b4630ed8fa
Stefan Eissing
2025-10-31
Subject
sectrust: fix verifystatus via sectrust
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
lib/vtls/openssl.c+11 -1
| @@ -5155,6 +5155,9 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf, | |
| bool strict = (conn_config->verifypeer || conn_config->verifyhost); | |
| X509 *server_cert; | |
| bool verified = FALSE; | |
| + | #ifdef USE_APPLE_SECTRUST |
| + | bool sectrust_verified = FALSE; |
| + | #endif |
| if(data->set.ssl.certinfo && !octx->reused_session) { | |
| /* asked to gather certificate info. Reused sessions don't have cert | |
| @@ -5207,6 +5210,7 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf, | |
| if(verified) { | |
| infof(data, "SSL certificate verified via Apple SecTrust."); | |
| ssl_config->certverifyresult = X509_V_OK; | |
| + | sectrust_verified = TRUE; |
| } | |
| } | |
| #endif | |
| @@ -5222,7 +5226,13 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf, | |
| } | |
| #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_OCSP) | |
| - | if(conn_config->verifystatus && !octx->reused_session) { |
| + | if(conn_config->verifystatus && |
| + | #ifdef USE_APPLE_SECTRUST |
| + | !sectrust_verified && /* already verified via apple sectrust, cannot |
| + | * verifystate via OpenSSL in that case as it |
| + | * does not have the trust anchors */ |
| + | #endif |
| + | !octx->reused_session) { |
| /* do not do this after Session ID reuse */ | |
| result = verifystatus(cf, data, octx); | |
| if(result) | |