diff options
| author | Fabian Mauchle <fabian.mauchle@switch.ch> | 2017-03-24 11:05:18 +0100 |
|---|---|---|
| committer | Linus Nordberg <linus@nordu.net> | 2017-08-01 17:28:23 +0200 |
| commit | d2fa6c90f3167d1e42ea54e75c373066ba889542 (patch) | |
| tree | 98d7eefa488cc4b147fd287344f1cdf92dfac672 | |
| parent | 4881e8b065767b29fd45294ad8321c6f5029a51b (diff) | |
create new cert_store before reloading CAs and CRLs
| -rw-r--r-- | ChangeLog | 1 | ||||
| -rw-r--r-- | tlscommon.c | 1 |
2 files changed, 2 insertions, 0 deletions
@@ -20,6 +20,7 @@ Changes between 1.6.8 and the master branch - Don't use a smaller pthread stack size than what's allowed. - Don't follow NULL the pointer at debug level 5 (RADSECPROXY-68). - Avoid a deadlock situation with dynamic servers (RADSECPROXY-73). + - Completely reload CAs and CRLs with cacheExpiry (RADSECPROXY-50). 2016-09-21 1.6.8 Bug fixes: diff --git a/tlscommon.c b/tlscommon.c index f71cc11..842b955 100644 --- a/tlscommon.c +++ b/tlscommon.c @@ -153,6 +153,7 @@ static int tlsaddcacrl(SSL_CTX *ctx, struct tls *conf) { X509_STORE *x509_s; unsigned long error; + SSL_CTX_set_cert_store(ctx, X509_STORE_new()); if (!SSL_CTX_load_verify_locations(ctx, conf->cacertfile, conf->cacertpath)) { while ((error = ERR_get_error())) debug(DBG_ERR, "SSL: %s", ERR_error_string(error, NULL)); |