From: Jouni Malinen Date: Wed, 21 Dec 2016 10:23:15 +0000 (+0200) Subject: OpenSSL: Make sure local certificate auto chaining is enabled X-Git-Tag: hostap_2_7~1981 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d7f12e4eb9fe1f182dadec79b675c274a2618549;p=thirdparty%2Fhostap.git OpenSSL: Make sure local certificate auto chaining is enabled Number of deployed use cases assume the default OpenSSL behavior of auto chaining the local certificate is in use. BoringSSL removed this functionality by default, so we need to restore it here to avoid breaking existing use cases. Signed-off-by: Jouni Malinen --- diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c index 9ca58b3ce..e2749755f 100644 --- a/src/crypto/tls_openssl.c +++ b/src/crypto/tls_openssl.c @@ -972,6 +972,14 @@ void * tls_init(const struct tls_config *conf) SSL_CTX_set_options(ssl, SSL_OP_NO_SSLv2); SSL_CTX_set_options(ssl, SSL_OP_NO_SSLv3); +#ifdef SSL_MODE_NO_AUTO_CHAIN + /* Number of deployed use cases assume the default OpenSSL behavior of + * auto chaining the local certificate is in use. BoringSSL removed this + * functionality by default, so we need to restore it here to avoid + * breaking existing use cases. */ + SSL_CTX_clear_mode(ssl, SSL_MODE_NO_AUTO_CHAIN); +#endif /* SSL_MODE_NO_AUTO_CHAIN */ + SSL_CTX_set_info_callback(ssl, ssl_info_cb); SSL_CTX_set_app_data(ssl, context); if (data->tls_session_lifetime > 0) {