From 1c6008869cbe9ad956f5ed56462637a1d35018e0 Mon Sep 17 00:00:00 2001
From: Anders Betts <anders.betts@gmail.com>
Date: Mon, 21 Sep 2026 14:52:10 +0200
Subject: tls: load the system CA bundle explicitly under static OpenSSL

---
 src/tax_table.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'src/tax_table.c')

diff --git a/src/tax_table.c b/src/tax_table.c
index 1cf40c1..6405a70 100644
--- a/src/tax_table.c
+++ b/src/tax_table.c
@@ -18,6 +18,7 @@
 #include <openssl/x509.h>
 
 #include "db.h"
+#include "tls_ca.h"
 #include "version.h"
 
 #define TT_LINE_LEN 49
@@ -478,7 +479,7 @@ static int tt_get_once(const struct tt_url *u, struct buf *body, int *status,
     SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);
     SSL_CTX_set_options(ctx, SSL_OP_NO_COMPRESSION | SSL_OP_NO_RENEGOTIATION);
     SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
-    if (SSL_CTX_set_default_verify_paths(ctx) != 1) {
+    if (tls_load_default_cas(ctx) != 1) {
         set_err(err, "cannot load system CA certificates");
         goto done;
     }
-- 
cgit v1.3