moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-08-13 17:03:50 -04:00
Code Issues Releases Wiki Activity
39ce47f219
curl/tests/certs/Server-localhost-lastSAN-sv.pem

146 lines
7.3 KiB
Plaintext
Raw Normal View History

schannel: add support for CURLOPT_CAINFO - Move verify_certificate functionality in schannel.c into a new file called schannel_verify.c. Additionally, some structure defintions from schannel.c have been moved to schannel.h to allow them to be used in schannel_verify.c. - Make verify_certificate functionality for Schannel available on all versions of Windows instead of just Windows CE. verify_certificate will be invoked on Windows CE or when the user specifies CURLOPT_CAINFO and CURLOPT_SSL_VERIFYPEER. - In verify_certificate, create a custom certificate chain engine that exclusively trusts the certificate store backed by the CURLOPT_CAINFO file. - doc updates of --cacert/CAINFO support for schannel - Use CERT_NAME_SEARCH_ALL_NAMES_FLAG when invoking CertGetNameString when available. This implements a TODO in schannel.c to improve handling of multiple SANs in a certificate. In particular, all SANs will now be searched instead of just the first name. - Update tool_operate.c to not search for the curl-ca-bundle.crt file when using Schannel to maintain backward compatibility. Previously, any curl-ca-bundle.crt file found in that search would have been ignored by Schannel. But, with CAINFO support, the file found by that search would have been used as the certificate store and could cause issues for any users that have curl-ca-bundle.crt in the search path. - Update url.c to not set the build time CURL_CA_BUNDLE if the selected SSL backend is Schannel. We allow setting CA location for schannel only when explicitly specified by the user via CURLOPT_CAINFO / --cacert. - Add new test cases 3000 and 3001. These test cases check that the first and last SAN, respectively, matches the connection hostname. New test certificates have been added for these cases. For 3000, the certificate prefix is Server-localhost-firstSAN and for 3001, the certificate prefix is Server-localhost-secondSAN. - Remove TODO 15.2 (Add support for custom server certificate validation), this commit addresses it. Closes https://github.com/curl/curl/pull/1325
2017-03-10 15:27:30 -05:00
extensions = x509v3
[ x509v3 ]
subjectAltName = DNS:localhost1,DNS:localhost2,DNS:localhost
keyUsage = keyEncipherment,digitalSignature,keyAgreement
extendedKeyUsage = serverAuth
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid
basicConstraints = CA:false
[ req ]
default_bits = 1024
distinguished_name = req_DN
default_md = sha256
string_mask = utf8only
[ req_DN ]
countryName = "Country Name is Northern Nowhere"
countryName_value = NN
organizationName = "Organization Name"
organizationName_value = Edel Curl Arctic Illudium Research Cloud
commonName = "Common Name"
commonName_value = localhost.nn
[something]
# The key
# the certificate
# some dhparam
-----BEGIN RSA PRIVATE KEY-----
certs/Server-localhost-lastSAN-sv: regenerate with sha256 All other certificates were regenerated in commit ba782baac30, but this one was missed. Fixes test3001 on modern systems. Closes https://github.com/curl/curl/pull/4551
2019-11-02 09:04:28 -04:00
MIIEowIBAAKCAQEAvZcOp222c4zQIWvzNnRdCqo68PpusVwcE3TKZysiA9GmPCXv
h0/oOJ8hHS6IEjZmggMCTPgXNQKVMbFTQCEkLwDwv4BYFrGSs9N4v3jLCpEM0m1d
sh9BcxYCfBrNFiXJ4RuBvYSTTGPOOPQ+rZhrAImouvV+CIPzmvWYuJ/W2MfU8wcc
j++8KRBgjIWLTHpzx5+oIy/ER/UYhZj7J95Yk0sIpWbJ39vwIvhkn6FWiZerAixa
mfJvv3IxkCIyroYlaxPGcuzfLsgSAMHjOLSgQLoBYcLXse99SykY4v4o0JjkZT9M
NDnkgqnKsj3EkY+glL/j+LNzSLf++gRD57W8vQIDAQABAoIBAQCC0wTKpdtbmtRX
66y1a9B0NolblgPiISRCjLnKPSpIpldmc+r4XTxqLexkvaIppx5PIpJo2FzzOGgJ
FUrUGspkIOr/yil+52PK8OcGgOziyrqlTdB0xDqelpZ6WuggG01WJ2v8gco+0TQR
