From 9f45fba09ae8169a1ff8d9e2417f22648d8ded19 Mon Sep 17 00:00:00 2001
From: carpentry-agent <noreply@carpentry-agent.dev>
Date: Fri, 5 Jun 2026 13:13:46 +0200
Subject: [PATCH] Use certificate_chain_file for intermediate cert support

SSL_CTX_use_certificate_file only loads a single certificate.
Switch to SSL_CTX_use_certificate_chain_file so intermediate
certificates in the PEM file are preserved during the TLS
handshake.
---
 src/tls_stream.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/tls_stream.h b/src/tls_stream.h
index 13b781f..05a6c5d 100644
--- a/src/tls_stream.h
+++ b/src/tls_stream.h
@@ -332,7 +332,7 @@ TlsServerCtx TlsServerCtx_create_(String *cert_file, String *key_file) {
   SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);
   carp_tls_harden_ctx(ctx);
 
-  if (SSL_CTX_use_certificate_file(ctx, *cert_file, SSL_FILETYPE_PEM) <= 0) {
+  if (SSL_CTX_use_certificate_chain_file(ctx, *cert_file) <= 0) {
     carp_tls_capture_ssl_error(SSL_ERROR_SSL);
     SSL_CTX_free(ctx);
     return sc;