From 99d96cefd95418fa4ea7546697fbc26048cb5dcf Mon Sep 17 00:00:00 2001 From: Pascal Abresch Date: Sat, 12 Sep 2020 13:15:49 +0200 Subject: [PATCH] TLS: add user cert dir BSecureSocket currently only checks for trust anchors in the CA file, this change will add the openssl certs/ directory as a trust anchor dir. this matches the behaviour openssl has on the commandline and allows users to install their own trust anchors to verify against for TLS Change-Id: I9db5c3f3b063607e092dded3d5b141dba340a8e2 Reviewed-on: https://review.haiku-os.org/c/haiku/+/3207 Reviewed-by: Fredrik Holmqvist --- src/kits/network/libnetapi/SecureSocket.cpp | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/kits/network/libnetapi/SecureSocket.cpp b/src/kits/network/libnetapi/SecureSocket.cpp index 31f8115d7e..1aaf9b344e 100644 --- a/src/kits/network/libnetapi/SecureSocket.cpp +++ b/src/kits/network/libnetapi/SecureSocket.cpp @@ -368,10 +368,11 @@ BSecureSocket::Private::_CreateContext() BPath certificateStore; find_directory(B_SYSTEM_DATA_DIRECTORY, &certificateStore); certificateStore.Append("ssl/CARootCertificates.pem"); - // TODO we may want to add a non-packaged certificate directory? - // (would make it possible to store user-added certificate exceptions - // there) - SSL_CTX_load_verify_locations(sContext, certificateStore.Path(), NULL); + + BPath userCertificateStore; + find_directory(B_SYSTEM_NONPACKAGED_DATA_DIRECTORY, &userCertificateStore); + userCertificateStore.Append("ssl/certs/"); + SSL_CTX_load_verify_locations(sContext, certificateStore.Path(), userCertificateStore.Path()); SSL_CTX_set_verify(sContext, SSL_VERIFY_PEER, VerifyCallback); // OpenSSL 1.0.2 and later: use the alternate "trusted first" algorithm to