Skip to content

Commit 074b7af

Browse files
nornagontargos
authored andcommitted
crypto: enable auto cert chaining for BoringSSL
OpenSSL enables this feature by default, but BoringSSL doesn't. This change makes it so that when building node with BoringSSL, the behaviour matches OpenSSL's. PR-URL: #22110 Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: Ujjwal Sharma <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]>
1 parent fb03faa commit 074b7af

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

src/node_crypto.cc

+5
Original file line numberDiff line numberDiff line change
@@ -463,6 +463,11 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
463463
SSL_CTX_set_options(sc->ctx_.get(), SSL_OP_NO_SSLv2);
464464
SSL_CTX_set_options(sc->ctx_.get(), SSL_OP_NO_SSLv3);
465465

466+
// Enable automatic cert chaining. This is enabled by default in OpenSSL, but
467+
// disabled by default in BoringSSL. Enable it explicitly to make the
468+
// behavior match when Node is built with BoringSSL.
469+
SSL_CTX_clear_mode(sc->ctx_.get(), SSL_MODE_NO_AUTO_CHAIN);
470+
466471
// SSL session cache configuration
467472
SSL_CTX_set_session_cache_mode(sc->ctx_.get(),
468473
SSL_SESS_CACHE_SERVER |

0 commit comments

Comments
 (0)