[openssl.org #2203] [PATCH] fix fallback to default verify paths

[Ludwig Nussel via RT]

---
 apps/s_client.c |   17 ++++++++++++-----
 1 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/apps/s_client.c b/apps/s_client.c
index 484d009..3f57a5d 100644
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -904,12 +904,19 @@ bad:
        if (!set_cert_key_stuff(ctx,cert,key))
                goto end;
 
-       if ((!SSL_CTX_load_verify_locations(ctx,CAfile,CApath)) ||
-               (!SSL_CTX_set_default_verify_paths(ctx)))
+       if (CAfile || CApath)
                {
-               /* BIO_printf(bio_err,"error setting default verify 
locations\n"); */
-               ERR_print_errors(bio_err);
-               /* goto end; */
+               if (!SSL_CTX_load_verify_locations(ctx,CAfile,CApath))
+                       {
+                       BIO_printf(bio_err,"error setting verify locations\n");
+                       ERR_print_errors(bio_err);
+                       goto end;
+                       }
+               }
+       else
+               {
+               BIO_printf(bio_c_out,"using default CA certificates\n");
+               SSL_CTX_set_default_verify_paths(ctx);
                }
 
 #ifndef OPENSSL_NO_TLSEXT
-- 
1.6.4.2

______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       openssl-dev@openssl.org
Automated List Manager                           majord...@openssl.org