svn commit: r295843 - stable/10/lib/libfetch

[Dag-Erling Smørgrav]

Author: des
Date: Sat Feb 20 22:58:33 2016
New Revision: 295843
URL: https://svnweb.freebsd.org/changeset/base/295843

Log:
  MFH (r294326): fall back to standard / configured CA store
  
  PR:		193871
  Approved by:	re (gjb)

Modified:
  stable/10/lib/libfetch/common.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/lib/libfetch/common.c
==============================================================================
--- stable/10/lib/libfetch/common.c	Sat Feb 20 17:29:04 2016	(r295842)
+++ stable/10/lib/libfetch/common.c	Sat Feb 20 22:58:33 2016	(r295843)
@@ -705,7 +705,8 @@ fetch_ssl_setup_peer_verification(SSL_CT
 		if (ca_cert_file == NULL &&
 		    access(LOCAL_CERT_FILE, R_OK) == 0)
 			ca_cert_file = LOCAL_CERT_FILE;
-		if (ca_cert_file == NULL)
+		if (ca_cert_file == NULL &&
+		    access(BASE_CERT_FILE, R_OK) == 0)
 			ca_cert_file = BASE_CERT_FILE;
 		ca_cert_path = getenv("SSL_CA_CERT_PATH");
 		if (verbose) {
@@ -716,11 +717,17 @@ fetch_ssl_setup_peer_verification(SSL_CT
 			if (ca_cert_path != NULL)
 				fetch_info("Using CA cert path: %s",
 				    ca_cert_path);
+			if (ca_cert_file == NULL && ca_cert_path == NULL)
+				fetch_info("Using OpenSSL default "
+				    "CA cert file and path");
 		}
 		SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER,
 		    fetch_ssl_cb_verify_crt);
-		SSL_CTX_load_verify_locations(ctx, ca_cert_file,
-		    ca_cert_path);
+		if (ca_cert_file != NULL || ca_cert_path != NULL)
+			SSL_CTX_load_verify_locations(ctx, ca_cert_file,
+			    ca_cert_path);
+		else
+			SSL_CTX_set_default_verify_paths(ctx);
 		if ((crl_file = getenv("SSL_CRL_FILE")) != NULL) {
 			if (verbose)
 				fetch_info("Using CRL file: %s", crl_file);