Fix bug in s_client. Previously default verify locations would only be loaded
authorMatt Caswell <matt@openssl.org>
Wed, 25 Feb 2015 11:30:43 +0000 (11:30 +0000)
committerMatt Caswell <matt@openssl.org>
Wed, 25 Mar 2015 13:03:57 +0000 (13:03 +0000)
if CAfile or CApath were also supplied and successfully loaded first.

Reviewed-by: Richard Levitte <levitte@openssl.org>
apps/s_client.c

index c02ed3c..cdea322 100644 (file)
@@ -1352,13 +1352,12 @@ int MAIN(int argc, char **argv)
 
     SSL_CTX_set_verify(ctx, verify, verify_callback);
 
-    if ((!SSL_CTX_load_verify_locations(ctx, CAfile, CApath)) ||
-        (!SSL_CTX_set_default_verify_paths(ctx))) {
-        /*
-         * BIO_printf(bio_err,"error setting default verify locations\n");
-         */
+    if ((CAfile || CApath)
+        && !SSL_CTX_load_verify_locations(ctx, CAfile, CApath)) {
+        ERR_print_errors(bio_err);
+    }
+    if (!SSL_CTX_set_default_verify_paths(ctx)) {
         ERR_print_errors(bio_err);
-        /* goto end; */
     }
 
     ssl_ctx_add_crls(ctx, crls, crl_download);