romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-05-07 03:57:33 +03:00
Code Issues Projects Releases Packages Wiki Activity

sectrust: fix verifystatus via sectrust

Browse source 
When openssl does not verify the certificate, but apple sectrust
does, we also pass it the ocsp stapled response when configured and
available.

When openssl does not verify the cert chain, it will also not be able
to verify the ocsp stapling. Do not call it if sectrust is the
verifier of the cert chain.

Fixes #19307
Reported-by: Harry Sintonen
Closes #19308
This commit is contained in:
Stefan Eissing 2025-10-31 17:57:53 +01:00 • committed by Daniel Stenberg
parent d646d5a130
commit b4630ed8fa
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 11 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
lib/vtls/openssl.c
View file

@ -5155,6 +5155,9 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf,
bool strict = (conn_config->verifypeer || conn_config->verifyhost);
X509 *server_cert;
bool verified = FALSE;
#ifdef USE_APPLE_SECTRUST
bool sectrust_verified = FALSE;
#endif
if(data->set.ssl.certinfo && !octx->reused_session) {
/* asked to gather certificate info. Reused sessions don't have cert
@ -5207,6 +5210,7 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf,
if(verified) {
infof(data, "SSL certificate verified via Apple SecTrust.");
ssl_config->certverifyresult = X509_V_OK;
sectrust_verified = TRUE;
}
}
#endif
@ -5222,7 +5226,13 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf,
}
#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_OCSP)
if(conn_config->verifystatus && !octx->reused_session) {
if(conn_config->verifystatus &&
#ifdef USE_APPLE_SECTRUST
!sectrust_verified && /* already verified via apple sectrust, cannot
* verifystate via OpenSSL in that case as it
* does not have the trust anchors */
#endif
!octx->reused_session) {
/* do not do this after Session ID reuse */
result = verifystatus(cf, data, octx);
if(result)