From 52a9d2ad07876e622df3874a2076724eed563c5b Mon Sep 17 00:00:00 2001
From: Alexander Borsuk <me@alex.bio>
Date: Tue, 21 Jan 2020 16:35:22 +0100
Subject: [PATCH] OpenSSL: Support self-signed certificates at depth 0

When libcoap config allows self-signed certificates (*) the library should
also accept self-signed certificates at depth 0. This is achieved by allowing
X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT [1].

(*) coap_dtls_pki_t.allow_self_signed == 1
[1] https://www.openssl.org/docs/man1.1.0/man3/X509_STORE_CTX_get_error_depth.html
---
 src/coap_openssl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/coap_openssl.c b/src/coap_openssl.c
index fd2aecf5..a44f81b9 100644
--- a/src/coap_openssl.c
+++ b/src/coap_openssl.c
@@ -1418,6 +1418,7 @@ tls_verify_call_back(int preverify_ok, X509_STORE_CTX *ctx) {
       if (setup_data->allow_expired_certs)
         preverify_ok = 1;
       break;
+    case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
     case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
       if (setup_data->allow_self_signed)
         preverify_ok = 1;