romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-05-01 14:07:51 +03:00
Code Issues Projects Releases Packages Wiki Activity

schannel_verify: use more human friendly error messages

Browse source 
Closes #18737
This commit is contained in:
Daniel Stenberg 2025-09-25 14:52:38 +02:00
parent edbf610c6a
commit bebc8df0f7
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 10 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

23
lib/vtls/schannel_verify.c
View file

@ -889,7 +889,7 @@ CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
NULL,
&pChainContext)) {
char buffer[WINAPI_ERROR_LEN];
failf(data, "schannel: CertGetCertificateChain failed: %s",
failf(data, "schannel: failed to get the certificate chain: %s",
curlx_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
pChainContext = NULL;
result = CURLE_PEER_FAILED_VERIFICATION;
@ -910,23 +910,20 @@ CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
if(dwTrustErrorMask) {
if(dwTrustErrorMask & CERT_TRUST_IS_REVOKED)
failf(data, "schannel: CertGetCertificateChain trust error"
" CERT_TRUST_IS_REVOKED");
failf(data, "schannel: trust for this certificate or one of "
"the certificates in the certificate chain has been revoked");
else if(dwTrustErrorMask & CERT_TRUST_IS_PARTIAL_CHAIN)
failf(data, "schannel: CertGetCertificateChain trust error"
" CERT_TRUST_IS_PARTIAL_CHAIN");
failf(data, "schannel: the certificate chain is incomplete");
else if(dwTrustErrorMask & CERT_TRUST_IS_UNTRUSTED_ROOT)
failf(data, "schannel: CertGetCertificateChain trust error"
" CERT_TRUST_IS_UNTRUSTED_ROOT");
failf(data, "schannel: the certificate or certificate chain is "
"based on an untrusted root");
else if(dwTrustErrorMask & CERT_TRUST_IS_NOT_TIME_VALID)
failf(data, "schannel: CertGetCertificateChain trust error"
" CERT_TRUST_IS_NOT_TIME_VALID");
failf(data, "schannel: this certificate or one of the certificates "
"in the certificate chain is not time valid");
else if(dwTrustErrorMask & CERT_TRUST_REVOCATION_STATUS_UNKNOWN)
failf(data, "schannel: CertGetCertificateChain trust error"
" CERT_TRUST_REVOCATION_STATUS_UNKNOWN");
failf(data, "schannel: the revocation status is unknown");
else
failf(data, "schannel: CertGetCertificateChain error mask: 0x%08lx",
dwTrustErrorMask);
failf(data, "schannel: error 0x%08lx", dwTrustErrorMask);
result = CURLE_PEER_FAILED_VERIFICATION;
}
}