romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-25 02:37:18 +03:00
Code Issues Projects Releases Packages Wiki Activity

gnutls/wolfssl: improve error message when certificate fails

Browse source 
Give more detailed reasons for certificate failures where available in
gnutls and wolfssi to allow user to understand the cause of the failure.

Closes #14501
This commit is contained in:
Stefan Eissing 2024-08-12 12:21:38 +02:00 • committed by Daniel Stenberg
parent 6905b1f867
commit 623b877504
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 21 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

17
lib/vtls/gtls.c
View file

@ -340,7 +340,7 @@ static CURLcode handshake(struct Curl_cfilter *cf,
if(!strerr)
strerr = gnutls_strerror(rc);
failf(data, "gnutls_handshake() failed: %s", strerr);
failf(data, "GnuTLS, handshake failed: %s", strerr);
return CURLE_SSL_CONNECT_ERROR;
}
@ -1295,9 +1295,18 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
/* verify_status is a bitmask of gnutls_certificate_status bits */
if(verify_status & GNUTLS_CERT_INVALID) {
if(config->verifypeer) {
failf(data, "server certificate verification failed. CAfile: %s "
"CRLfile: %s", config->CAfile ? config->CAfile:
"none",
const char *cause = "certificate error, no details available";
if(verify_status & GNUTLS_CERT_EXPIRED)
cause = "certificate has expired";
else if(verify_status & GNUTLS_CERT_SIGNER_NOT_FOUND)
cause = "certificate signer not trusted";
else if(verify_status & GNUTLS_CERT_INSECURE_ALGORITHM)
cause = "certificate uses insecure algorithm";
else if(verify_status & GNUTLS_CERT_INVALID_OCSP_STATUS)
cause = "attached OCSP status response is invalid";
failf(data, "server verification failed: %s. (CAfile: %s "
"CRLfile: %s)", cause,
config->CAfile ? config->CAfile: "none",
ssl_config->primary.CRLfile ?
ssl_config->primary.CRLfile : "none");
return CURLE_PEER_FAILED_VERIFICATION;

8
lib/vtls/wolfssl.c
View file

@ -1306,6 +1306,14 @@ wolfssl_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
"continuing anyway");
}
}
else if(ASN_AFTER_DATE_E == detail) {
failf(data, "server verification failed: certificate has expired.");
return CURLE_PEER_FAILED_VERIFICATION;
}
else if(ASN_BEFORE_DATE_E == detail) {
failf(data, "server verification failed: certificate not valid yet.");
return CURLE_PEER_FAILED_VERIFICATION;
}
#ifdef USE_ECH
else if(-1 == detail) {
/* try access a retry_config ECHConfigList for tracing */