Fix a bug loading the default certificate path locations.

The files would only be loaded if the CAfile or CApath locations were
succesfully loaded first. Original patch from OpenSSL:

https://github.com/openssl/openssl/commit/fe9b85c3cb79f1e29e61f01de105b34ce8177190

ok beck@

1 files changed, 7 insertions, 9 deletions

diff --git a/src/usr.bin/openssl/s_client.c b/src/usr.bin/openssl/s_client.c
index 471a5e3c5c..b35fa8c3fc 100644
--- a/src/usr.bin/openssl/s_client.c
+++ b/src/usr.bin/openssl/s_client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s_client.c,v 1.27 2015/12/01 12:01:56 jca Exp $ */
+/* $OpenBSD: s_client.c,v 1.28 2016/06/21 03:56:43 bcook Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -728,15 +728,13 @@ bad:
         if (!set_cert_key_stuff(ctx, cert, key))
                 goto end;
 
-        if ((!SSL_CTX_load_verify_locations(ctx, CAfile, CApath)) ||
-            (!SSL_CTX_set_default_verify_paths(ctx))) {
-                /*
-                 * BIO_printf(bio_err,"error setting default verify
-                 * locations\n");
-                 */
+        if ((CAfile || CApath)
+            && !SSL_CTX_load_verify_locations(ctx, CAfile, CApath))
                 ERR_print_errors(bio_err);
-                /* goto end; */
-        }
+
+        if (!SSL_CTX_set_default_verify_paths(ctx))
+                ERR_print_errors(bio_err);
+
         if (servername != NULL) {
                 tlsextcbp.biodebug = bio_err;
                 SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb);