Skip to content
  • Dan McNulty's avatar
    schannel: add support for CURLOPT_CAINFO · 89963002
    Dan McNulty authored
    - Move verify_certificate functionality in schannel.c into a new
      file called schannel_verify.c. Additionally, some structure defintions
      from schannel.c have been moved to schannel.h to allow them to be
      used in schannel_verify.c.
    
    - Make verify_certificate functionality for Schannel available on
      all versions of Windows instead of just Windows CE. verify_certificate
      will be invoked on Windows CE or when the user specifies
      CURLOPT_CAINFO and CURLOPT_SSL_VERIFYPEER.
    
    - In verify_certificate, create a custom certificate chain engine that
      exclusively trusts the certificate store backed by the CURLOPT_CAINFO
      file.
    
    - doc updates of --cacert/CAINFO support for schannel
    
    - Use CERT_NAME_SEARCH_ALL_NAMES_FLAG when invoking CertGetNameString
      when available. This implements a TODO in schannel.c to improve
      handling of multiple SANs in a certificate. In particular, all SANs
      will now be searched instead of just the first name.
    
    - Update tool_operate.c to not search for the curl-ca-bundle.crt file
      when using Schannel to maintain backward compatibility. Previously,
      any curl-ca-bundle.crt file found in that search would have been
      ignored by Schannel. But, with CAINFO support, the file found by
      that search would have been used as the certificate store and
      could cause issues for any users that have curl-ca-bundle.crt in
      the search path.
    
    - Update url.c to not set the build time CURL_CA_BUNDLE if the selected
      SSL backend is Schannel. We allow setting CA location for schannel
      only when explicitly specified by the user via CURLOPT_CAINFO /
      --cacert.
    
    - Add new test cases 3000 and 3001. These test cases check that the first
      and last SAN, respectively, matches the connection hostname. New test
      certificates have been added for these cases. For 3000, the certificate
      prefix is Server-localhost-firstSAN and for 3001, the certificate
      prefix is Server-localhost-secondSAN.
    
    - Remove TODO 15.2 (Add support for custom server certificate
      validation), this commit addresses it.
    
    Closes https://github.com/curl/curl/pull/1325
    89963002