Fix set_ca_cert_store() to skip system certs like set_ca_cert_path() (#2335)

Both APIs conceptually do the same thing: "use these CA certs for
verification." However, set_ca_cert_store() falls through to the else
branch in load_certs() where system certs are added to the user's
custom store, defeating the purpose of certificate pinning.

This change makes set_ca_cert_store() behave consistently with
set_ca_cert_path() by checking ca_cert_store_ before loading system
certificates.

Added test to verify system certs are not loaded when custom store is set.

Co-authored-by: Your <you@example.com>
This commit is contained in:
Sung Po-HanandYour authored and GitHub committed 2026-01-22 18:58:25 -05:00
1 parent f73e694f0c
commit c3fa06112b
2 files changed
+22 -1

No files matched your search

+1 -1
View File
@@ -13095,7 +13095,7 @@ inline bool SSLClient::load_certs() {
last_openssl_error_ = ERR_get_error();
ret = false;
}
} else {
} else if (!ca_cert_store_) {
auto loaded = false;
#ifdef _WIN32
loaded =