From 20f331b7072b07e08f9600512356f6cf559cb3a3 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Mon, 24 Aug 2015 19:36:34 +0300 Subject: [PATCH] OpenSSL: Write PKCS#12 extra cert errors into debug log Commit de2a7b796d82d92120aa9532450863f503e1885a ('OpenSSL: Use connection certificate chain with PKCS#12 extra certs') added a new mechanism for doing this with OpenSSL 1.0.2 and newer. However, it did not poinr out anything in debug log if SSL_add1_chain_cert() failed. Add such a debug print and also silence static analyzer warning on res being stored without being read (since the error case is ignored at least for now). Signed-off-by: Jouni Malinen --- src/crypto/tls_openssl.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c index 88bf4104f..8b7b47bc2 100644 --- a/src/crypto/tls_openssl.c +++ b/src/crypto/tls_openssl.c @@ -2237,10 +2237,15 @@ static int tls_parse_pkcs12(struct tls_data *data, SSL *ssl, PKCS12 *p12, wpa_printf(MSG_DEBUG, "TLS: additional certificate" " from PKCS12: subject='%s'", buf); if (SSL_add1_chain_cert(ssl, cert) != 1) { + tls_show_errors(MSG_DEBUG, __func__, + "Failed to add additional certificate"); res = -1; break; } } + if (!res) { + /* Try to continue anyway */ + } sk_X509_free(certs); #ifndef OPENSSL_IS_BORINGSSL res = SSL_build_cert_chain(ssl,