ewDxOxbDFTq4YARrDdqAmG6dH7baeMDvh6IVe/dkJOVlyh0MA2QP+VR6fDv73jUe
3yW6G+hql9mjZK6Cgz2lWoeW7YXAvWtTXT68/bcZLO64oLyCjBmsbSrBRQN5m9M9
dWJV5B0h02P+uMF5H+EAD3qN5I670iSY3d+FWBpd3cA2arRGWlUXNmCGG3CjLYUS
wGw1lbFhAoGBAPG6JhdXAaH3DN9khp54plbFSIanvjWK8RAEaQgkurwDUL3o1LmC
ObqiCmMTU25HRlwWkwlCxejHfzOEqFdwiX5QuNmYBE6TYHtmnWSJ5ebMG7SOtlIS
9Z4dLNZz8j95OGKb3XI9qR0ItxsmuLgWvrJUayd0UXcU7BTzHCXGx99JAoGBAMjI
0z5+DeTwBhDY1mIUY081FmhrT9PhFHGtRy2OIENW0ZhJ5yE+ygVQssnR+Lr/yl1p
zGC+CM//5wmJ774Xx0reMsh/rgK4Z0Wq47JJFGo0RMfYVmlod0OndtdobDc7ds7t
Q3wIGt2ZXW6BtzMo8KVUuuHL8QwZoZqJNe/7QE3VAoGAGGrRRjJHu/CUoEwrPP66
7rDm7pMrJ4VtbEzFv0jWg/9hvI00T7jT1AJiQjfFibIxbUPqflj8XNMqCi4wQwTf
Hp9QzMoKRVWlvVFUPL+hNXsQoWB5EjlQDjSsPs1ffwHjrDJKYCvSVVh4BooWxqGl
iaX1XPrm77xxTHxyL26w6eECgYA176S3g9stpcCrY+RrInju/R7Q3Arsquj4BIk7
VpOaI0dYdnnNN3XDacMtbec4LKBq6ZHKZyIs5dxldpVdZjvWA8x2ib3v4yNy1o4m
BXWjdfkICjhkRnjLRsAo61cumx22Row7VF4LKzirB9NzvcqvTwyIvWU6T+RWhAdm
OQM0JQKBgC+gmBGfnQShTRYlfpb4RVnDijPpC34AdEO7wdeMcdQK9KfWsLZT5y0w
qoZhW9IPlu1dNRhwHqGHWu2CmQVwFpy5/ccpukCJfyZw7edbb9dIqzKlUWw8Jmmg
C7WKz4z3mKkZrwptFxDu0dpQ644yOP/gnRaLLyP0zn/brmnYz09X
schannel: add support for CURLOPT_CAINFO - Move verify_certificate functionality in schannel.c into a new file called schannel_verify.c. Additionally, some structure defintions from schannel.c have been moved to schannel.h to allow them to be used in schannel_verify.c. - Make verify_certificate functionality for Schannel available on all versions of Windows instead of just Windows CE. verify_certificate will be invoked on Windows CE or when the user specifies CURLOPT_CAINFO and CURLOPT_SSL_VERIFYPEER. - In verify_certificate, create a custom certificate chain engine that exclusively trusts the certificate store backed by the CURLOPT_CAINFO file. - doc updates of --cacert/CAINFO support for schannel - Use CERT_NAME_SEARCH_ALL_NAMES_FLAG when invoking CertGetNameString when available. This implements a TODO in schannel.c to improve handling of multiple SANs in a certificate. In particular, all SANs will now be searched instead of just the first name. - Update tool_operate.c to not search for the curl-ca-bundle.crt file when using Schannel to maintain backward compatibility. Previously, any curl-ca-bundle.crt file found in that search would have been ignored by Schannel. But, with CAINFO support, the file found by that search would have been used as the certificate store and could cause issues for any users that have curl-ca-bundle.crt in the search path. - Update url.c to not set the build time CURL_CA_BUNDLE if the selected SSL backend is Schannel. We allow setting CA location for schannel only when explicitly specified by the user via CURLOPT_CAINFO / --cacert. - Add new test cases 3000 and 3001. These test cases check that the first and last SAN, respectively, matches the connection hostname. New test certificates have been added for these cases. For 3000, the certificate prefix is Server-localhost-firstSAN and for 3001, the certificate prefix is Server-localhost-secondSAN. - Remove TODO 15.2 (Add support for custom server certificate validation), this commit addresses it. Closes https://github.com/curl/curl/pull/1325
2017-03-10 15:27:30 -05:00
-----END RSA PRIVATE KEY-----
Certificate:
Data:
Version: 3 (0x2)
certs/Server-localhost-lastSAN-sv: regenerate with sha256 All other certificates were regenerated in commit ba782baac30, but this one was missed. Fixes test3001 on modern systems. Closes https://github.com/curl/curl/pull/4551
2019-11-02 09:04:28 -04:00
Serial Number:
0e:4d:b9:c6:24:b0
Signature Algorithm: sha256WithRSAEncryption
