Make sure using SSL_CERT_FILE actually works, and has priority over system defaults.

[openssl.git] / crypto / x509 / by_file.c

diff --git a/crypto/x509/by_file.c b/crypto/x509/by_file.c
index 78e9240a8d0973da02a958b08a53113baa4b4207..d8731d4e514015be36541552eabc90e0a33e3694 100644 (file)
--- a/crypto/x509/by_file.c
+++ b/crypto/x509/by_file.c
@@ -66,7 +66,7 @@
 #include <openssl/x509.h>
 #include <openssl/pem.h>
 
-#ifndef NO_STDIO
+#ifndef OPENSSL_NO_STDIO
 
 static int by_file_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc,
        long argl, char **ret);
@@ -100,18 +100,19 @@ static int by_file_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, long argl,
        case X509_L_FILE_LOAD:
                if (argl == X509_FILETYPE_DEFAULT)
                        {
-                       ok = (X509_load_cert_crl_file(ctx,X509_get_default_cert_file(),
-                               X509_FILETYPE_PEM) != 0);
+                       file = (char *)Getenv(X509_get_default_cert_file_env());
+                       if (file)
+                               ok = (X509_load_cert_crl_file(ctx,file,
+                                             X509_FILETYPE_PEM) != 0);
+
+                       if (!ok)
+                               ok = (X509_load_cert_crl_file(ctx,X509_get_default_cert_file(),
+                                             X509_FILETYPE_PEM) != 0);
+
                        if (!ok)
                                {
                                X509err(X509_F_BY_FILE_CTRL,X509_R_LOADING_DEFAULTS);
                                }
-                       else
-                               {
-                               file=(char *)Getenv(X509_get_default_cert_file_env());
-                               ok = (X509_load_cert_crl_file(ctx,file,
-                                       X509_FILETYPE_PEM) != 0);
-                               }
                        }
                else
                        {
@@ -294,5 +295,5 @@ int X509_load_cert_crl_file(X509_LOOKUP *ctx, const char *file, int type)
 }
 
 
-#endif /* NO_STDIO */
+#endif /* OPENSSL_NO_STDIO */