From 0d2c0e67769639924ad2d2e37f7c7d7bee46188b Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Tue, 11 Aug 2015 00:40:27 +0300 Subject: [PATCH] OpenSSL: Fix PKCS#12 extra certificate handling Previously, the possible extra certificate(s) from a PKCS#12 file was added once for each authentication attempt. This resulted in OpenSSL concatenating the certificates multiple time (add one copy for each try during the wpa_supplicant process lifetime). Fix this by clearing the extra chain certificates before adding new ones when using OpenSSL 1.0.1 or newer that include the needed function. Signed-off-by: Jouni Malinen --- src/crypto/tls_openssl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c index fcc5c7fed..d0baea6a9 100644 --- a/src/crypto/tls_openssl.c +++ b/src/crypto/tls_openssl.c @@ -2112,6 +2112,9 @@ static int tls_parse_pkcs12(SSL_CTX *ssl_ctx, SSL *ssl, PKCS12 *p12, } if (certs) { +#if OPENSSL_VERSION_NUMBER >= 0x10001000L + SSL_CTX_clear_extra_chain_certs(ssl_ctx); +#endif /* OPENSSL_VERSION_NUMBER >= 0x10001000L */ while ((cert = sk_X509_pop(certs)) != NULL) { X509_NAME_oneline(X509_get_subject_name(cert), buf, sizeof(buf));