From 3f8f725d970452356256b0f9c6520ee666553fb8 Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Fri, 15 May 2026 13:26:05 +0200
Subject: [PATCH] schannel: enforce Extended Key Usage for custom CA roots

Reported-by: Joshua Rogers (Aisle Research)

Closes #21629
---
 lib/vtls/schannel_verify.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/vtls/schannel_verify.c b/lib/vtls/schannel_verify.c
index d613186253..486fd6e005 100644
--- a/lib/vtls/schannel_verify.c
+++ b/lib/vtls/schannel_verify.c
@@ -776,9 +776,13 @@ CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
 
   if(result == CURLE_OK) {
     CERT_CHAIN_PARA ChainPara;
+    LPSTR serverAuthOID = CURL_UNCONST(szOID_PKIX_KP_SERVER_AUTH);
 
     memset(&ChainPara, 0, sizeof(ChainPara));
     ChainPara.cbSize = sizeof(ChainPara);
+    ChainPara.RequestedUsage.dwType = USAGE_MATCH_TYPE_AND;
+    ChainPara.RequestedUsage.Usage.cUsageIdentifier = 1;
+    ChainPara.RequestedUsage.Usage.rgpszUsageIdentifier = &serverAuthOID;
 
     if(!CertGetCertificateChain(cert_chain_engine,
                                 pCertContextServer,