diff options
| author | Gilles Vollant <info@winimage.com> | 2020-07-13 03:17:56 +0200 |
|---|---|---|
| committer | Jay Satiro <raysatiro@yahoo.com> | 2021-05-05 02:29:16 -0400 |
| commit | 77fc3859b24470b5c173174e2aba3b099b92adfd (patch) | |
| tree | 010c3dfb572cd78b1b88187bb5dfc4200eeb1638 /lib/vtls/schannel.c | |
| parent | 70cf50fb4aa5e55ca2e732716a4f455d39192088 (diff) | |
| download | curl-77fc3859b24470b5c173174e2aba3b099b92adfd.tar.gz | |
SSL: support in-memory CA certs for some backends
- New options CURLOPT_CAINFO_BLOB and CURLOPT_PROXY_CAINFO_BLOB to
specify in-memory PEM certificates for OpenSSL, Schannel (Windows)
and Secure Transport (Apple) SSL backends.
Prior to this change PEM certificates could only be imported from a file
and not from memory.
Co-authored-by: moparisthebest@users.noreply.github.com
Ref: https://github.com/curl/curl/pull/4679
Ref: https://github.com/curl/curl/pull/5677
Ref: https://github.com/curl/curl/pull/6109
Closes https://github.com/curl/curl/pull/6662
Diffstat (limited to 'lib/vtls/schannel.c')
| -rw-r--r-- | lib/vtls/schannel.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/lib/vtls/schannel.c b/lib/vtls/schannel.c index 4ddab55d2..d3fb642d1 100644 --- a/lib/vtls/schannel.c +++ b/lib/vtls/schannel.c @@ -473,7 +473,7 @@ schannel_connect_step1(struct Curl_easy *data, struct connectdata *conn, #endif #else #ifdef HAS_MANUAL_VERIFY_API - if(SSL_CONN_CONFIG(CAfile)) { + if(SSL_CONN_CONFIG(CAfile) || SSL_CONN_CONFIG(ca_info_blob)) { if(curlx_verify_windows_version(6, 1, PLATFORM_WINNT, VERSION_GREATER_THAN_EQUAL)) { BACKEND->use_manual_cred_validation = true; @@ -487,7 +487,7 @@ schannel_connect_step1(struct Curl_easy *data, struct connectdata *conn, else BACKEND->use_manual_cred_validation = false; #else - if(SSL_CONN_CONFIG(CAfile)) { + if(SSL_CONN_CONFIG(CAfile) || SSL_CONN_CONFIG(ca_info_blob)) { failf(data, "schannel: CA cert support not built in"); return CURLE_NOT_BUILT_IN; } @@ -2403,6 +2403,9 @@ const struct Curl_ssl Curl_ssl_schannel = { { CURLSSLBACKEND_SCHANNEL, "schannel" }, /* info */ SSLSUPP_CERTINFO | +#ifdef HAS_MANUAL_VERIFY_API + SSLSUPP_CAINFO_BLOB | +#endif SSLSUPP_PINNEDPUBKEY, sizeof(struct ssl_backend_data), |