From cce4d3b0edd98b9b10f62485f01d37b81fd46a00 Mon Sep 17 00:00:00 2001 From: Joshua Rogers Date: Tue, 19 May 2026 23:32:26 +0200 Subject: [PATCH] schannel: fix revoke_best_effort setting for proxy - Fix revoke_best_effort reading wrong ssl config. Prior to this change the revoke_best_effort setting for the proxy was wrongly ignored in favor of the same setting for the destination host. In other words, CURLSSLOPT_REVOKE_BEST_EFFORT set via CURLOPT_PROXY_SSL_OPTIONS did not apply to the proxy and CURLSSLOPT_REVOKE_BEST_EFFORT set via CURLOPT_SSL_OPTIONS wrongly applied to the proxy. Closes https://github.com/curl/curl/pull/21683 --- lib/vtls/schannel_verify.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/vtls/schannel_verify.c b/lib/vtls/schannel_verify.c index 486fd6e005..25b13955f2 100644 --- a/lib/vtls/schannel_verify.c +++ b/lib/vtls/schannel_verify.c @@ -805,7 +805,7 @@ CURLcode Curl_verify_certificate(struct Curl_cfilter *cf, DWORD dwTrustErrorMask = ~(DWORD)(CERT_TRUST_IS_NOT_TIME_NESTED); dwTrustErrorMask &= pSimpleChain->TrustStatus.dwErrorStatus; - if(data->set.ssl.revoke_best_effort) { + if(ssl_config->revoke_best_effort) { /* Ignore errors when root certificates are missing the revocation * list URL, or when the list could not be downloaded because the * server is currently unreachable. */