Conditionally compile TLS-PSK code (--enable-tls-psk).

Also, allow for PSK-only configuration, i.e. don't barf on missing cert stuff.

1 files changed, 9 insertions, 8 deletions

diff --git a/lib/rsp_tlscommon.c b/lib/rsp_tlscommon.c
index a34fe33..75aa891 100644
--- a/lib/rsp_tlscommon.c
+++ b/lib/rsp_tlscommon.c
@@ -271,14 +271,15 @@ static SSL_CTX *tlscreatectx(uint8_t type, struct tls *conf) {
 	}
     }
 
-    if (!tlsaddcacrl(ctx, conf)) {
-	if (conf->vpm) {
-	    X509_VERIFY_PARAM_free(conf->vpm);
-	    conf->vpm = NULL;
-	}
-	SSL_CTX_free(ctx);
-	return NULL;
-    }
+    if (conf->cacertfile != NULL || conf->cacertpath != NULL)
+        if (!tlsaddcacrl(ctx, conf)) {
+            if (conf->vpm) {
+                X509_VERIFY_PARAM_free(conf->vpm);
+                conf->vpm = NULL;
+            }
+            SSL_CTX_free(ctx);
+            return NULL;
+        }
 
     debug(DBG_DBG, "tlscreatectx: created TLS context %s", conf->name);
     return ctx;