# HG changeset patch
# User Alain Mazy <am@orthanc.team>
# Date 1716287301 -7200
# Node ID 5db4ed395d8155acf21378770fe11a04adae97bb
# Parent  cfb67c7ccb4d367644a7cf4c3e76b179c46a0dbe# Parent  3b7fb32ecbb01d19909fd049ecd8a03e8aead72d
merge

diff -r 3b7fb32ecbb0 -r 5db4ed395d81 NEWS
--- a/NEWS	Fri May 17 13:23:58 2024 +0200
+++ b/NEWS	Tue May 21 12:28:21 2024 +0200
@@ -42,8 +42,15 @@
   creating a ZIP archive.
 * Monitoring of stable resources now also takes into consideration the
   resource type, not only the resource identifier identifier.
-* When working with "DicomTlsEnabled": true and "DicomTlsRemoteCertificateRequired": false,
-  Orthanc was refusing to start if no "DicomTlsTrustedCertificates" was provided.
+* DICOM TLS:
+  * In prior versions, when "DicomTlsRemoteCertificateRequired" was set to false, Orthanc
+    was still sending a client certificate request during the TLS handshake but was not triggering
+    and error if the client certificate was not trusted (equivalent to the --verify-peer-cert DCMTK option)
+    From this version, if this option is set to false, Orthanc will not send a 
+    client certificate request during the TLS handshake anymore (equivalent to the --ignore-peer-cert 
+    DCMTK option).
+  * When working with "DicomTlsEnabled": true and "DicomTlsRemoteCertificateRequired": false,
+    Orthanc was refusing to start if no "DicomTlsTrustedCertificates" was provided.
 * Upgraded dependencies for static builds:
   - boost 1.85.0
 
diff -r 3b7fb32ecbb0 -r 5db4ed395d81 OrthancFramework/Sources/DicomNetworking/Internals/DicomTls.cpp
--- a/OrthancFramework/Sources/DicomNetworking/Internals/DicomTls.cpp	Fri May 17 13:23:58 2024 +0200
+++ b/OrthancFramework/Sources/DicomNetworking/Internals/DicomTls.cpp	Tue May 21 12:28:21 2024 +0200
@@ -28,7 +28,6 @@
 #include "../../OrthancException.h"
 #include "../../SystemToolbox.h"
 
-
 #if DCMTK_VERSION_NUMBER < 364
 #  define DCF_Filetype_PEM  SSL_FILETYPE_PEM
 #  if OPENSSL_VERSION_NUMBER >= 0x0090700fL
@@ -180,8 +179,8 @@
       }
       else
       {
-        // Check remote certificate if present, succeed if no certificate is present
-        tls->setCertificateVerification(DCV_checkCertificate /*opt_certVerification*/);
+        // From 1.12.4, do not even request remote certificate (prior to 1.12.4, we were requesting a certificates, checking it if present and succeeding if not present)
+        tls->setCertificateVerification(DCV_ignoreCertificate /*opt_certVerification*/);
       }
       
       if (ASC_setTransportLayer(network, tls.get(), 0).bad())