s_client ignores CA files in openssldir

[libressl]

s_client ignores CA files in openssldir

[kinichiro]

Hi,

If you move /usr/local/etc/libressl/cert.pem to
/usr/local/etc/libressl/certs/, this issue will be solved.

The cert.pem should be placed into $OPENSSLDIR/certs/ .

In my CentOS7, with OpenSSL 1.0.2, OPENSSLDIR is set to /usr/lib/ssl/
and this directory and certs/ under this directory contain like this.

$ ls /usr/lib/ssl/
certs  misc  openssl.cnf  private
$
ls /usr/lib/ssl/certs/
00673b5b.0
02265526.0
...
9f533518.0
ACCVRAIZ1.pem
ACEDICOM_Root.pem
... (many *.pem files are listed) ...
thawte_Primary_Root_CA.pem
thawte_Primary_Root_CA_-_G2.pem
thawte_Primary_Root_CA_-_G3.pem
$

It seems that both OpenSSL and LibreSSL search CA files
from $OPENSSLDIR/certs/.

BTW, according to tls/Makefile.am,
libtls expect cert.pem is placed under the OPENSSLDIR

...
Makefile.am:libtls_la_CPPFLAGS += -D_PATH_SSL_CA_FILE=\"@OPENSSLDIR@/cert.pem\"
...

This might be a conflict between openssl command and libtls API.

Best Regards,

[kinichiro]

OpenSSL had fixed this by this commit.
openssl/openssl@fe9b85c

[busterb]

Thanks, I forwarded the patch for this to [email protected] for review.

[busterb]

Fix applied, thanks! c69dd72