From 02d8206e9d1a17a52a61a58b5f0957fcdeabe28d Mon Sep 17 00:00:00 2001 From: Francesco Cozzuto Date: Mon, 15 Dec 2025 23:08:31 +0100 Subject: [PATCH] Load full certificate chains, not just the leafs --- chttp.c | 4 ++-- src/secure_context.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/chttp.c b/chttp.c index e09c546..43d1778 100644 --- a/chttp.c +++ b/chttp.c @@ -1868,7 +1868,7 @@ int server_secure_context_init(ServerSecureContext *ctx, key_buffer[key_file.len] = '\0'; // Load certificate and private key - if (SSL_CTX_use_certificate_file(p, cert_buffer, SSL_FILETYPE_PEM) != 1) { + if (SSL_CTX_use_certificate_chain_file(p, cert_buffer) != 1) { SSL_CTX_free(p); return -1; } @@ -1938,7 +1938,7 @@ int server_secure_context_add_certificate(ServerSecureContext *ctx, memcpy(key_buffer, key_file.ptr, key_file.len); key_buffer[key_file.len] = '\0'; - if (SSL_CTX_use_certificate_file(p, cert_buffer, SSL_FILETYPE_PEM) != 1) { + if (SSL_CTX_use_certificate_chain_file(p, cert_buffer) != 1) { SSL_CTX_free(p); return -1; } diff --git a/src/secure_context.c b/src/secure_context.c index b068592..2cd0541 100644 --- a/src/secure_context.c +++ b/src/secure_context.c @@ -103,7 +103,7 @@ int server_secure_context_init(ServerSecureContext *ctx, key_buffer[key_file.len] = '\0'; // Load certificate and private key - if (SSL_CTX_use_certificate_file(p, cert_buffer, SSL_FILETYPE_PEM) != 1) { + if (SSL_CTX_use_certificate_chain_file(p, cert_buffer) != 1) { SSL_CTX_free(p); return -1; } @@ -173,7 +173,7 @@ int server_secure_context_add_certificate(ServerSecureContext *ctx, memcpy(key_buffer, key_file.ptr, key_file.len); key_buffer[key_file.len] = '\0'; - if (SSL_CTX_use_certificate_file(p, cert_buffer, SSL_FILETYPE_PEM) != 1) { + if (SSL_CTX_use_certificate_chain_file(p, cert_buffer) != 1) { SSL_CTX_free(p); return -1; }