OpenSSL fix empty tls_verify_certificates.

New behaviour matches GnuTLS handling, and is documented.

Previously, a tls_verify_certificates expansion forced failure was the
only portable way to avoid setting this option.  Now, an empty string is
equivalent.

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 9c03523bb828dfe8b9c619843754aa62030f0475..92d0a22879211a7b191de4e1d15406cdd04b08c1 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -16066,6 +16066,9 @@ use OpenSSL with a directory.
 
 See &<<SECTtlssni>>& for discussion of when this option might be re-expanded.
 
+A forced expansion failure or setting to an empty string is equivalent to
+being unset.
+
 
 .option tls_verify_hosts main "host list&!!" unset
 .cindex "TLS" "client certificate verification"

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index c8155aa5c8bcf860b0830c9b49473f83e51b9c1e..a2e204d342d4f8a9c867c20606eae1d6d0d5854c 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -175,6 +175,12 @@ PP/17 Update configure.default to handle IPv6 localhost better.
       Patch by Alain Williams (plus minor tweaks).
       Bugzilla 880.
 
+PP/18 OpenSSL made graceful with empty tls_verify_certificates setting.
+      This is now consistent with GnuTLS, and is now documented: the
+      previous undocumented portable approach to treating the option as
+      unset was to force an expansion failure.  That still works, and
+      an empty string is now equivalent.
+
 
 Exim version 4.80.1
 -------------------

diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index d879f08736e4a19f5a9671978b0048bdefbfe611..42afd3949ec343caa29d5f26e7508114f6b0ddd8 100644 (file)
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -1008,7 +1008,7 @@ uschar *expcerts, *expcrl;
 if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
   return DEFER;
 
-if (expcerts != NULL)
+if (expcerts != NULL && *expcerts != '\0')
   {
   struct stat statbuf;
   if (!SSL_CTX_set_default_verify_paths(sctx))