Hi Paul, >> This one introduces some failures on some boxes. Are they indeed missing >> the needed Verisign root certificate as stated in the logs?
No, that warning is spurious in this case. Austin and I introduced competing patches for this one, where my warning was intended to warn only in the case that no root certificates were found, hence would not produce spurious warnings. His was simpler and beat mine. > Could it just be a fact of an older crypt32 that doesn't deal (properly) > with CERT_TRUST_IS_NOT_VALID_FOR_USAGE? Yes. I was hoping to mark these with broken, but I missed it on some chains. Does the attached patch help? --Juan
From 4beb7491286e6d7f8f8ba8e7ef30e43072381b45 Mon Sep 17 00:00:00 2001 From: Juan Lang <[email protected]> Date: Thu, 22 Oct 2009 07:38:56 -0700 Subject: [PATCH] Fix test failures on older versions of crypt32 --- dlls/crypt32/tests/chain.c | 12 +++++++----- 1 files changed, 7 insertions(+), 5 deletions(-) diff --git a/dlls/crypt32/tests/chain.c b/dlls/crypt32/tests/chain.c index d29c86a..e66015a 100644 --- a/dlls/crypt32/tests/chain.c +++ b/dlls/crypt32/tests/chain.c @@ -1778,14 +1778,15 @@ static ChainCheck chainCheck[] = { { { CERT_TRUST_IS_NOT_TIME_NESTED, CERT_TRUST_HAS_PREFERRED_ISSUER }, { CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, simpleStatus14 }, 0 }, + /* Earlier versions of crypt32 incorrectly do not complain that the end cert's + * key usage is invalid, so ignore that error. + */ { { sizeof(chain15) / sizeof(chain15[0]), chain15 }, - { { CERT_TRUST_IS_NOT_TIME_NESTED, CERT_TRUST_HAS_PREFERRED_ISSUER }, + { { CERT_TRUST_IS_NOT_TIME_NESTED | CERT_TRUST_IS_NOT_VALID_FOR_USAGE, + CERT_TRUST_HAS_PREFERRED_ISSUER }, { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_VALID_FOR_USAGE, 0 }, 1, simpleStatus15 }, 0 }, - /* Windows XP incorrectly does not complain that the end cert's key usage is - * invalid, so ignore that error. - */ { { sizeof(chain16) / sizeof(chain16[0]), chain16 }, { { CERT_TRUST_IS_NOT_TIME_NESTED | CERT_TRUST_IS_NOT_VALID_FOR_USAGE, CERT_TRUST_HAS_PREFERRED_ISSUER }, @@ -1797,7 +1798,8 @@ static ChainCheck chainCheck[] = { { CERT_TRUST_IS_UNTRUSTED_ROOT, 0 }, 1, simpleStatus17 }, 0 }, { { sizeof(chain18) / sizeof(chain18[0]), chain18 }, - { { CERT_TRUST_IS_NOT_TIME_NESTED, CERT_TRUST_HAS_PREFERRED_ISSUER }, + { { CERT_TRUST_IS_NOT_TIME_NESTED | CERT_TRUST_IS_NOT_VALID_FOR_USAGE, + CERT_TRUST_HAS_PREFERRED_ISSUER }, { CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_NOT_VALID_FOR_USAGE, 0 }, 1, simpleStatus18 }, 0 }, -- 1.6.0.6
