expose the default cert file as a function, not a define. it's really

an internal detail of the library, so the string should live inside it,
not in the application code.
ok jsing

1 files changed, 2 insertions, 2 deletions

diff --git a/src/lib/libtls/tls.c b/src/lib/libtls/tls.c
index 4362c60c80..bf1d9da81e 100644
--- a/src/lib/libtls/tls.c
+++ b/src/lib/libtls/tls.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls.c,v 1.81 2018/11/06 20:34:54 jsing Exp $ */
+/* $OpenBSD: tls.c,v 1.82 2018/11/29 14:24:23 tedu Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -501,7 +501,7 @@ tls_configure_ssl_verify(struct tls *ctx, SSL_CTX *ssl_ctx, int verify)
 
         /* If no CA has been specified, attempt to load the default. */
         if (ctx->config->ca_mem == NULL && ctx->config->ca_path == NULL) {
-                if (tls_config_load_file(&ctx->error, "CA", TLS_CA_CERT_FILE,
+                if (tls_config_load_file(&ctx->error, "CA", tls_default_ca_cert_file(),
                     &ca_mem, &ca_len) != 0)
                         goto err;
                 ca_free = ca_mem;