Reverted to gnutls 2.2 behaviour of allowing an empty key (for PKCS #11).

Reported by Joe Orton.

diff --git a/lib/auth_cert.c b/lib/auth_cert.c
index d4f55d0fb3fa7d5e1d2b23aa45eb489e69a60c25..cfa80cefb8023332a5281cc6387798268e26a497 100644 (file)
--- a/lib/auth_cert.c
+++ b/lib/auth_cert.c
@@ -456,7 +456,7 @@ call_get_cert_callback (gnutls_session_t session,
   if (type == GNUTLS_CRT_X509)
     {
       local_certs = alloc_and_load_x509_certs (st.cert.x509, st.ncerts);
-      if (local_certs != NULL) 
+      if (local_certs != NULL && st.key.x509 != NULL) 
         {
          local_key = alloc_and_load_x509_key (st.key.x509);
          if (local_key == NULL)
@@ -480,7 +480,7 @@ call_get_cert_callback (gnutls_session_t session,
 #ifdef ENABLE_OPENPGP
       {
         local_certs = alloc_and_load_pgp_certs (st.cert.pgp);
-        if (local_certs != NULL)
+        if (local_certs != NULL && st.key.pgp != NULL)
           {
            local_key = alloc_and_load_pgp_key (st.key.pgp);
            if (local_key == NULL)