From fe9b85c3cb79f1e29e61f01de105b34ce8177190 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Wed, 25 Feb 2015 11:30:43 +0000 Subject: [PATCH] Fix bug in s_client. Previously default verify locations would only be loaded if CAfile or CApath were also supplied and successfully loaded first. Reviewed-by: Richard Levitte (cherry picked from commit 70e5fd877890489a3972bf8bf50bfec1fca3875e) --- apps/s_client.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/apps/s_client.c b/apps/s_client.c index ef41cec1aa..1f37239e27 100644 --- a/apps/s_client.c +++ b/apps/s_client.c @@ -1177,13 +1177,12 @@ int MAIN(int argc, char **argv) if (!set_cert_key_stuff(ctx, cert, key)) goto end; - if ((!SSL_CTX_load_verify_locations(ctx, CAfile, CApath)) || - (!SSL_CTX_set_default_verify_paths(ctx))) { - /* - * BIO_printf(bio_err,"error setting default verify locations\n"); - */ + if ((CAfile || CApath) + && !SSL_CTX_load_verify_locations(ctx, CAfile, CApath)) { + ERR_print_errors(bio_err); + } + if (!SSL_CTX_set_default_verify_paths(ctx)) { ERR_print_errors(bio_err); - /* goto end; */ } #ifndef OPENSSL_NO_TLSEXT if (servername != NULL) { -- 2.34.1