schannel: add support for CURLOPT_CAINFO - Move verify_certificate functionality in schannel.c into a new file called schannel_verify.c. Additionally, some structure defintions from schannel.c have been moved to schannel.h to allow them to be used in schannel_verify.c. - Make verify_certificate functionality for Schannel available on all versions of Windows instead of just Windows CE. verify_certificate will be invoked on Windows CE or when the user specifies CURLOPT_CAINFO and CURLOPT_SSL_VERIFYPEER. - In verify_certificate, create a custom certificate chain engine that exclusively trusts the certificate store backed by the CURLOPT_CAINFO file. - doc updates of --cacert/CAINFO support for schannel - Use CERT_NAME_SEARCH_ALL_NAMES_FLAG when invoking CertGetNameString when available. This implements a TODO in schannel.c to improve handling of multiple SANs in a certificate. In particular, all SANs will now be searched instead of just the first name. - Update tool_operate.c to not search for the curl-ca-bundle.crt file when using Schannel to maintain backward compatibility. Previously, any curl-ca-bundle.crt file found in that search would have been ignored by Schannel. But, with CAINFO support, the file found by that search would have been used as the certificate store and could cause issues for any users that have curl-ca-bundle.crt in the search path. - Update url.c to not set the build time CURL_CA_BUNDLE if the selected SSL backend is Schannel. We allow setting CA location for schannel only when explicitly specified by the user via CURLOPT_CAINFO / --cacert. - Add new test cases 3000 and 3001. These test cases check that the first and last SAN, respectively, matches the connection hostname. New test certificates have been added for these cases. For 3000, the certificate prefix is Server-localhost-firstSAN and for 3001, the certificate prefix is Server-localhost-secondSAN. - Remove TODO 15.2 (Add support for custom server certificate validation), this commit addresses it. Closes https://github.com/curl/curl/pull/1325
2017-03-10 15:27:30 -05:00
Issuer:
countryName = NN
organizationName = Edel Curl Arctic Illudium Research Cloud
commonName = Northern Nowhere Trust Anchor
Validity
certs/Server-localhost-lastSAN-sv: regenerate with sha256 All other certificates were regenerated in commit ba782baac30, but this one was missed. Fixes test3001 on modern systems. Closes https://github.com/curl/curl/pull/4551
2019-11-02 09:04:28 -04:00
Not Before: Nov 2 12:53:25 2019 GMT
Not After : Jan 19 12:53:25 2028 GMT
schannel: add support for CURLOPT_CAINFO - Move verify_certificate functionality in schannel.c into a new file called schannel_verify.c. Additionally, some structure defintions from schannel.c have been moved to schannel.h to allow them to be used in schannel_verify.c. - Make verify_certificate functionality for Schannel available on all versions of Windows instead of just Windows CE. verify_certificate will be invoked on Windows CE or when the user specifies CURLOPT_CAINFO and CURLOPT_SSL_VERIFYPEER. - In verify_certificate, create a custom certificate chain engine that exclusively trusts the certificate store backed by the CURLOPT_CAINFO file. - doc updates of --cacert/CAINFO support for schannel - Use CERT_NAME_SEARCH_ALL_NAMES_FLAG when invoking CertGetNameString when available. This implements a TODO in schannel.c to improve handling of multiple SANs in a certificate. In particular, all SANs will now be searched instead of just the first name. - Update tool_operate.c to not search for the curl-ca-bundle.crt file when using Schannel to maintain backward compatibility. Previously, any curl-ca-bundle.crt file found in that search would have been ignored by Schannel. But, with CAINFO support, the file found by that search would have been used as the certificate store and could cause issues for any users that have curl-ca-bundle.crt in the search path. - Update