upstream updates

Limelight/Crypto/CryptoManager.m

@@ -96,6 +96,7 @@ static NSData* p12 = nil;
     
     bio = BIO_new(BIO_s_mem());
     i2d_X509_bio(bio, x509);
+    X509_free(x509);
 
     BUF_MEM* mem;
     BIO_get_mem_ptr(bio, &mem);
@@ -222,6 +223,7 @@ static NSData* p12 = nil;
 + (NSData *)getSignatureFromCert:(NSData *)cert {
     BIO* bio = BIO_new_mem_buf([cert bytes], (int)[cert length]);
     X509* x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
+    BIO_free(bio);
     
     if (!x509) {
         Log(LOG_E, @"Unable to parse certificate in memory!");

Limelight/Crypto/mkcert.c

@@ -63,21 +63,9 @@ void mkcert(X509 **x509p, EVP_PKEY **pkeyp, int bits, int serial, int years) {
 }
 
 struct CertKeyPair generateCertKeyPair(void) {
-    BIO *bio_err;
     X509 *x509 = NULL;
     EVP_PKEY *pkey = NULL;
     PKCS12 *p12 = NULL;
-    // OpenSSL3 has default algorithms that iOS refuses to load so we
-    // must load the legacy provider and override all the algorithms
-    // in this cert.
-
-    OSSL_PROVIDER *_legacy = OSSL_PROVIDER_try_load(NULL, "legacy", 1);
-
-    if (_legacy == NULL) {
-        printf("Failed to load Legacy provider\n");
-    }
-   
-    bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
     
     mkcert(&x509, &pkey, NUM_BITS, SERIAL, NUM_YEARS);
     
@@ -88,7 +76,7 @@ struct CertKeyPair generateCertKeyPair(void) {
                         x509,
                         NULL,
                         NID_pbe_WithSHA1And3_Key_TripleDES_CBC,
-                        NID_pbe_WithSHA1And40BitRC2_CBC,
+                        -1, // disable certificate encryption
                         2048,
                         -1, // disable the automatic MAC
                         0);
@@ -99,8 +87,6 @@ struct CertKeyPair generateCertKeyPair(void) {
         printf("Error generating a valid PKCS12 certificate.\n");
     }
     
-    BIO_free(bio_err);
-    
     return (CertKeyPair){x509, pkey, p12};
 }