i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BSecureSocket: use openssl's default paths for certificates.

Browse Source 
It is confusing to use different sets of certificates for BSecureSocket
based apps and ones using openssl directly. So, use the defaults in
BSecureSocket.

OpenSSL was modified to keep the user certificates in non-packaged so
this does not change the behavior for native apps (needs openssl 1.1.1g-3)

Change-Id: Ic398eec5efa9d036c3b810b7a3bb7142bdeb2d46
Reviewed-on: https://review.haiku-os.org/c/haiku/+/3394
Reviewed-by: Adrien Destugues <[email protected]>
This commit is contained in:
Adrien Destugues
2020-11-22 19:19:20 +00:00
committed by Adrien Destugues
parent c5ff1f14c6
commit bc8445142d
1 changed files with 1 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/kits/network/libnetapi/SecureSocket.cpp
+1 -9
View File
@@ -365,15 +365,7 @@ BSecureSocket::Private::_CreateContext()
SSL_CTX_set_cipher_list(sContext, "HIGH:!aNULL:!PSK:!SRP:!MD5:!RC4");
// Setup certificate verification
BPath certificateStore;
find_directory(B_SYSTEM_DATA_DIRECTORY, &certificateStore);
certificateStore.Append("ssl/CARootCertificates.pem");
BPath userCertificateStore;
find_directory(B_SYSTEM_NONPACKAGED_DATA_DIRECTORY, &userCertificateStore);
userCertificateStore.Append("ssl/certs/");
SSL_CTX_load_verify_locations(sContext, certificateStore.Path(), userCertificateStore.Path());
SSL_CTX_set_verify(sContext, SSL_VERIFY_PEER, VerifyCallback);
SSL_CTX_set_default_verify_file(sContext);
// OpenSSL 1.0.2 and later: use the alternate "trusted first" algorithm to
// validate certificate chains. This makes the validation stop as soon as a