sample/https-client: use host SSL certificate store by default

Currently a static (Debian) certificate path is used by default, which
can be overridden using the -crt parameter. This commit changes the
default behaviour such that the openssl default certificate store is
used, unless overridden by -crt.

Signed-off-by: David Disseldorp <ddiss@suse.de>

diff --git a/sample/https-client.c b/sample/https-client.c
index 7566683644c2b57ff3b662071a3b0ce83cff2f6f..18cea9063af2c1070c016b7fc02dbea40438266d 100644 (file)
--- a/sample/https-client.c
+++ b/sample/https-client.c
@@ -191,7 +191,7 @@ main(int argc, char **argv)
 
        struct evhttp_uri *http_uri = NULL;
        const char *url = NULL, *data_file = NULL;
-       const char *crt = "/etc/ssl/certs/ca-certificates.crt";
+       const char *crt = NULL;
        const char *scheme, *host, *path, *query;
        char uri[256];
        int port;
@@ -338,11 +338,19 @@ main(int argc, char **argv)
 #ifndef _WIN32
        /* TODO: Add certificate loading on Windows as well */
 
-       /* Attempt to use the system's trusted root certificates.
-        * (This path is only valid for Debian-based systems.) */
-       if (1 != SSL_CTX_load_verify_locations(ssl_ctx, crt, NULL)) {
-               err_openssl("SSL_CTX_load_verify_locations");
-               goto error;
+       if (crt == NULL) {
+               X509_STORE *store;
+               /* Attempt to use the system's trusted root certificates. */
+               store = SSL_CTX_get_cert_store(ssl_ctx);
+               if (X509_STORE_set_default_paths(store) != 1) {
+                       err_openssl("X509_STORE_set_default_paths");
+                       goto error;
+               }
+       } else {
+               if (SSL_CTX_load_verify_locations(ssl_ctx, crt, NULL) != 1) {
+                       err_openssl("SSL_CTX_load_verify_locations");
+                       goto error;
+               }
        }
        /* Ask OpenSSL to verify the server certificate.  Note that this
         * does NOT include verifying that the hostname is correct.