clear the error stack at the end of fetching

Clearning the error stack at the very end will get rid of any other
optional fetch failures since fetch failures are treated as-if they are
unsupported by the provider.

diff --git a/lib/isc/crypto/ossl3.c b/lib/isc/crypto/ossl3.c
index c05653517b005486f2dd87d858314c79af34024a..3473502badc3c037fbba72f075c092c10889c21b 100644 (file)
--- a/lib/isc/crypto/ossl3.c
+++ b/lib/isc/crypto/ossl3.c
@@ -163,7 +163,6 @@ register_algorithms(void) {
        /* We _must_ have HMAC */
        evp_hmac = EVP_MAC_fetch(NULL, "HMAC", NULL);
        if (evp_hmac == NULL) {
-               ERR_clear_error();
                FATAL_ERROR("OpenSSL failed to find an HMAC implementation. "
                            "Please make sure the default provider has an "
                            "EVP_MAC-HMAC implementation");
@@ -179,12 +178,13 @@ register_algorithms(void) {
 
        evp_hkdf = EVP_KDF_fetch(NULL, OSSL_KDF_NAME_HKDF, NULL);
        if (evp_hkdf == NULL) {
-               ERR_clear_error();
                FATAL_ERROR("OpenSSL failed to find an HKDF implementation. "
                            "Please make sure the default provider has an "
                            "EVP_KDF-HKDF implementation");
        }
 
+       ERR_clear_error();
+
        return ISC_R_SUCCESS;
 }