afclient: support loading complete cert-chains from cerfile.

This makes x.509 certification more usable/maintainable,
because the intermediate CA keys don't all need to be
maintained on the server (the certification tools just need
to concatenate the CA chain onto the APF-client certificates
as part of the certification-process).

1 files changed, 1 insertions, 1 deletions

diff --git a/src/afclient.c b/src/afclient.c
index fbafcc1..5a823eb 100644
--- a/src/afclient.c
+++ b/src/afclient.c
@@ -708,7 +708,7 @@ main(int argc, char **argv)
 
     certif = ClientConfiguration_get_certificateFile(cconfig);
     if (certif) {
-      if (SSL_CTX_use_certificate_file(ctx, certif, SSL_FILETYPE_PEM) != 1) {
+      if (SSL_CTX_use_certificate_chain_file(ctx, certif) != 1) {
         aflog(LOG_T_INIT, LOG_I_CRIT,
             "Setting certificate failed (%s)... exiting", certif);
         exit(1);