certificate verify issue of tfphttpclient with openssl
from wiki page, https client as easy as:
tfphttpclient.simpleget('https://192.168.0.1')in TOpenSSLSocketHandler, the VerifyPeerCert is False by default when check the TSSL.VerifyResult, will got one of following: 1) X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT = 18; when https server use a self-signed cert 2) X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN = 19; when server use a cert signed by internal CA 3) X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY = 20; when connect to a real *signed* server, ex: https://www.kernel.org if set TSSL.VerifyResult to True, the connect will fail and exception raised. even set Handler.CertificateData.CertCA.FileName to a valid cert file. finally found in opensslsockets.pas: TOpenSSLSocketHandler.Connect: Boolean ... if Result and VerifyPeerCert then Result:=(FSSL.VerifyResult<>0) or (not DoVerifyCert); ... in first Result and VerifyPeerCert both are True the second line, if I'm not wrong understanding, is totally reverse FSSL.VerifyResult is 0 here, and DoVerifyCert always return True, so the Result changed to False, and then the connect became fail. in a real prog, we want to check the VerifyResult, and still allow the connection in some conditions. after some modify, things changed to: 1) when VerifyPeerCert is True if Handler.CertificateData.CertCA.FileName set to a valid cert, VerifyResult will be 0, and https request passed 2) when it's False assign a OnVerifyCertificate handler, check SSL infos, to allow or deny the connect. *** tested fpc 3.2.0, openssl 1.0.2j(copied from lazarus), windows 10 64-bit, client side of https transmition. patch file attached, some explain: a) sslsockets.pp the TVerifyCertificateEvent shall allow to modify the "Allow" param, for compatibility reason, function DoVerifyCert: Boolean may change to virtual b) fppoenssl.pp FingerPrint always genarate by MD5, can be SHA1 or SHA256 c) opensslsockets.pp export SSL: TSSL for more lower level control in Connect(): Result and VerifyPeerCert check are duplicated alway give a chance to let user do the certificate verifing.
openssl-verify-cert.diff
Description: Binary data
_______________________________________________ fpc-devel maillist - fpc-devel@lists.freepascal.org https://lists.freepascal.org/cgi-bin/mailman/listinfo/fpc-devel
