This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 836436cfb9 avformat/tls_openssl: also trust the Windows certificate
store
836436cfb9 is described below
commit 836436cfb9926fc69606a3772fea8f9941aec06e
Author: J-RAP <[email protected]>
AuthorDate: Mon Oct 26 05:07:37 2026 -0600
Commit: Timo Rothenpieler <[email protected]>
CommitDate: Sun Nov 1 12:08:49 2026 +0000
avformat/tls_openssl: also trust the Windows certificate store
The tls and dtls protocols verify the peer by default. Without ca_file,
OpenSSL only looks in the default locations configured when it was
built, which on Windows usually do not exist, so every connection fails
certificate verification unless the caller provides a CA file. The
Schannel backend uses the system store and does not have this problem.
OpenSSL 3.2 added a store loader for the Windows ROOT system store.
When no ca_file is given, register it in addition to the default
locations, unless OpenSSL was built without it. Its certificates are
looked up during verification, with the usual OpenSSL checks; trust
restrictions that Windows keeps as certificate properties are not
enforced by the loader.
OpenSSL 3.5.0 crashes in this loader (openssl/openssl#27355, fixed in
3.5.1); no workaround is added for that superseded release.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Signed-off-by: J-RAP <[email protected]>
---
doc/protocols.texi | 12 ++++++++++++
libavformat/tls_openssl.c | 8 ++++++++
2 files changed, 20 insertions(+)
diff --git a/doc/protocols.texi b/doc/protocols.texi
index 4544ed3d3f..031e257d3f 100644
--- a/doc/protocols.texi
+++ b/doc/protocols.texi
@@ -2319,6 +2319,12 @@ as trusted. If the linked TLS library contains a default
this might not
need to be specified for verification to work, but not all libraries and
setups have defaults built in.
The file must be in OpenSSL PEM format.
+When no file is given, Windows builds using OpenSSL 3.2 or later with
+Windows certificate store support also use certificates from the system
+ROOT store. OpenSSL applies its usual certificate checks. Additional
+trust restrictions stored as Windows certificate properties, rather than
+encoded in the certificates themselves, are not enforced by its Windows
+certificate store loader.
@item tls_verify, verify=@var{1|0}
If enabled, try to verify the peer that we are communicating with.
@@ -2392,6 +2398,12 @@ as trusted. If the linked TLS library contains a default
this might not
need to be specified for verification to work, but not all libraries and
setups have defaults built in.
The file must be in OpenSSL PEM format.
+When no file is given, Windows builds using OpenSSL 3.2 or later with
+Windows certificate store support also use certificates from the system
+ROOT store. OpenSSL applies its usual certificate checks. Additional
+trust restrictions stored as Windows certificate properties, rather than
+encoded in the certificates themselves, are not enforced by its Windows
+certificate store loader.
@item tls_verify, verify=@var{1|0}
If enabled, try to verify the peer that we are communicating with.
diff --git a/libavformat/tls_openssl.c b/libavformat/tls_openssl.c
index 0075288d61..3bcd1e74dd 100644
--- a/libavformat/tls_openssl.c
+++ b/libavformat/tls_openssl.c
@@ -719,6 +719,14 @@ static av_cold int openssl_init_ca_key_cert(URLContext *h)
av_log(h, AV_LOG_WARNING, "Failure setting default verify
locations: %s\n",
openssl_get_error(c));
}
+#if defined(_WIN32) && !defined(OPENSSL_NO_WINSTORE) && \
+ OPENSSL_VERSION_NUMBER >= 0x30200000L /* OpenSSL 3.2 */
+ // Windows has no default CA directory, so also trust its ROOT system
store
+ if (!SSL_CTX_load_verify_store(c->ctx, "org.openssl.winstore://")) {
+ av_log(h, AV_LOG_WARNING, "Failure registering the Windows
certificate store: %s\n",
+ openssl_get_error(c));
+ }
+#endif
}
if (s->cert_file) {
--
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
