Issue: OpenSSL tls_connection_set_params() replaces the context-wide trust store

[Karsten Sperling]

tls_connection_ca_cert() in src/crypto/tls_openssl.c installs a brand-new, empty X509_STORE on the context-wide SSL_CTX before it has looked at any of its arguments.

Because tls_connection_set_params() calls it unconditionally, a per-connection tls_connection_set_params() call removes the trusted-CA set of every other connection sharing that tls_ctx. When params supplies no ca_cert, ca_cert_blob or ca_path, nothing reloads anything and the store is simply left empty.

Every other per-connection setting applied by tls_connection_set_params() is scoped to conn->ssl (e.g. SSL_use_certificate_ASN1(), SSL_use_PrivateKey_*(), SSL_set1_curves_list(), ...), so the CA handling is the odd one out.

One case where this is reachable today: src/radius/radius_client.c creates both auth_tls_conn and acct_tls_conn from a single radius->tls_ctx (:1892) and calls tls_connection_set_params() per connection with that server's own ca_cert (:1376-1389). If the auth connection's handshake is still in flight when the accounting connection is set up, the auth connection's certificate verification runs against the accounting server's trust store, and vice versa.

Checked against main at eaa647bb8: tls_connection_ca_cert() at src/crypto/tls_openssl.c:3119, store installed at :3137, called unconditionally from tls_connection_set_params() at :5809.