diff options
| author | Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com> | 2012-07-05 23:22:34 +0900 |
|---|---|---|
| committer | Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com> | 2012-07-05 23:22:34 +0900 |
| commit | 4046f27ea9acc08180455900c20d2bd4c02f6f62 (patch) | |
| tree | f5e492569e2fb09384995f5fbfb09fd2d865dba5 /src/LibsslTLSContext.cc | |
| parent | b25d8a992377555d19106da48d82cc2def79bbec (diff) | |
Use system-wide certificates for SSL
Use system-wide certificates for SSL. For GnuTLS it requires the
latest version, 3.0.20. OpenSSL had it for longer. This means that if
SSL library is properly configured to locate system-wide certificates
store, the user don't have to use --ca-certificate option. Also
packagers don't have to use --with-ca-bundle configure option.
Patch from Cristian Morales Vega
Diffstat (limited to 'src/LibsslTLSContext.cc')
| -rw-r--r-- | src/LibsslTLSContext.cc | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/src/LibsslTLSContext.cc b/src/LibsslTLSContext.cc index 272f8cd3..c370d49c 100644 --- a/src/LibsslTLSContext.cc +++ b/src/LibsslTLSContext.cc @@ -102,6 +102,18 @@ bool TLSContext::addClientKeyFile(const std::string& certfile, return true; } +bool TLSContext::addSystemTrustedCACerts() +{ + if(SSL_CTX_set_default_verify_paths(sslCtx_) != 1) { + A2_LOG_ERROR(fmt(MSG_LOADING_SYSTEM_TRUSTED_CA_CERTS_FAILED, + ERR_error_string(ERR_get_error(), 0))); + return false; + } else { + A2_LOG_INFO("System trusted CA certificates were successfully added."); + return true; + } +} + bool TLSContext::addTrustedCACertFile(const std::string& certfile) { if(SSL_CTX_load_verify_locations(sslCtx_, certfile.c_str(), 0) != 1) { |