1 files changed, 15 insertions, 0 deletions
diff --git a/Swiften/TLS/OpenSSL/OpenSSLContext.cpp b/Swiften/TLS/OpenSSL/OpenSSLContext.cpp
index d9560de..6dd75d6 100644
--- a/Swiften/TLS/OpenSSL/OpenSSLContext.cpp
+++ b/Swiften/TLS/OpenSSL/OpenSSLContext.cpp
@@ -390,18 +390,33 @@ bool OpenSSLContext::configure(const TLSOptions &options)
     updateOptionIfPresent(options.workaroundTLSBlockPadding, SSL_OP_TLS_BLOCK_PADDING_BUG);
     updateOptionIfPresent(options.workaroundDontInsertEmptyFragments, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
     updateOptionIfPresent(options.workaroundAll, SSL_OP_ALL);
     updateOptionIfPresent(options.suppressSSLv2, SSL_OP_NO_SSLv2);
     updateOptionIfPresent(options.suppressSSLv3, SSL_OP_NO_SSLv3);
     updateOptionIfPresent(options.suppressTLSv1, SSL_OP_NO_TLSv1);
     updateOptionIfPresent(options.disableTLSRollBackBug, SSL_OP_TLS_ROLLBACK_BUG);
     updateOptionIfPresent(options.singleDHUse, SSL_OP_SINGLE_DH_USE);
 
+    if (options.trustAnchors) {
+        // Add any additional Trust Anchors which are present in the TLSOptions
+        X509_STORE* store = SSL_CTX_get_cert_store(context_.get());
+
+        if (store) {
+            for (auto& certificate : *options.trustAnchors) {
+                auto openSSLCert = dynamic_cast<OpenSSLCertificate*>(certificate.get());
+                if (openSSLCert && openSSLCert->getInternalX509()) {
+                    X509_STORE_add_cert(store, openSSLCert->getInternalX509().get());
+                    // Don't need to increment reference count as X509_STORE_add_cert does thiS
+                }
+            }
+        }
+    }
+
     return true;
 }
 
 
 void OpenSSLContext::accept() {
     assert(mode_ == Mode::Server);
     handle_ = std::unique_ptr<SSL>(SSL_new(context_.get()));
     if (!handle_) {
         state_ = State::Error;