Sorry for the very late response...
On Sun, Nov 24, 2019 at 12:05:34PM +0100, Claus Assmann wrote:
> Seems it is impossible to override the list with NULL for SSL, as
> the code will then use the list from CTX (if my limited understanding
> of the code is correct):
>
> STACK_OF(X509_NAME) *SSL_get_client_CA_list(const SSL *s)
> {
> ...
> if (s->client_CA != NULL)
> return (s->client_CA);
> else
> return (s->ctx->client_CA);
>
> Is this intentional? The man pages says:
Yes.
> SSL_set_client_CA_list() sets the list of CAs sent to the client when
> requesting a client certificate for the chosen ssl, overriding the
> setting valid for ssl's SSL_CTX object.
>
>
> IMHO there should be some indication (flag) that the value from SSL
> should be used (to distinguish between the ways NULL is used: "this
> is NULL because of the initialization" and "this is explicitly set
> to NULL").
You should be able to set a "zero-length list" (which is a non-NULL pointer
value) in order to get your desired behavior.
-Ben
