From: Aydın Mercan <aydin@isc.org>
Date: Thu, 12 Feb 2026 07:07:57 +0000 (+0300)
Subject: clear the error stack at the end of fetching
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=9df7af4a1e9f56b6ce835c35f320bddf643f8b6d;p=thirdparty%2Fbind9.git

clear the error stack at the end of fetching

Clearning the error stack at the very end will get rid of any other
optional fetch failures since fetch failures are treated as-if they are
unsupported by the provider.
---

diff --git a/lib/isc/crypto/ossl3.c b/lib/isc/crypto/ossl3.c
index c05653517b0..3473502badc 100644
--- a/lib/isc/crypto/ossl3.c
+++ b/lib/isc/crypto/ossl3.c
@@ -163,7 +163,6 @@ register_algorithms(void) {
 	/* We _must_ have HMAC */
 	evp_hmac = EVP_MAC_fetch(NULL, "HMAC", NULL);
 	if (evp_hmac == NULL) {
-		ERR_clear_error();
 		FATAL_ERROR("OpenSSL failed to find an HMAC implementation. "
 			    "Please make sure the default provider has an "
 			    "EVP_MAC-HMAC implementation");
@@ -179,12 +178,13 @@ register_algorithms(void) {
 
 	evp_hkdf = EVP_KDF_fetch(NULL, OSSL_KDF_NAME_HKDF, NULL);
 	if (evp_hkdf == NULL) {
-		ERR_clear_error();
 		FATAL_ERROR("OpenSSL failed to find an HKDF implementation. "
 			    "Please make sure the default provider has an "
 			    "EVP_KDF-HKDF implementation");
 	}
 
+	ERR_clear_error();
+
 	return ISC_R_SUCCESS;
 }