From 1c6008869cbe9ad956f5ed56462637a1d35018e0 Mon Sep 17 00:00:00 2001
From: Anders Betts <anders.betts@gmail.com>
Date: Mon, 21 Sep 2026 14:52:10 +0200
Subject: tls: load the system CA bundle explicitly under static OpenSSL

---
 src/smtp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'src/smtp.c')

diff --git a/src/smtp.c b/src/smtp.c
index 6a90424..18834fa 100644
--- a/src/smtp.c
+++ b/src/smtp.c
@@ -18,6 +18,7 @@
 #include <openssl/ssl.h>
 #include <openssl/x509.h>
 
+#include "tls_ca.h"
 #include "util.h"
 
 #define SMTP_TIMEOUT_SEC 30
@@ -345,7 +346,7 @@ static int tls_start(struct smtp_conn *c, const char *host, char *err,
     SSL_CTX_set_options(c->ctx, SSL_OP_NO_COMPRESSION |
                                     SSL_OP_NO_RENEGOTIATION);
     SSL_CTX_set_verify(c->ctx, SSL_VERIFY_PEER, NULL);
-    if (SSL_CTX_set_default_verify_paths(c->ctx) != 1) {
+    if (tls_load_default_cas(c->ctx) != 1) {
         set_err(err, errlen, "smtp: cannot load system CA certificates");
         return -1;
     }
-- 
cgit v1.3