diff --git a/src/ssl_ckch.c b/src/ssl_ckch.c index b178078d8..4fb119718 100644 --- a/src/ssl_ckch.c +++ b/src/ssl_ckch.c @@ -647,6 +647,15 @@ int ssl_sock_load_pem_into_ckch(const char *path, char *buf, struct ckch_data *d } } + /* If we couldn't find a chain, we should try to look for a corresponding chain in 'issuers-chain-path' */ + if (chain == NULL) { + struct issuer_chain *issuer_chain; + issuer_chain = ssl_get0_issuer_chain(cert); + if (issuer_chain) { + chain = X509_chain_up_ref(issuer_chain->chain); + } + } + ret = ERR_get_error(); if (ret && !(ERR_GET_LIB(ret) == ERR_LIB_PEM && ERR_GET_REASON(ret) == PEM_R_NO_START_LINE)) { memprintf(err, "%sunable to load certificate chain from file '%s': %s\n", diff --git a/src/ssl_sock.c b/src/ssl_sock.c index 08aa28273..904aa3a75 100644 --- a/src/ssl_sock.c +++ b/src/ssl_sock.c @@ -2613,12 +2613,6 @@ static int ssl_sock_load_cert_chain(const char *path, const struct ckch_data *da if (data->chain) { *find_chain = X509_chain_up_ref(data->chain); - } else { - /* Find Certificate Chain in global */ - struct issuer_chain *issuer; - issuer = ssl_get0_issuer_chain(data->cert); - if (issuer) - *find_chain = X509_chain_up_ref(issuer->chain); } if (!*find_chain) {