From: Isaac Boukris <iboukris@gmail.com>
Date: Fri, 19 Jan 2018 02:23:30 +0000 (+0000)
Subject: TLS: Allow partial certificate chain to trusted CA
X-Git-Tag: release_3_0_17~57^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8e54822dcaf1230d48469214c128e6be08d4d9ea;p=thirdparty%2Ffreeradius-server.git

TLS: Allow partial certificate chain to trusted CA

This lets for example to only trust a local sub CA
without having to trust the whole hierarchy.
---

diff --git a/src/main/tls.c b/src/main/tls.c
index e914fb2be55..9b04a532f99 100644
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -2914,6 +2914,9 @@ SSL_CTX *tls_init_ctx(fr_tls_server_conf_t *conf, int client)
 
 	/* Load the CAs we trust */
 load_ca:
+#if defined(X509_V_FLAG_PARTIAL_CHAIN)
+	X509_STORE_set_flags(SSL_CTX_get_cert_store(ctx), X509_V_FLAG_PARTIAL_CHAIN);
+#endif
 	if (conf->ca_file || conf->ca_path) {
 		if (!SSL_CTX_load_verify_locations(ctx, conf->ca_file, conf->ca_path)) {
 			tls_error_log(NULL, "Failed reading Trusted root CA list \"%s\"",