romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-27 21:53:06 +03:00
Code Issues Projects Releases Packages Wiki Activity

schannel: enforce Extended Key Usage for custom CA roots

Browse source 
Reported-by: Joshua Rogers (Aisle Research)

Closes #21629
This commit is contained in:
Viktor Szakats 2026-05-15 13:26:05 +02:00
parent d9514e3b92
commit 3f8f725d97
No known key found for this signature in database
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/vtls/schannel_verify.c
View file

@ -776,9 +776,13 @@ CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
if(result == CURLE_OK) {
CERT_CHAIN_PARA ChainPara;
LPSTR serverAuthOID = CURL_UNCONST(szOID_PKIX_KP_SERVER_AUTH);
memset(&ChainPara, 0, sizeof(ChainPara));
ChainPara.cbSize = sizeof(ChainPara);
ChainPara.RequestedUsage.dwType = USAGE_MATCH_TYPE_AND;
ChainPara.RequestedUsage.Usage.cUsageIdentifier = 1;
ChainPara.RequestedUsage.Usage.rgpszUsageIdentifier = &serverAuthOID;
if(!CertGetCertificateChain(cert_chain_engine,
pCertContextServer,