From 80296b4bd502764d00699f0ffe5f65658ffb7142 Mon Sep 17 00:00:00 2001 From: William Lallemand Date: Tue, 5 Apr 2022 10:19:30 +0200 Subject: [PATCH] BUG/MINOR: ssl: handle X509_get_default_cert_dir() returning NULL ssl_store_load_locations_file() is using X509_get_default_cert_dir() when using '@system-ca' as a parameter. This function could return a NULL if OpenSSL was built with a X509_CERT_DIR set to NULL, this is uncommon but let's fix this. No backport needed, 2.6 only. Fix issue #1637. --- src/ssl_ckch.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/ssl_ckch.c b/src/ssl_ckch.c index 438483c95..c047b1c6b 100644 --- a/src/ssl_ckch.c +++ b/src/ssl_ckch.c @@ -1124,7 +1124,7 @@ int ssl_store_load_locations_file(char *path, int create_if_none, enum cafile_ty if (!X509_STORE_load_locations(store, file, NULL)) { goto err; } - } else { + } else if (dir) { int n, i; struct dirent **de_list; @@ -1178,6 +1178,9 @@ scandir_err: } free(de_list); + } else { + ha_alert("ca-file: couldn't load '%s'\n", path); + goto err; } objs = X509_STORE_get0_objects(store);