url.c to not set the build time CURL_CA_BUNDLE if the selected SSL backend is Schannel. We allow setting CA location for schannel only when explicitly specified by the user via CURLOPT_CAINFO / --cacert. - Add new test cases 3000 and 3001. These test cases check that the first and last SAN, respectively, matches the connection hostname. New test certificates have been added for these cases. For 3000, the certificate prefix is Server-localhost-firstSAN and for 3001, the certificate prefix is Server-localhost-secondSAN. - Remove TODO 15.2 (Add support for custom server certificate validation), this commit addresses it. Closes https://github.com/curl/curl/pull/1325
2017-03-10 15:27:30 -05:00
Subject:
countryName = NN
organizationName = Edel Curl Arctic Illudium Research Cloud
commonName = localhost.nn
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
certs/Server-localhost-lastSAN-sv: regenerate with sha256 All other certificates were regenerated in commit ba782baac30, but this one was missed. Fixes test3001 on modern systems. Closes https://github.com/curl/curl/pull/4551
2019-11-02 09:04:28 -04:00
RSA Public-Key: (2048 bit)
schannel: add support for CURLOPT_CAINFO - Move verify_certificate functionality in schannel.c into a new file called schannel_verify.c. Additionally, some structure defintions from schannel.c have been moved to schannel.h to allow them to be used in schannel_verify.c. - Make verify_certificate functionality for Schannel available on all versions of Windows instead of just Windows CE. verify_certificate will be invoked on Windows CE or when the user specifies CURLOPT_CAINFO and CURLOPT_SSL_VERIFYPEER. - In verify_certificate, create a custom certificate chain engine that exclusively trusts the certificate store backed by the CURLOPT_CAINFO file. - doc updates of --cacert/CAINFO support for schannel - Use CERT_NAME_SEARCH_ALL_NAMES_FLAG when invoking CertGetNameString when available. This implements a TODO in schannel.c to improve handling of multiple SANs in a certificate. In particular, all SANs will now be searched instead of just the first name. - Update tool_operate.c to not search for the curl-ca-bundle.crt file when using Schannel to maintain backward compatibility. Previously, any curl-ca-bundle.crt file found in that search would have been ignored by Schannel. But, with CAINFO support, the file found by that search would have been used as the certificate store and could cause issues for any users that have curl-ca-bundle.crt in the search path. - Update url.c to not set the build time CURL_CA_BUNDLE if the selected SSL backend is Schannel. We allow setting CA location for schannel only when explicitly specified by the user via CURLOPT_CAINFO / --cacert. - Add new test cases 3000 and 3001. These test cases check that the first and last SAN, respectively, matches the connection hostname. New test certificates have been added for these cases. For 3000, the certificate prefix is Server-localhost-firstSAN and for 3001, the certificate prefix is Server-localhost-secondSAN. - Remove TODO 15.2 (Add support for custom server certificate validation), this commit addresses it. Closes https://github.com/curl/curl/pull/1325
2017-03-10 15:27:30 -05:00
Modulus:
certs/Server-localhost-lastSAN-sv: regenerate with sha256 All other certificates were regenerated in commit ba782baac30, but this one was missed. Fixes test3001 on modern systems. Closes https://github.com/curl/curl/pull/4551
2019-11-02 09:04:28 -04:00
00:bd:97:0e:a7:6d:b6:73:8c:d0:21:6b:f3:36:74:
5d:0a:aa:3a:f0:fa:6e:b1:5c:1c:13:74:ca:67:2b:
22:03:d1:a6:3c:25:ef:87:4f:e8:38:9f:21:1d:2e:
88:12:36:66:82:03:02:4c:f8:17:35:02:95:31:b1:
53:40:21:24:2f:00:f0:bf:80:58:16:b1:92:b3:d3:
78:bf:78:cb:0a:91:0c:d2:6d:5d:b2:1f:41:73:16:
