From: jethrogb <github@jbeekman.nl>
Date: Thu, 20 Feb 2020 19:36:25 +0000 (+0100)
Subject: GnuTLS: Always send client cert
X-Git-Tag: curl-7_69_0~95
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=41fcb4f609;p=thirdparty%2Fcurl.git

GnuTLS: Always send client cert

TLS servers may request a certificate from the client. This request
includes a list of 0 or more acceptable issuer DNs. The client may use
this list to determine which certificate to send. GnuTLS's default
behavior is to not send a client certificate if there is no
match. However, OpenSSL's default behavior is to send the configured
certificate. The `GNUTLS_FORCE_CLIENT_CERT` flag mimics OpenSSL
behavior.

Authored-by: jethrogb on github
Fixes #1411
Closes #4958
---

diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c
index 3737d7c685..955f1ee350 100644
--- a/lib/vtls/gtls.c
+++ b/lib/vtls/gtls.c
@@ -664,7 +664,7 @@ gtls_connect_step1(struct connectdata *conn,
   }
 
   /* Initialize TLS session as a client */
-  init_flags = GNUTLS_CLIENT;
+  init_flags = GNUTLS_CLIENT | GNUTLS_FORCE_CLIENT_CERT;
 
 #if defined(GNUTLS_NO_TICKETS)
   /* Disable TLS session tickets */