Starting from the stackoverflow article, I made a patch against lib/vtls/openssl.c
I worked against commit https://github.com/curl/curl/commit/6684653b682bae0be75ea62bb473b126923952f1 It run well for me Before commiting on git, there is probably two questions : - Is the #if defined(HAVE_WINDOWS_H) test good to decide include Wincrypt.h and this code? Or another macro? - And if both HAVE_WINDOWS_H (or alternate macro) and CURL_CA_FALLBACK are defined ? Here is the patch *** openssl.git Sun Sep 09 21:15:17 2018 --- openssl.gv Sun Sep 09 21:18:03 2018 *************** *** 2184,2189 **** --- 2184,2195 ---- return CURLE_OK; } + + #if defined(HAVE_WINDOWS_H) + #include <Wincrypt.h> + #pragma comment(lib, "crypt32.lib") + #endif + static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex) { CURLcode result = CURLE_OK; *************** *** 2521,2527 **** ssl_cafile ? ssl_cafile : "none", ssl_capath ? ssl_capath : "none"); } ! #ifdef CURL_CA_FALLBACK else if(verifypeer) { /* verfying the peer without any CA certificates won't work so use openssl's built in default as fallback */ --- 2527,2563 ---- ssl_cafile ? ssl_cafile : "none", ssl_capath ? ssl_capath : "none"); } ! ! #if defined(HAVE_WINDOWS_H) && !defined(CURL_CA_FALLBACK) ! else if (verifypeer) { ! // read https://stackoverflow.com/questions/9507184/can-openssl-on-windows-use-the-s ystem-certificate-store/15451831 ! // ! if ((!ssl_cafile) && (!ssl_capath)) { ! X509_STORE *store = SSL_CTX_get_cert_store(BACKEND->ctx); ! PCCERT_CONTEXT pContext = NULL; ! ! HCERTSTORE hStore = CertOpenSystemStoreW((HCRYPTPROV_LEGACY)NULL, L"ROOT"); ! ! if (hStore) { ! while (pContext = CertEnumCertificatesInStore(hStore, pContext)) ! { ! const unsigned char *encoded_cert = (const unsigned char *)pContext->pbCertEncoded; ! X509 *x509 = d2i_X509(NULL, &encoded_cert, pContext->cbCertEncoded); ! ! if (x509) ! { ! X509_STORE_add_cert(store, x509); ! X509_free(x509); ! } ! } ! ! CertFreeCertificateContext(pContext); ! CertCloseStore(hStore, 0); ! } ! } ! } ! #endif ! #if defined(CURL_CA_FALLBACK) else if(verifypeer) { /* verfying the peer without any CA certificates won't work so use openssl's built in default as fallback */
------------------------------------------------------------------- Unsubscribe: https://cool.haxx.se/list/listinfo/curl-library Etiquette: https://curl.haxx.se/mail/etiquette.html