02:7c:1a:cd:16:25:c9:e1:1b:81:bd:84:93:4c:63:
ce:38:f4:3e:ad:98:6b:00:89:a8:ba:f5:7e:08:83:
f3:9a:f5:98:b8:9f:d6:d8:c7:d4:f3:07:1c:8f:ef:
bc:29:10:60:8c:85:8b:4c:7a:73:c7:9f:a8:23:2f:
c4:47:f5:18:85:98:fb:27:de:58:93:4b:08:a5:66:
c9:df:db:f0:22:f8:64:9f:a1:56:89:97:ab:02:2c:
5a:99:f2:6f:bf:72:31:90:22:32:ae:86:25:6b:13:
c6:72:ec:df:2e:c8:12:00:c1:e3:38:b4:a0:40:ba:
01:61:c2:d7:b1:ef:7d:4b:29:18:e2:fe:28:d0:98:
e4:65:3f:4c:34:39:e4:82:a9:ca:b2:3d:c4:91:8f:
a0:94:bf:e3:f8:b3:73:48:b7:fe:fa:04:43:e7:b5:
bc:bd
schannel: add support for CURLOPT_CAINFO - Move verify_certificate functionality in schannel.c into a new file called schannel_verify.c. Additionally, some structure defintions from schannel.c have been moved to schannel.h to allow them to be used in schannel_verify.c. - Make verify_certificate functionality for Schannel available on all versions of Windows instead of just Windows CE. verify_certificate will be invoked on Windows CE or when the user specifies CURLOPT_CAINFO and CURLOPT_SSL_VERIFYPEER. - In verify_certificate, create a custom certificate chain engine that exclusively trusts the certificate store backed by the CURLOPT_CAINFO file. - doc updates of --cacert/CAINFO support for schannel - Use CERT_NAME_SEARCH_ALL_NAMES_FLAG when invoking CertGetNameString when available. This implements a TODO in schannel.c to improve handling of multiple SANs in a certificate. In particular, all SANs will now be searched instead of just the first name. - Update tool_operate.c to not search for the curl-ca-bundle.crt file when using Schannel to maintain backward compatibility. Previously, any curl-ca-bundle.crt file found in that search would have been ignored by Schannel. But, with CAINFO support, the file found by that search would have been used as the certificate store and could cause issues for any users that have curl-ca-bundle.crt in the search path. - Update url.c to not set the build time CURL_CA_BUNDLE if the selected SSL backend is Schannel. We allow setting CA location for schannel only when explicitly specified by the user via CURLOPT_CAINFO / --cacert. - Add new test cases 3000 and 3001. These test cases check that the first and last SAN, respectively, matches the connection hostname. New test certificates have been added for these cases. For 3000, the certificate prefix is Server-localhost-firstSAN and for 3001, the certificate prefix is Server-localhost-secondSAN. - Remove TODO 15.2 (Add support for custom server certificate validation), this commit addresses it. Closes https://github.com/curl/curl/pull/1325
2017-03-10 15:27:30 -05:00
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Alternative Name:
DNS:localhost1, DNS:localhost2, DNS:localhost
X509v3 Key Usage:
Digital Signature, Key Encipherment, Key Agreement
X509v3 Extended Key Usage:
TLS Web Server Authentication
X509v3 Subject Key Identifier:
certs/Server-localhost-lastSAN-sv: regenerate with sha256 All other certificates were regenerated in commit ba782baac30, but this one was missed. Fixes test3001 on modern systems. Closes https://github.com/curl/curl/pull/4551
2019-11-02 09:04:28 -04:00
4E:54:63:95:A1:58:0C:FA:BD:3E:58:26:AF:AF:A4:F3:66:1A:CB:25
schannel: add support for CURLOPT_CAINFO - Move verify_certificate functionality in schannel.c into a new file called schannel_verify.c. Additionally, some structure defintions from schannel.c have been moved to schannel.h to allow them to be used in schannel_verify.c. - Make verify_certificate functionality for Schannel available on all versions of Windows instead of just Windows CE. verify_certificate will be invoked on Windows CE or when the user specifies CURLOPT_CAINFO and CURLOPT_SSL_VERIFYPEER. - In verify_certificate, create a custom certificate chain engine that