From bc8445142dd217c608f4c10f34a5947951e027b7 Mon Sep 17 00:00:00 2001 From: Adrien Destugues Date: Sun, 15 Nov 2020 15:16:23 +0100 Subject: [PATCH] BSecureSocket: use openssl's default paths for certificates. It is confusing to use different sets of certificates for BSecureSocket based apps and ones using openssl directly. So, use the defaults in BSecureSocket. OpenSSL was modified to keep the user certificates in non-packaged so this does not change the behavior for native apps (needs openssl 1.1.1g-3) Change-Id: Ic398eec5efa9d036c3b810b7a3bb7142bdeb2d46 Reviewed-on: https://review.haiku-os.org/c/haiku/+/3394 Reviewed-by: Adrien Destugues --- src/kits/network/libnetapi/SecureSocket.cpp | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/src/kits/network/libnetapi/SecureSocket.cpp b/src/kits/network/libnetapi/SecureSocket.cpp index 1aaf9b344e..d8bb5eeecb 100644 --- a/src/kits/network/libnetapi/SecureSocket.cpp +++ b/src/kits/network/libnetapi/SecureSocket.cpp @@ -365,15 +365,7 @@ BSecureSocket::Private::_CreateContext() SSL_CTX_set_cipher_list(sContext, "HIGH:!aNULL:!PSK:!SRP:!MD5:!RC4"); // Setup certificate verification - BPath certificateStore; - find_directory(B_SYSTEM_DATA_DIRECTORY, &certificateStore); - certificateStore.Append("ssl/CARootCertificates.pem"); - - BPath userCertificateStore; - find_directory(B_SYSTEM_NONPACKAGED_DATA_DIRECTORY, &userCertificateStore); - userCertificateStore.Append("ssl/certs/"); - SSL_CTX_load_verify_locations(sContext, certificateStore.Path(), userCertificateStore.Path()); - SSL_CTX_set_verify(sContext, SSL_VERIFY_PEER, VerifyCallback); + SSL_CTX_set_default_verify_file(sContext); // OpenSSL 1.0.2 and later: use the alternate "trusted first" algorithm to // validate certificate chains. This makes the validation stop as soon as a