.include directive with relative path should print a warning when OPENSSL_CONF_INCLUDE env. var. is not defined

[leorge]

Hi, try the following commands.

$ touch a.cnf
$ mkdir sub1 && cd $_
$ echo ".include ../a.cnf" > b.cnf
$ mkdir sub2 && cd $_
$ echo ".include ../b.cnf" > c.cnf
$ openssl ca -config ./c.cnf
      (Error messages like the next)
$ openssl ca -config ../b.cnf
Using configuration from ../b.cnf
variable lookup failed for ca::default_ca
4007E9D4017F0000:error:80000002:system library:process_include:No such file or directory:../crypto/conf/conf_def.c:822:calling stat(../a.cnf)
4007E9D4017F0000:error:0700006C:configuration file routines:NCONF_get_string:no value:../crypto/conf/conf_lib.c:315:group=ca name=default_ca

../a.cnf can't be found.

Version: OpenSSL 3.0.15 3 Sep 2024 (Library: OpenSSL 3.0.15 3 Sep 2024)

[Sashan]

If relative paths are used in .include directives then OPENSSL_CONF_INCLUDE env. var, should be defined so openssl knows where to find included files. Quoting from config(ossl5) manpage:

     As a general rule, the pathname should be an absolute path; this can be
     enforced with the abspath and includedir pragmas, described below.  The
     environment variable OPENSSL_CONF_INCLUDE, if it exists, is prepended to
     all relative pathnames.  If the pathname is still relative, it is
     interpreted based on the current working directory.

I agree openssl can be more friendly here and throw a warning an relative path is being used without OPENSSL_CONF_INCLUDE being defined.

[leorge]

Thank you very much.
My study was not enough.

[t8m]

Please note we are looking for community help implementing this issue. Please comment if you are interested in implementing this feature or if you have reasons why this feature is important enough so we should consider implementing it with higher priority than other requested features. The issue will be closed after 2 months otherwise.