6aa8fa3fdf
Stefan Eissing
2025-11-21
Subject
apple-sectrust: always ask when `native_ca_store` is in use
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
lib/vtls/gtls.c+1 -2
| @@ -1687,8 +1687,7 @@ Curl_gtls_verifyserver(struct Curl_cfilter *cf, | |
| infof(data, " SSL certificate verified by GnuTLS"); | |
| #ifdef USE_APPLE_SECTRUST | |
| - | if(!verified && ssl_config->native_ca_store && |
| - | (verify_status & GNUTLS_CERT_SIGNER_NOT_FOUND)) { |
| + | if(!verified && ssl_config->native_ca_store) { |
| result = glts_apple_verify(cf, data, peer, &chain, &verified); | |
| if(result && (result != CURLE_PEER_FAILED_VERIFICATION)) | |
| goto out; /* unexpected error */ | |
lib/vtls/openssl.c+1 -3
| @@ -4829,9 +4829,7 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf, | |
| infof(data, "SSL certificate verified via OpenSSL."); | |
| #ifdef USE_APPLE_SECTRUST | |
| - | if(!verified && |
| - | conn_config->verifypeer && ssl_config->native_ca_store && |
| - | (ossl_verify == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY)) { |
| + | if(!verified && conn_config->verifypeer && ssl_config->native_ca_store) { |
| /* we verify using Apple SecTrust *unless* OpenSSL already verified. | |
| * This may happen if the application intercepted the OpenSSL callback | |
| * and installed its own. */ | |