tls_ver_out->tls_ver = MHD_TLS_VERSION_1_3;
     break;
   case SSL3_VERSION:
   default:
     tls_ver_out->tls_ver = MHD_TLS_VERSION_UNKNOWN;
     break;
   }
 
   return true;
 }
 
 
 MHD_INTERNAL MHD_FN_PAR_NONNULL_ALL_ enum mhd_TlsAlpnProt
 mhd_tls_open_conn_get_alpn_prot (struct mhd_TlsOpenConnData *restrict c_tls)
 {
   const unsigned char *sel_prot;
   unsigned int sel_prot_len;
 #ifdef mhd_HAVE_OPENSSL_ACME
   mhd_assert (!c_tls->is_acme);
 #endif /* mhd_HAVE_OPENSSL_ACME */
 
   SSL_get0_alpn_selected (c_tls->sess,
                           &sel_prot,
                           &sel_prot_len);
 
 #ifndef OPENSSL_NO_NEXTPROTONEG
   if ((NULL == sel_prot)
       || (0 == sel_prot_len))
   {
     SSL_get0_next_proto_negotiated (c_tls->sess,
                                     &sel_prot,
                                     &sel_prot_len);
   }
 #endif /* ! OPENSSL_NO_NEXTPROTONEG */
 
   mhd_assert (sel_prot_len == (size_t)sel_prot_len);
 
   return mhd_tls_alpn_decode_n ((size_t)sel_prot_len,
                                 sel_prot);
 }
 
 
 #ifdef mhd_HAVE_TLS_ACME
 #  ifdef mhd_HAVE_OPENSSL_ACME
 MHD_INTERNAL MHD_FN_PAR_NONNULL_ALL_ bool
 mhd_tls_open_conn_is_acme (struct mhd_TlsOpenConnData *restrict c_tls)
 {
   return c_tls->is_acme;
 }
 
 
 #  endif /* mhd_HAVE_OPENSSL_ACME */
 #endif /* mhd_HAVE_TLS_ACME */