Merge pull request #677 from InfrastructureServices/use-system-cas

wcawijngaards · web-flow · commit 2132e67b36c5 · 2022-05-12T16:16:49.000+02:00
Allow using system certificates not only on Windows
diff --git a/util/config_file.c b/util/config_file.c
@@ -546,6 +546,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_STR("ssl-cert-bundle:", tls_cert_bundle)
 	else S_STR("tls-cert-bundle:", tls_cert_bundle)
 	else S_YNO("tls-win-cert:", tls_win_cert)
+	else S_YNO("tls-system-cert:", tls_win_cert)
 	else S_STRLIST("additional-ssl-port:", tls_additional_port)
 	else S_STRLIST("additional-tls-port:", tls_additional_port)
 	else S_STRLIST("tls-additional-ports:", tls_additional_port)
diff --git a/util/net_help.c b/util/net_help.c
@@ -1271,7 +1271,13 @@ void* connect_sslctx_create(char* key, char* pem, char* verifypem, int wincert)
 			}
 		}
 #else
-		(void)wincert;
+		if(wincert) {
+			if(!SSL_CTX_set_default_verify_paths(ctx)) {
+				log_crypto_err("error in default_verify_paths");
+				SSL_CTX_free(ctx);
+				return NULL;
+			}
+		}
 #endif
 		SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
 	}

Original file line number	Diff line number	Diff line change
`@@ -1271,7 +1271,13 @@ void* connect_sslctx_create(char* key, char* pem, char* verifypem, int wincert)`
`1271`	`1271`	`}`
`1272`	`1272`	`}`
`1273`	`1273`	`#else`
`1274`		`- (void)wincert;`
	`1274`	`+ if(wincert) {`
	`1275`	`+ if(!SSL_CTX_set_default_verify_paths(ctx)) {`
	`1276`	`+ log_crypto_err("error in default_verify_paths");`
	`1277`	`+ SSL_CTX_free(ctx);`
	`1278`	`+ return NULL;`
	`1279`	`+ }`
	`1280`	`+ }`
`1275`	`1281`	`#endif`
`1276`	`1282`	`SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);`
`1277`	`1283`	`}`