Load full certificate chain from a certificate chain file

This commit fixes loading the certificate chain files so that the full
chain could be sent to the clients which require that for
verification. Before that fix only the top most certificate would be
loaded from the chain and sent to clients preventing some of them to
perform certificate validation (e.g. Windows 10 DoH client).

diff --git a/lib/isc/tls.c b/lib/isc/tls.c
index 8a3f5cc41b53c12d164dfecc48163434ed5476f7..d15fc16b1cea8329ad7d60aa4ca0f8ac7fdf9180 100644 (file)
--- a/lib/isc/tls.c
+++ b/lib/isc/tls.c
@@ -311,8 +311,7 @@ isc_tlsctx_createserver(const char *keyfile, const char *certfile,
                EVP_PKEY_free(pkey);
                BN_free(bn);
        } else {
-               rv = SSL_CTX_use_certificate_file(ctx, certfile,
-                                                 SSL_FILETYPE_PEM);
+               rv = SSL_CTX_use_certificate_chain_file(ctx, certfile);
                if (rv != 1) {
                        goto ssl_error;
                }