When no explicit CAs file is set, load the default locations, else there is no way for verification to succeed. This matches the behavior of other TLS backends.
Unified · Split
| @@ -740,6 +740,12 @@ static av_cold int openssl_init_ca_key_cert(URLContext *h) · 739 unmodified lines | ||
| 740 | 740 | if (c->ca_file) { |
| 741 | 741 | if (!SSL_CTX_load_verify_locations(p->ctx, c->ca_file, NULL)) |
| 742 | 742 | av_log(h, AV_LOG_ERROR, "SSL_CTX_load_verify_locations %s\n", openssl_get_error(p)); |
| 743 | + } else { | |
| 744 | + if (!SSL_CTX_set_default_verify_paths(p->ctx)) { | |
| 745 | + // Only log the failure but do not error out, as this is not fatal | |
| 746 | + av_log(h, AV_LOG_WARNING, "Failure setting default verify locations: %s\n", | |
| 747 | + openssl_get_error(p)); | |
| 748 | + } | |
| 743 | 749 | } |
| 744 | 750 | |
| 745 | 751 | if (c->cert_file) { |