romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-05 01:16:19 +03:00
Code Issues Projects Releases Packages Wiki Activity

schannel: allow partial chains for manual peer verification

Browse source 
- Align --cacert behaviour with OpenSSL and LibreSSL.

This changes the default behavior of Schannel manual certificate
verification, which is used when the user provides their own CA
certificates for verification, to accept partial chains. In other words,
the user may provide an intermediate certificate without having to
provide the root CA.

Win8/Server2012 widened the PKIX chain traversal API to allow
certificate traversal to terminate at an intermediate.

This behaviour (terminate at the fist matching intermediate) is the
default for LibreSSL and OpenSSL (with OpenSSL allowing control via
CURLSSLOPT_NO_PARTIALCHAIN).

This change uses the new API if it is available, and also allows the
behaviour to revert legacy if CURLSSLOPT_NO_PARTIALCHAIN is present.

Closes https://github.com/curl/curl/pull/17418
This commit is contained in:
Rod Widdowson 2025-05-21 20:10:36 +01:00 • committed by Jay Satiro
parent 49a0c27bbc
commit df1ff17f88
3 changed files with 48 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/libcurl/opts/CURLOPT_PROXY_SSL_OPTIONS.md
View file

@ -55,9 +55,13 @@ Untrusted Publishers block list which it seems cannot be bypassed. (Added in
## CURLSSLOPT_NO_PARTIALCHAIN
Tells libcurl to not accept "partial" certificate chains, which it otherwise
does by default. This option is only supported for OpenSSL and fails the
certificate verification if the chain ends with an intermediate certificate
and not with a root cert. (Added in 7.68.0)
does by default. This option fails the certificate verification if the chain
ends with an intermediate certificate and not with a root cert.
Works with OpenSSL and its forks (LibreSSL, BoringSSL, etc). (Added in 7.68.0)
Works with Schannel if the user specified certificates to verify the peer.
(Added in 8.15.0)
## CURLSSLOPT_REVOKE_BEST_EFFORT

10
docs/libcurl/opts/CURLOPT_SSL_OPTIONS.md
View file

@ -53,9 +53,13 @@ Untrusted Publishers block list which it seems cannot be bypassed. (Added in
## CURLSSLOPT_NO_PARTIALCHAIN
Tells libcurl to not accept "partial" certificate chains, which it otherwise
does by default. This option is only supported for OpenSSL and fails the
certificate verification if the chain ends with an intermediate certificate
and not with a root cert. (Added in 7.68.0)
does by default. This option fails the certificate verification if the chain
ends with an intermediate certificate and not with a root cert.
Works with OpenSSL and its forks (LibreSSL, BoringSSL, etc). (Added in 7.68.0)
Works with Schannel if the user specified certificates to verify the peer.
(Added in 8.15.0)
## CURLSSLOPT_REVOKE_BEST_EFFORT