[gnurl] 85/411: openssl: avoid error conditions when importing native CA

[gnunet]

This is an automated email from the git hooks/post-receive script.

nikita pushed a commit to branch master
in repository gnurl.

commit b3fbb2fb9dde9ab93db67a7ccc2130e68714016b
Author: Daniel Stenberg <daniel@haxx.se>
AuthorDate: Wed Sep 2 15:26:09 2020 +0200

    openssl: avoid error conditions when importing native CA
    
    The code section that is OpenSSL 3+ specific now uses the same logic as
    is used in the version < 3 section. It caused a compiler error without
    it.
    
    Closes #5907
---
 lib/vtls/openssl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
index ce6f8445a..5d3da8234 100644
--- a/lib/vtls/openssl.c
+++ b/lib/vtls/openssl.c
@@ -2993,7 +2993,7 @@ static CURLcode ossl_connect_step1(struct connectdata 
*conn, int sockindex)
   {
     if(ssl_cafile) {
       if(!SSL_CTX_load_verify_file(backend->ctx, ssl_cafile)) {
-        if(verifypeer) {
+        if(verifypeer && !imported_native_ca) {
           /* Fail if we insist on successfully verifying the server. */
           failf(data, "error setting certificate file: %s", ssl_cafile);
           return CURLE_SSL_CACERT_BADFILE;
@@ -3005,7 +3005,7 @@ static CURLcode ossl_connect_step1(struct connectdata 
*conn, int sockindex)
     }
     if(ssl_capath) {
       if(!SSL_CTX_load_verify_dir(backend->ctx, ssl_capath)) {
-        if(verifypeer) {
+        if(verifypeer && !imported_native_ca) {
           /* Fail if we insist on successfully verifying the server. */
           failf(data, "error setting certificate path: %s", ssl_capath);
           return CURLE_SSL_CACERT_BADFILE;

-- 
To stop receiving notification emails like this one, please contact
gnunet@gnunet.org.