What were you trying to do that didn't work?

Use SSL_add_file_cert_subjects_to_stack or SSL_add_dir_cert_subjects_to_stack with a large number of certificates.

Backport https://github.com/openssl/openssl/commit/5cec58bdfffeff89cce3cfc64e8e2cb709a8fa8e to address this.

Please provide the package NVR for which bug is seen:

openssl-3.2.2-9.el10

How reproducible:

Run the attached reproducer with 1000 or more certificates with different subjects.

Steps to reproduce

1. openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out server.key
2. mkdir -p dir-1000
3. for num in $(seq 0 1000); do openssl req x509 -key server.key -days 365 -subj "$(printf '/CN=host%05d' $num)" -out "$(printf 'certs/%05d.crt' $num)"; done
4. gcc -O3 -fno-omit-frame-pointer -ggdb -o bench bench.c -lssl -lcrypto
5. ./bench 10 dir-1000

See also /CoreOS/tests/stunnel/Regression/RHEL-52321-CAfile-processing-is-slow.

Expected results

Finishes in under 2 seconds

Actual results

Finishes in ~6 seconds