TLS: Allow partial certificate chain to trusted CA

This lets for example to only trust a local sub CA
without having to trust the whole hierarchy.

diff --git a/src/main/tls.c b/src/main/tls.c
index e914fb2be55c4be4fc9f7cb94848bb087689983e..9b04a532f99c9203ec0bd705a39761cc10c424fa 100644 (file)
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -2914,6 +2914,9 @@ SSL_CTX *tls_init_ctx(fr_tls_server_conf_t *conf, int client)
 
        /* Load the CAs we trust */
 load_ca:
+#if defined(X509_V_FLAG_PARTIAL_CHAIN)
+       X509_STORE_set_flags(SSL_CTX_get_cert_store(ctx), X509_V_FLAG_PARTIAL_CHAIN);
+#endif
        if (conf->ca_file || conf->ca_path) {
                if (!SSL_CTX_load_verify_locations(ctx, conf->ca_file, conf->ca_path)) {
                        tls_error_log(NULL, "Failed reading Trusted root CA list \"%s\"",