AuroraMiddleware/qt5base-lts
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix windows cert fetcher if site presents full chain

Browse Source 
If a website presents the complete certificate chain in the handshake
i.e. site -> intermediate CA -> root CA then openssl gives
a different error (SelfSignedCertificateInChain)

Because of this windows feature, that either means the site is
signed by an untrusted CA, or the CA trust status is unknown because
we don't have the root cert in the cert store.

In any case, calling the windows verification function results
in a trusted chain & the root being added to the cert store.

Task-number: QTBUG-24827
Change-Id: I2663ea2f86cd0b4dfde105d858ec1b39a340c1f6
Reviewed-by: Richard J. Moore <rich@kde.org>
This commit is contained in:
Shane Kearns 2012-04-27 20:05:05 +01:00 committed by Qt by Nokia
parent f503e906d6
commit 42d4639fd9
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/network/ssl/qsslsocket_openssl.cpp
View File

@ -1252,7 +1252,8 @@ bool QSslSocketBackendPrivate::startHandshake()
bool fetchCertificate = true;
for (int i=0; i< sslErrors.count(); i++) {
switch (sslErrors.at(i).error()) {
case QSslError::UnableToGetLocalIssuerCertificate:
case QSslError::UnableToGetLocalIssuerCertificate: // site presented intermediate cert, but root is unknown
case QSslError::SelfSignedCertificateInChain: // site presented a complete chain, but root is unknown
certToFetch = sslErrors.at(i).certificate();
break;
case QSslError::SelfSignedCertificate:
@ -1344,6 +1345,7 @@ void QSslSocketBackendPrivate::_q_caRootLoaded(QSslCertificate cert, QSslCertifi
case QSslError::UnableToGetLocalIssuerCertificate:
case QSslError::CertificateUntrusted:
case QSslError::UnableToVerifyFirstCertificate:
case QSslError::SelfSignedCertificateInChain:
// error can be ignored if OS says the chain is trusted
sslErrors.removeAt(i);
break;