Hi,
On Sun, Jan 21, 2018 at 4:36 AM, Isaac Boukris <iboukris@xxxxxxxxx> wrote:
> This helps the server to build the chain to trusted CA.
>
> Signed-off-by: Isaac Boukris <iboukris@xxxxxxxxx>
> ---
> src/crypto/tls_openssl.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
> index ce73848..3d789bb 100644
> --- a/src/crypto/tls_openssl.c
> +++ b/src/crypto/tls_openssl.c
> @@ -2653,10 +2653,9 @@ static int tls_connection_client_cert(struct tls_connection *conn,
> return 0;
> }
>
> - if (SSL_use_certificate_file(conn->ssl, client_cert,
> - SSL_FILETYPE_PEM) == 1) {
> + if (SSL_use_certificate_chain_file(conn->ssl, client_cert) == 1) {
> ERR_clear_error();
> - wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_file (PEM)"
> + wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_chain_file"
> " --> OK");
> return 0;
> }
> --
I'd like to reference the case where I found this useful against
FreeRadius server, see:
http://lists.freeradius.org/pipermail/freeradius-users/2018-January/090245.html
I left it unconditional as I assumed that without this change it
wouldn't make much sense having the chain included.
Review appreciated.
Thank you,
Isaac B.
_______________________________________________
Hostap mailing list
Hostap@xxxxxxxxxxxxxxxxxxx
http://lists.infradead.org/mailman/listinfo/hostap
