blob: 3b3134586e94545a67c027e0c6472e6f72f82a07 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
#ifndef BOKF_TLS_CA_H
#define BOKF_TLS_CA_H
#include <openssl/ssl.h>
/* Load the system trust store. A statically linked OpenSSL keeps the build
machine's compiled-in directory (e.g. Debian's /usr/lib/ssl), which may
not exist where the binary runs, so the common bundle locations are also
tried explicitly. Returns 1 when any store was loaded. */
static inline int tls_load_default_cas(SSL_CTX *ctx)
{
int ok = SSL_CTX_set_default_verify_paths(ctx) == 1;
static const char *const files[] = {
"/etc/ssl/certs/ca-certificates.crt",
"/etc/pki/tls/certs/ca-bundle.crt",
NULL,
};
static const char *const dirs[] = {
"/etc/ssl/certs",
NULL,
};
for (int i = 0; files[i]; i++)
if (SSL_CTX_load_verify_locations(ctx, files[i], NULL) == 1)
ok = 1;
for (int i = 0; dirs[i]; i++)
if (SSL_CTX_load_verify_locations(ctx, NULL, dirs[i]) == 1)
ok = 1;
return ok;
}
#endif
|
