tls: load the system CA bundle explicitly under static OpenSSLv0.1.58

1 files changed, 31 insertions, 0 deletions

diff --git a/src/tls_ca.h b/src/tls_ca.h
new file mode 100644
index 0000000..3b31345
--- /dev/null
+++ b/src/tls_ca.h
@@ -0,0 +1,31 @@
+#ifndef BOKF_TLS_CA_H
+#define BOKF_TLS_CA_H
+
+#include <openssl/ssl.h>
+
+/* Load the system trust store. A statically linked OpenSSL keeps the build
+   machine's compiled-in directory (e.g. Debian's /usr/lib/ssl), which may
+   not exist where the binary runs, so the common bundle locations are also
+   tried explicitly. Returns 1 when any store was loaded. */
+static inline int tls_load_default_cas(SSL_CTX *ctx)
+{
+    int ok = SSL_CTX_set_default_verify_paths(ctx) == 1;
+    static const char *const files[] = {
+        "/etc/ssl/certs/ca-certificates.crt",
+        "/etc/pki/tls/certs/ca-bundle.crt",
+        NULL,
+    };
+    static const char *const dirs[] = {
+        "/etc/ssl/certs",
+        NULL,
+    };
+    for (int i = 0; files[i]; i++)
+        if (SSL_CTX_load_verify_locations(ctx, files[i], NULL) == 1)
+            ok = 1;
+    for (int i = 0; dirs[i]; i++)
+        if (SSL_CTX_load_verify_locations(ctx, NULL, dirs[i]) == 1)
+            ok = 1;
+    return ok;
+}
+
+#endif