romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-06 10:46:18 +03:00
Code Issues Projects Releases Packages Wiki Activity

schannel: error on TLS 1.3-only with cipher list

Browse source 
The legacy SCHANNEL_CRED path cannot negotiate TLS 1.3. When TLS 1.3
is the only enabled protocol and a cipher list is set, fail instead of
silently downgrading to TLS 1.2.

Fixes https://github.com/curl/curl/issues/21702
Closes https://github.com/curl/curl/pull/21725
This commit is contained in:
Joshua Rogers 2026-05-22 09:59:17 +02:00 • committed by Jay Satiro
parent 2ba0a0e41e
commit fc90bdbaf9
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
lib/vtls/schannel.c
View file

@ -654,6 +654,11 @@ static CURLcode acquire_sspi_handle(struct Curl_cfilter *cf,
if(ciphers) {
if((enabled_protocols & SP_PROT_TLS1_3_CLIENT)) {
if(!(enabled_protocols & ~SP_PROT_TLS1_3_CLIENT)) {
failf(data, "schannel: TLS 1.3 is not supported with a cipher list; "
"remove the cipher list or allow a lower TLS version");
return CURLE_SSL_CONNECT_ERROR;
}
infof(data, "schannel: WARNING: This version of Schannel "
"negotiates a less-secure TLS version than TLS 1.3 because the "
"user set an algorithm cipher list.");