#ifndef BOKF_TLS_CA_H
#define BOKF_TLS_CA_H

#include <openssl/ssl.h>

/* Load the system trust store. A statically linked OpenSSL keeps the build
   machine's compiled-in directory (e.g. Debian's /usr/lib/ssl), which may
   not exist where the binary runs, so the common bundle locations are also
   tried explicitly. Returns 1 when any store was loaded. */
static inline int tls_load_default_cas(SSL_CTX *ctx)
{
    int ok = SSL_CTX_set_default_verify_paths(ctx) == 1;
    static const char *const files[] = {
        "/etc/ssl/certs/ca-certificates.crt",
        "/etc/pki/tls/certs/ca-bundle.crt",
        NULL,
    };
    static const char *const dirs[] = {
        "/etc/ssl/certs",
        NULL,
    };
    for (int i = 0; files[i]; i++)
        if (SSL_CTX_load_verify_locations(ctx, files[i], NULL) == 1)
            ok = 1;
    for (int i = 0; dirs[i]; i++)
        if (SSL_CTX_load_verify_locations(ctx, NULL, dirs[i]) == 1)
            ok = 1;
    return ok;
}

#endif