exclusively trusts the certificate store backed by the CURLOPT_CAINFO file. - doc updates of --cacert/CAINFO support for schannel - Use CERT_NAME_SEARCH_ALL_NAMES_FLAG when invoking CertGetNameString when available. This implements a TODO in schannel.c to improve handling of multiple SANs in a certificate. In particular, all SANs will now be searched instead of just the first name. - Update tool_operate.c to not search for the curl-ca-bundle.crt file when using Schannel to maintain backward compatibility. Previously, any curl-ca-bundle.crt file found in that search would have been ignored by Schannel. But, with CAINFO support, the file found by that search would have been used as the certificate store and could cause issues for any users that have curl-ca-bundle.crt in the search path. - Update url.c to not set the build time CURL_CA_BUNDLE if the selected SSL backend is Schannel. We allow setting CA location for schannel only when explicitly specified by the user via CURLOPT_CAINFO / --cacert. - Add new test cases 3000 and 3001. These test cases check that the first and last SAN, respectively, matches the connection hostname. New test certificates have been added for these cases. For 3000, the certificate prefix is Server-localhost-firstSAN and for 3001, the certificate prefix is Server-localhost-secondSAN. - Remove TODO 15.2 (Add support for custom server certificate validation), this commit addresses it. Closes https://github.com/curl/curl/pull/1325
2017-03-10 15:27:30 -05:00
X509v3 Authority Key Identifier:
keyid:12:CA:BA:4B:46:04:A7:75:8A:2C:E8:0E:54:94:BC:12:65:A6:7B:CE
X509v3 Basic Constraints:
CA:FALSE
certs/Server-localhost-lastSAN-sv: regenerate with sha256 All other certificates were regenerated in commit ba782baac30, but this one was missed. Fixes test3001 on modern systems. Closes https://github.com/curl/curl/pull/4551
2019-11-02 09:04:28 -04:00
Signature Algorithm: sha256WithRSAEncryption
2c:f9:48:33:7c:93:ca:3c:9c:58:92:8c:2b:87:61:9f:0d:9c:
9d:e8:43:43:12:d6:a3:40:71:ec:cb:31:76:80:68:b1:54:d1:
86:f4:b3:9e:c8:50:62:b4:87:12:be:9b:d6:3c:2b:cf:22:0e:
66:26:c2:31:dd:1f:c6:97:1e:61:a4:51:ea:68:75:81:66:b9:
3b:a6:1f:f6:80:ec:6b:aa:65:66:0c:02:ab:c9:57:bd:6a:4e:
6d:24:30:13:7b:65:17:60:9a:14:37:57:f7:22:66:55:7d:1a:
1a:5b:27:43:3b:d4:88:bc:2f:d3:d7:bb:d5:3f:9b:25:26:5d:
39:a0:4c:8a:84:2c:db:04:87:8a:df:49:7d:4b:d2:85:7a:09:
5e:df:6b:1b:b5:6e:9c:bb:2b:f6:c5:01:19:5a:87:d0:cf:16:
67:8b:54:41:87:c1:33:c3:21:f6:e5:84:d2:84:5d:da:82:cd:
39:4d:50:97:f3:83:37:9e:e5:04:0e:dc:c6:20:d1:b3:f6:c7:
3d:dd:95:be:8c:b9:72:72:7a:71:66:aa:4a:8e:cf:37:38:e8:
c8:06:69:68:8d:d8:d6:8b:4c:23:50:27:fa:e9:bb:2a:a6:89:
56:ad:be:4d:bd:be:0c:d7:55:b4:f4:b9:f7:6a:b5:2c:7f:5f:
9f:df:f6:61
schannel: add support for CURLOPT_CAINFO - Move verify_certificate functionality in schannel.c into a new file called schannel_verify.c. Additionally, some structure defintions from schannel.c have been moved to schannel.h to allow them to be used in schannel_verify.c. - Make verify_certificate functionality for Schannel available on all versions of Windows instead of just Windows CE. verify_certificate will be invoked on Windows CE or when the user specifies CURLOPT_CAINFO and CURLOPT_SSL_VERIFYPEER. - In verify_certificate, create a custom certificate chain engine that exclusively trusts the certificate store backed by the CURLOPT_CAINFO file. - doc updates of --cacert/CAINFO support for schannel - Use CERT_NAME_SEARCH_ALL_NAMES_FLAG when invoking CertGetNameString when available. This implements a TODO in schannel.c to improve handling of multiple SANs in a certificate. In particular, all SANs will now be searched instead of just the first name. - Update tool_operate.c to not search for the curl-ca-bundle.crt file when using