From 1c6008869cbe9ad956f5ed56462637a1d35018e0 Mon Sep 17 00:00:00 2001 From: Anders Betts Date: Mon, 21 Sep 2026 14:52:10 +0200 Subject: tls: load the system CA bundle explicitly under static OpenSSL --- clients/client.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'clients/client.c') diff --git a/clients/client.c b/clients/client.c index fd119f1..30f2a67 100644 --- a/clients/client.c +++ b/clients/client.c @@ -1,4 +1,5 @@ #include "client.h" +#include "tls_ca.h" #include #include @@ -126,7 +127,7 @@ static int tls_connect_addr(const char *addrport, struct client_conn *out) } SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION); SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL); - SSL_CTX_set_default_verify_paths(ctx); + tls_load_default_cas(ctx); const char *ca = getenv("BOKFD_TLS_CA"); if (ca && *ca && SSL_CTX_load_verify_locations(ctx, ca, NULL) != 1) { set_tls_error("TLS CA file"); -- cgit v1.3