1 files changed, 17 insertions, 19 deletions

diff --git a/src/stls/stls_client_init_and_handshake.c b/src/stls/stls_client_init_and_handshake.c
index 173942f..f0cc5be 100644
--- a/src/stls/stls_client_init_and_handshake.c
+++ b/src/stls/stls_client_init_and_handshake.c
@@ -22,6 +22,21 @@ struct tls *stls_client_init_and_handshake (int const *fds, uint32_t preoptions,
   cfg = tls_config_new() ;
   if (!cfg) strerr_diefu1sys(111, "tls_config_new") ;
 
+  if (preoptions & 1)
+  {
+    x = getenv("CERTFILE") ;
+    if (!x) strerr_dienotset(100, "CERTFILE") ;
+    if (tls_config_set_cert_file(cfg, x) < 0)
+      diecfg(cfg, "tls_config_set_cert_file") ;
+
+    x = getenv("KEYFILE") ;
+    if (!x) strerr_dienotset(100, "KEYFILE") ;
+    if (tls_config_set_key_file(cfg, x) < 0)
+      diecfg(cfg, "tls_config_set_key_file") ;
+  }
+
+  stls_drop() ;
+
   x = getenv("CADIR") ;
   if (x)
   {
@@ -36,24 +51,9 @@ struct tls *stls_client_init_and_handshake (int const *fds, uint32_t preoptions,
       if (tls_config_set_ca_file(cfg, x) < 0)
         diecfg(cfg, "tls_config_set_ca_file") ;
     }
-    else strerr_dief1x(100, "no trust anchor found - please set CADIR or CAFILE") ;
+    else strerr_diefu1x(100, "get trust anchor list: neither CADIR nor CAFILE is set") ;
   }
 
-  if (preoptions & 1)
-  {
-    x = getenv("CERTFILE") ;
-    if (!x) strerr_dienotset(100, "CERTFILE") ;
-    if (tls_config_set_cert_file(cfg, x) < 0)
-      diecfg(cfg, "tls_config_set_cert_file") ;
-
-    x = getenv("KEYFILE") ;
-    if (!x) strerr_dienotset(100, "KEYFILE") ;
-    if (tls_config_set_key_file(cfg, x) < 0)
-      diecfg(cfg, "tls_config_set_key_file") ;
-  }
-
-  stls_drop() ;
-
   if (tls_config_set_ciphers(cfg, "secure") < 0)
     diecfg(cfg, "tls_config_set_ciphers") ;
 
@@ -75,8 +75,6 @@ struct tls *stls_client_init_and_handshake (int const *fds, uint32_t preoptions,
   if (tls_connect_fds(ctx, fds[0], fds[1], servername) < 0)
     diectx(97, ctx, "tls_connect_fds") ;
   tls_config_free(cfg) ;
-  strerr_warn1x("before handshake") ;
-  if (tls_handshake(ctx) < 0) diectx(97, ctx, "perform SSL handshake") ;
-  strerr_warn1x("after handshake") ;
+  if (tls_handshake(ctx) < 0) diectx(97, ctx, "tls_handshake") ;
   return ctx ;
 }