From b7b68166dcbadb1c207b4b6f25b23a18a292da2d Mon Sep 17 00:00:00 2001 From: Alex Bligh Date: Tue, 5 Apr 2016 20:33:48 +0100 Subject: TLS: provide slightly more information when TLS certificate loading fails Give slightly more information when certification loading fails. Rather than have no information, you now get gnutls's only slightly less unhelpful error messages. Signed-off-by: Alex Bligh Signed-off-by: Daniel P. Berrange --- crypto/tlscredsx509.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) (limited to 'crypto/tlscredsx509.c') diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c index 6a0179c2e1..520d34d77e 100644 --- a/crypto/tlscredsx509.c +++ b/crypto/tlscredsx509.c @@ -392,11 +392,14 @@ qcrypto_tls_creds_load_cert(QCryptoTLSCredsX509 *creds, gsize buflen; GError *gerr; int ret = -1; + int err; trace_qcrypto_tls_creds_x509_load_cert(creds, isServer, certFile); - if (gnutls_x509_crt_init(&cert) < 0) { - error_setg(errp, "Unable to initialize certificate"); + err = gnutls_x509_crt_init(&cert); + if (err < 0) { + error_setg(errp, "Unable to initialize certificate: %s", + gnutls_strerror(err)); goto cleanup; } @@ -410,11 +413,13 @@ qcrypto_tls_creds_load_cert(QCryptoTLSCredsX509 *creds, data.data = (unsigned char *)buf; data.size = strlen(buf); - if (gnutls_x509_crt_import(cert, &data, GNUTLS_X509_FMT_PEM) < 0) { + err = gnutls_x509_crt_import(cert, &data, GNUTLS_X509_FMT_PEM); + if (err < 0) { error_setg(errp, isServer ? - "Unable to import server certificate %s" : - "Unable to import client certificate %s", - certFile); + "Unable to import server certificate %s: %s" : + "Unable to import client certificate %s: %s", + certFile, + gnutls_strerror(err)); goto cleanup; } -- cgit v1.2.3