← Commit list

3f8f725d97

Viktor Szakats
Viktor Szakats
2026-05-16
SUCCESS Duration: 233s

Subject

schannel: enforce Extended Key Usage for custom CA roots

Binary

No binary (build failed)

Architecture & Compiler Flags

Architecture: x86_64-linux-gnu Compiler: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0

—

Build Log

(log yok)

Commit Diff GitHub →

lib/vtls/schannel_verify.c +4 -0
lib/vtls/schannel_verify.c+4 -0
@@ -776,9 +776,13 @@ CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
if(result == CURLE_OK) {
CERT_CHAIN_PARA ChainPara;
+ LPSTR serverAuthOID = CURL_UNCONST(szOID_PKIX_KP_SERVER_AUTH);
memset(&ChainPara, 0, sizeof(ChainPara));
ChainPara.cbSize = sizeof(ChainPara);
+ ChainPara.RequestedUsage.dwType = USAGE_MATCH_TYPE_AND;
+ ChainPara.RequestedUsage.Usage.cUsageIdentifier = 1;
+ ChainPara.RequestedUsage.Usage.rgpszUsageIdentifier = &serverAuthOID;
if(!CertGetCertificateChain(cert_chain_engine,
pCertContextServer,