tls: load the system CA bundle explicitly under static OpenSSLv0.1.58

3 files changed, 35 insertions, 2 deletions

diff --git a/src/smtp.c b/src/smtp.c
index 6a90424..18834fa 100644
--- a/src/smtp.c
+++ b/src/smtp.c
@@ -18,6 +18,7 @@
 #include <openssl/ssl.h>
 #include <openssl/x509.h>
 
+#include "tls_ca.h"
 #include "util.h"
 
 #define SMTP_TIMEOUT_SEC 30
@@ -345,7 +346,7 @@ static int tls_start(struct smtp_conn *c, const char *host, char *err,
     SSL_CTX_set_options(c->ctx, SSL_OP_NO_COMPRESSION |
                                     SSL_OP_NO_RENEGOTIATION);
     SSL_CTX_set_verify(c->ctx, SSL_VERIFY_PEER, NULL);
-    if (SSL_CTX_set_default_verify_paths(c->ctx) != 1) {
+    if (tls_load_default_cas(c->ctx) != 1) {
         set_err(err, errlen, "smtp: cannot load system CA certificates");
         return -1;
     }
diff --git a/src/tax_table.c b/src/tax_table.c
index 1cf40c1..6405a70 100644
--- a/src/tax_table.c
+++ b/src/tax_table.c
@@ -18,6 +18,7 @@
 #include <openssl/x509.h>
 
 #include "db.h"
+#include "tls_ca.h"
 #include "version.h"
 
 #define TT_LINE_LEN 49
@@ -478,7 +479,7 @@ static int tt_get_once(const struct tt_url *u, struct buf *body, int *status,
     SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);
     SSL_CTX_set_options(ctx, SSL_OP_NO_COMPRESSION | SSL_OP_NO_RENEGOTIATION);
     SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
-    if (SSL_CTX_set_default_verify_paths(ctx) != 1) {
+    if (tls_load_default_cas(ctx) != 1) {
         set_err(err, "cannot load system CA certificates");
         goto done;
     }
diff --git a/src/tls_ca.h b/src/tls_ca.h
new file mode 100644
index 0000000..3b31345
--- /dev/null
+++ b/src/tls_ca.h
@@ -0,0 +1,31 @@
+#ifndef BOKF_TLS_CA_H
+#define BOKF_TLS_CA_H
+
+#include <openssl/ssl.h>
+
+/* Load the system trust store. A statically linked OpenSSL keeps the build
+   machine's compiled-in directory (e.g. Debian's /usr/lib/ssl), which may
+   not exist where the binary runs, so the common bundle locations are also
+   tried explicitly. Returns 1 when any store was loaded. */
+static inline int tls_load_default_cas(SSL_CTX *ctx)
+{
+    int ok = SSL_CTX_set_default_verify_paths(ctx) == 1;
+    static const char *const files[] = {
+        "/etc/ssl/certs/ca-certificates.crt",
+        "/etc/pki/tls/certs/ca-bundle.crt",
+        NULL,
+    };
+    static const char *const dirs[] = {
+        "/etc/ssl/certs",
+        NULL,
+    };
+    for (int i = 0; files[i]; i++)
+        if (SSL_CTX_load_verify_locations(ctx, files[i], NULL) == 1)
+            ok = 1;
+    for (int i = 0; dirs[i]; i++)
+        if (SSL_CTX_load_verify_locations(ctx, NULL, dirs[i]) == 1)
+            ok = 1;
+    return ok;
+}
+
+#endif