From 1c6008869cbe9ad956f5ed56462637a1d35018e0 Mon Sep 17 00:00:00 2001 From: Anders Betts Date: Mon, 21 Sep 2026 14:52:10 +0200 Subject: tls: load the system CA bundle explicitly under static OpenSSL --- src/tls_ca.h | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 src/tls_ca.h (limited to 'src/tls_ca.h') diff --git a/src/tls_ca.h b/src/tls_ca.h new file mode 100644 index 0000000..3b31345 --- /dev/null +++ b/src/tls_ca.h @@ -0,0 +1,31 @@ +#ifndef BOKF_TLS_CA_H +#define BOKF_TLS_CA_H + +#include + +/* Load the system trust store. A statically linked OpenSSL keeps the build + machine's compiled-in directory (e.g. Debian's /usr/lib/ssl), which may + not exist where the binary runs, so the common bundle locations are also + tried explicitly. Returns 1 when any store was loaded. */ +static inline int tls_load_default_cas(SSL_CTX *ctx) +{ + int ok = SSL_CTX_set_default_verify_paths(ctx) == 1; + static const char *const files[] = { + "/etc/ssl/certs/ca-certificates.crt", + "/etc/pki/tls/certs/ca-bundle.crt", + NULL, + }; + static const char *const dirs[] = { + "/etc/ssl/certs", + NULL, + }; + for (int i = 0; files[i]; i++) + if (SSL_CTX_load_verify_locations(ctx, files[i], NULL) == 1) + ok = 1; + for (int i = 0; dirs[i]; i++) + if (SSL_CTX_load_verify_locations(ctx, NULL, dirs[i]) == 1) + ok = 1; + return ok; +} + +#endif -- cgit v1.3