BUG/MINOR: ssl/cli: can't find ".crt" files when replacing a certificate

Bug was introduced by commit 26654 ("MINOR: ssl: add "crt" in the
cert_exts array").

When looking for a .crt directly in the cert_exts array, the
ssl_sock_load_pem_into_ckch() function will be called with a argument
which does not have its ".crt" extensions anymore.

If "ssl-load-extra-del-ext" is used this is not a problem since we try
to add the ".crt" when doing the lookup in the tree.

However when using directly a ".crt" without this option it will failed
looking for the file in the tree.

The fix removes the "crt" entry from the array since it does not seem to
be really useful without a rework of all the lookups.

Should fix issue #2265

Must be backported as far as 2.6.
This commit is contained in:
William Lallemand
2023-08-28 17:12:14 +02:00
parent 0074c36dd2
commit e7d9082315
4 changed files with 91 additions and 2 deletions

View File

@@ -139,7 +139,6 @@ struct cafile_entry {
enum {
CERT_TYPE_PEM = 0,
CERT_TYPE_CRT,
CERT_TYPE_KEY,
#if ((defined SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB && !defined OPENSSL_NO_OCSP) || defined OPENSSL_IS_BORINGSSL)
CERT_TYPE_OCSP,