Schannel to maintain backward compatibility. Previously, any curl-ca-bundle.crt file found in that search would have been ignored by Schannel. But, with CAINFO support, the file found by that search would have been used as the certificate store and could cause issues for any users that have curl-ca-bundle.crt in the search path. - Update url.c to not set the build time CURL_CA_BUNDLE if the selected SSL backend is Schannel. We allow setting CA location for schannel only when explicitly specified by the user via CURLOPT_CAINFO / --cacert. - Add new test cases 3000 and 3001. These test cases check that the first and last SAN, respectively, matches the connection hostname. New test certificates have been added for these cases. For 3000, the certificate prefix is Server-localhost-firstSAN and for 3001, the certificate prefix is Server-localhost-secondSAN. - Remove TODO 15.2 (Add support for custom server certificate validation), this commit addresses it. Closes https://github.com/curl/curl/pull/1325
2017-03-10 15:27:30 -05:00
-----BEGIN CERTIFICATE-----
certs/Server-localhost-lastSAN-sv: regenerate with sha256 All other certificates were regenerated in commit ba782baac30, but this one was missed. Fixes test3001 on modern systems. Closes https://github.com/curl/curl/pull/4551
2019-11-02 09:04:28 -04:00
MIID3jCCAsagAwIBAgIGDk25xiSwMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNVBAYT
schannel: add support for CURLOPT_CAINFO - Move verify_certificate functionality in schannel.c into a new file called schannel_verify.c. Additionally, some structure defintions from schannel.c have been moved to schannel.h to allow them to be used in schannel_verify.c. - Make verify_certificate functionality for Schannel available on all versions of Windows instead of just Windows CE. verify_certificate will be invoked on Windows CE or when the user specifies CURLOPT_CAINFO and CURLOPT_SSL_VERIFYPEER. - In verify_certificate, create a custom certificate chain engine that exclusively trusts the certificate store backed by the CURLOPT_CAINFO file. - doc updates of --cacert/CAINFO support for schannel - Use CERT_NAME_SEARCH_ALL_NAMES_FLAG when invoking CertGetNameString when available. This implements a TODO in schannel.c to improve handling of multiple SANs in a certificate. In particular, all SANs will now be searched instead of just the first name. - Update tool_operate.c to not search for the curl-ca-bundle.crt file when using Schannel to maintain backward compatibility. Previously, any curl-ca-bundle.crt file found in that search would have been ignored by Schannel. But, with CAINFO support, the file found by that search would have been used as the certificate store and could cause issues for any users that have curl-ca-bundle.crt in the search path. - Update url.c to not set the build time CURL_CA_BUNDLE if the selected SSL backend is Schannel. We allow setting CA location for schannel only when explicitly specified by the user via CURLOPT_CAINFO / --cacert. - Add new test cases 3000 and 3001. These test cases check that the first and last SAN, respectively, matches the connection hostname. New test certificates have been added for these cases. For 3000, the certificate prefix is Server-localhost-firstSAN and for 3001, the certificate prefix is Server-localhost-secondSAN. - Remove TODO 15.2 (Add support for custom server certificate validation), this commit addresses it. Closes https://github.com/curl/curl/pull/1325
2017-03-10 15:27:30 -05:00
Ak5OMTEwLwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNo
IENsb3VkMSYwJAYDVQQDDB1Ob3J0aGVybiBOb3doZXJlIFRydXN0IEFuY2hvcjAe
certs/Server-localhost-lastSAN-sv: regenerate with sha256 All other certificates were regenerated in commit ba782baac30, but this one was missed. Fixes test3001 on modern systems. Closes https://github.com/curl/curl/pull/4551
