title: HTTPS client and server together using C++ and POCO libraries (SSL context issues)?
body: <p>I'm working on a C++ project which will need to both consume and provide RESTful HTTPS web services (isn't that a lovely combination!) and have chosen the POCO libraries to make it work (for license, platform support, and ease of use/adaptability reasons I won't go into here).  I am new to POCO and to OpenSSL which it uses to provide HTTPS functionality.</p>
  
  <p>The issue I've run into is that it seems that the SSLManager and Context classes (from POCO's NetSSL_OpenSSL library) only support either client or server contexts but not both.  I've tested that this is the case with a simple HTTPS client and server.  So I did some digging into the POCO code and for the SSLManager's part the server functionality seems to be a superset of the client functionality (so I could call the <code>initializeServer()</code> method on it and it should work).  Where I seem to be in trouble is the Context, which seems to server as a wrapper around an OpenSSL context structure (hold the Heartbleed jokes, please! :) ).  </p>
  
  <p>Now, after some more searching I came across <a href="http://h71000.www7.hp.com/doc/83final/ba554_90007/ch04s03.html" rel="nofollow" title="SSL Programming Tutorial">this page</a> which has a nice little table which explains to me, the OpenSSL neophyte, that I need to fill out a SSL_METHOD structure in order to create an OpenSSL context and here are a few canned ones OpenSSL provides for client, server, and combined uses (for those that follow that link, no I'm not doing anything related to OpenVMS, I'm on Windows and Linux for the purposes of this question).  And sure enough in the POCO Context <code>createSSLContext()</code> method several of the SSL_METHODs from the table are used, though not the ones for the combined client and server.</p>
  
  <p>I have tried modifiying the POCO code to add a "MIXED_USE" usage and updated the context code appropriately and from my toy example it seems to work.  This brings me to my question.  Am I missing anything which would or might cause me problems down the road if I go down this route?  Besides the obvious "well POCO also references the usage type over here you blind idiot" issues, are there any ill effects I might run into from basically taking a set of OpenSSL (wrapper) code and simply changing the SSL method for the SSL context in my web services?  Any help/pointers/thoughts are appreciated.</p>
  
  <hr>
  
  <p>TL;DR version:  POCO HTTPS libraries expect you to use either a client or server OpenSSL context, but I want to tweak them and just change the SSL_METHOD to support a combined client and server OpenSSL context?  How screwed am I?</p>
  
  <hr>
  
  <p>EDIT 4/24/2014:  So in response to jww's answer, let me sketch out the Context class a bit.  It basically wraps a pointer to an OpenSSL context structure, named <code>_pSSLContext</code>.  To the constructor there's a <code>Usage</code> enum parameter (which sets a member <code>_usage</code>) which has a few possible values.  As part of the Context object's initialization it calls an internal method called <code>createSSLContext()</code> which looks like this:</p>
  
  <pre><code>void Context::createSSLContext()
  {
      if (SSLManager::isFIPSEnabled())
      {
          _pSSLContext = SSL_CTX_new(TLSv1_method());
      }
      else
      {
          switch (_usage)
          {
          case CLIENT_USE:
              _pSSLContext = SSL_CTX_new(SSLv23_client_method());
              break;
          case SERVER_USE:
              _pSSLContext = SSL_CTX_new(SSLv23_server_method());
              break;
          case TLSV1_CLIENT_USE:
              _pSSLContext = SSL_CTX_new(TLSv1_client_method());
              break;
          case TLSV1_SERVER_USE:
              _pSSLContext = SSL_CTX_new(TLSv1_server_method());
              break;
          default:
              throw Poco::InvalidArgumentException("Invalid usage");
          }
      }
      if (!_pSSLContext) 
      {
          unsigned long err = ERR_get_error();
          throw SSLException("Cannot create SSL_CTX object", ERR_error_string(err, 0));
      }
  
      SSL_CTX_set_default_passwd_cb(_pSSLContext, &amp;SSLManager::privateKeyPassphraseCallback);
      Utility::clearErrorStack();
      SSL_CTX_set_options(_pSSLContext, SSL_OP_ALL);
  }
  </code></pre>
  
  <p>I think I should be able to add another value to the <code>Usage</code> enum which would cause the switch statement above to make call initialize the context with the <code>SSL_METHOD</code> being <code>SSLv23_method()</code>.  I've tested this in a toy example and it seems to work.</p>
  
  <p>My concern, which led to my question, is that there might be side effects of making a change like this.  I don't know POCO or OpenSSL enough to know if there are other levers I need to pull in order to make that work.  For instance, if there's something about the <code>SSLv23_server/client_method()</code>s where just inserting <code>SSLv23_method()</code> in its place without changing something somewhere else too might break something (possibly subtly so).</p>