You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

71 lines
2.3 KiB

diff --git a/sendmail/conf.c b/sendmail/conf.c
index 777e05e..e693ed0 100644
--- a/sendmail/conf.c
+++ b/sendmail/conf.c
@@ -6504,6 +6504,14 @@ char *FFRCompileOptions[] =
/* More STARTTLS options, e.g., secondary certs. */
"_FFR_TLS_1",
#endif /* _FFR_TLS_1 */
+#if _FFR_TLS_USE_CERTIFICATE_CHAIN_FILE
+ /*
+ ** Use SSL_CTX_use_certificate_chain_file()
+ ** instead of SSL_CTX_use_certificate_file()
+ */
+
+ "_FFR_TLS_USE_CERTIFICATE_CHAIN_FILE",
+#endif /* _FFR_TLS_USE_CERTIFICATE_CHAIN_FILE */
#if _FFR_TRUSTED_QF
/*
** If we don't own the file mark it as unsafe.
diff --git a/sendmail/tls.c b/sendmail/tls.c
index 72da987..6707a35 100644
--- a/sendmail/tls.c
+++ b/sendmail/tls.c
@@ -860,17 +860,25 @@ inittls(ctx, req, options, srv, certfile, keyfile, cacertpath, cacertfile, dhpar
if (bitset(TLS_I_USE_KEY, req))
return false;
}
+#if _FFR_TLS_USE_CERTIFICATE_CHAIN_FILE
+# define SSL_CTX_use_cert(ssl_ctx, certfile) \
+ SSL_CTX_use_certificate_chain_file(ssl_ctx, certfile)
+# define SSL_CTX_USE_CERT "SSL_CTX_use_certificate_chain_file"
+#else
+# define SSL_CTX_use_cert(ssl_ctx, certfile) \
+ SSL_CTX_use_certificate_file(ssl_ctx, certfile, SSL_FILETYPE_PEM)
+# define SSL_CTX_USE_CERT "SSL_CTX_use_certificate_file"
+#endif
/* get the certificate file */
if (bitset(TLS_S_CERT_OK, status) &&
- SSL_CTX_use_certificate_file(*ctx, certfile,
- SSL_FILETYPE_PEM) <= 0)
+ SSL_CTX_use_cert(*ctx, certfile) <= 0)
{
if (LogLevel > 7)
{
sm_syslog(LOG_WARNING, NOQID,
- "STARTTLS=%s, error: SSL_CTX_use_certificate_file(%s) failed",
- who, certfile);
+ "STARTTLS=%s, error: %s(%s) failed",
+ who, SSL_CTX_USE_CERT, certfile);
if (LogLevel > 9)
tlslogerr(LOG_WARNING, who);
}
@@ -914,13 +922,13 @@ inittls(ctx, req, options, srv, certfile, keyfile, cacertpath, cacertfile, dhpar
/* get the certificate file */
if (bitset(TLS_S_CERT2_OK, status) &&
- SSL_CTX_use_certificate_file(*ctx, cf2, SSL_FILETYPE_PEM) <= 0)
+ SSL_CTX_use_cert(*ctx, cf2) <= 0)
{
if (LogLevel > 7)
{
sm_syslog(LOG_WARNING, NOQID,
- "STARTTLS=%s, error: SSL_CTX_use_certificate_file(%s) failed",
- who, cf2);
+ "STARTTLS=%s, error: %s(%s) failed",
+ who, SSL_CTX_USE_CERT, cf2);
if (LogLevel > 9)
tlslogerr(LOG_WARNING, who);
}