Skip to content

Commit

Permalink
GnuTLS: Always send client cert
Browse files Browse the repository at this point in the history
TLS servers may request a certificate from the client. This request includes a list of 0 or more acceptable issuer DNs. The client may use this list to determine which certificate to send. GnuTLS's default behavior is to not send a client certificate if there is no match. However, OpenSSL's default behavior is to send the configured certificate. The `GNUTLS_FORCE_CLIENT_CERT` flag mimics OpenSSL behavior.

Fixes curl#1411
  • Loading branch information
jethrogb committed Feb 20, 2020
1 parent 150f45e commit 844f050
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion lib/vtls/gtls.c
Original file line number Diff line number Diff line change
Expand Up @@ -664,7 +664,7 @@ gtls_connect_step1(struct connectdata *conn,
}

/* Initialize TLS session as a client */
init_flags = GNUTLS_CLIENT;
init_flags = GNUTLS_CLIENT | GNUTLS_FORCE_CLIENT_CERT;

#if defined(GNUTLS_NO_TICKETS)
/* Disable TLS session tickets */
Expand Down

0 comments on commit 844f050

Please sign in to comment.