romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-04-15 02:11:42 +03:00
Code Issues Projects Releases Packages Wiki Activity

apple-sectrust: always ask when native_ca_store is in use

Browse source 
When OpenSSL fails to verify the peer certificate, we checked for
one specific reason code and did not ask Apple SecTrust for any
other failure.

Always ask Apple SecTrust after OpenSSL fails when the `native_ca_store`
is enabled. If the user configures a CAfile or CApath, the native store
is disabled, so this does not affect use cases where users asks curl
to use a specific set of trust anchors.

Do the same for GnuTLS

Fixes #19636
Reported-by: ffath-vo on github
Closes #19638
This commit is contained in:
Stefan Eissing 2025-11-21 13:06:00 +01:00 • committed by Daniel Stenberg
parent 9e6f1c5efb
commit 6aa8fa3fdf
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 2 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/vtls/gtls.c
View file

@ -1687,8 +1687,7 @@ Curl_gtls_verifyserver(struct Curl_cfilter *cf,
infof(data, " SSL certificate verified by GnuTLS");
#ifdef USE_APPLE_SECTRUST
if(!verified && ssl_config->native_ca_store &&
(verify_status & GNUTLS_CERT_SIGNER_NOT_FOUND)) {
if(!verified && ssl_config->native_ca_store) {
result = glts_apple_verify(cf, data, peer, &chain, &verified);
if(result && (result != CURLE_PEER_FAILED_VERIFICATION))
goto out; /* unexpected error */

4
lib/vtls/openssl.c
View file

@ -4829,9 +4829,7 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf,
infof(data, "SSL certificate verified via OpenSSL.");
#ifdef USE_APPLE_SECTRUST
if(!verified &&
conn_config->verifypeer && ssl_config->native_ca_store &&
(ossl_verify == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY)) {
if(!verified && conn_config->verifypeer && ssl_config->native_ca_store) {
/* we verify using Apple SecTrust *unless* OpenSSL already verified.
* This may happen if the application intercepted the OpenSSL callback
* and installed its own. */