2019-11-02 09:04:28 -04:00
Fw0xOTExMDIxMjUzMjVaFw0yODAxMTkxMjUzMjVaMFcxCzAJBgNVBAYTAk5OMTEw
schannel: add support for CURLOPT_CAINFO - Move verify_certificate functionality in schannel.c into a new file called schannel_verify.c. Additionally, some structure defintions from schannel.c have been moved to schannel.h to allow them to be used in schannel_verify.c. - Make verify_certificate functionality for Schannel available on all versions of Windows instead of just Windows CE. verify_certificate will be invoked on Windows CE or when the user specifies CURLOPT_CAINFO and CURLOPT_SSL_VERIFYPEER. - In verify_certificate, create a custom certificate chain engine that exclusively trusts the certificate store backed by the CURLOPT_CAINFO file. - doc updates of --cacert/CAINFO support for schannel - Use CERT_NAME_SEARCH_ALL_NAMES_FLAG when invoking CertGetNameString when available. This implements a TODO in schannel.c to improve handling of multiple SANs in a certificate. In particular, all SANs will now be searched instead of just the first name. - Update tool_operate.c to not search for the curl-ca-bundle.crt file when using Schannel to maintain backward compatibility. Previously, any curl-ca-bundle.crt file found in that search would have been ignored by Schannel. But, with CAINFO support, the file found by that search would have been used as the certificate store and could cause issues for any users that have curl-ca-bundle.crt in the search path. - Update url.c to not set the build time CURL_CA_BUNDLE if the selected SSL backend is Schannel. We allow setting CA location for schannel only when explicitly specified by the user via CURLOPT_CAINFO / --cacert. - Add new test cases 3000 and 3001. These test cases check that the first and last SAN, respectively, matches the connection hostname. New test certificates have been added for these cases. For 3000, the certificate prefix is Server-localhost-firstSAN and for 3001, the certificate prefix is Server-localhost-secondSAN. - Remove TODO 15.2 (Add support for custom server certificate validation), this commit addresses it. Closes https://github.com/curl/curl/pull/1325
2017-03-10 15:27:30 -05:00
LwYDVQQKDChFZGVsIEN1cmwgQXJjdGljIElsbHVkaXVtIFJlc2VhcmNoIENsb3Vk
tests/certs: rebuild certs with 2048-bit RSA keys The previous test certificates contained RSA keys of only 1024 bits. However, RSA claims that 1024-bit RSA keys are likely to become crackable some time before 2010. The NIST recommends at least 2048-bit keys for RSA for now. Better use full 2048 also for testing. Closes #2973
2018-09-10 14:32:23 -04:00
MRUwEwYDVQQDDAxsb2NhbGhvc3Qubm4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
certs/Server-localhost-lastSAN-sv: regenerate with sha256 All other certificates were regenerated in commit ba782baac30, but this one was missed. Fixes test3001 on modern systems. Closes https://github.com/curl/curl/pull/4551
2019-11-02 09:04:28 -04:00
ggEKAoIBAQC9lw6nbbZzjNAha/M2dF0Kqjrw+m6xXBwTdMpnKyID0aY8Je+HT+g4
nyEdLogSNmaCAwJM+Bc1ApUxsVNAISQvAPC/gFgWsZKz03i/eMsKkQzSbV2yH0Fz
FgJ8Gs0WJcnhG4G9hJNMY8449D6tmGsAiai69X4Ig/Oa9Zi4n9bYx9TzBxyP77wp
EGCMhYtMenPHn6gjL8RH9RiFmPsn3liTSwilZsnf2/Ai+GSfoVaJl6sCLFqZ8m+/
cjGQIjKuhiVrE8Zy7N8uyBIAweM4tKBAugFhwtex731LKRji/ijQmORlP0w0OeSC
qcqyPcSRj6CUv+P4s3NIt/76BEPntby9AgMBAAGjgZ4wgZswLAYDVR0RBCUwI4IK
tests/certs: rebuild certs with 2048-bit RSA keys The previous test certificates contained RSA keys of only 1024 bits. However, RSA claims that 1024-bit RSA keys are likely to become crackable some time before 2010. The NIST recommends at least 2048-bit keys for RSA for now. Better use full 2048 also for testing. Closes #2973
2018-09-10 14:32:23 -04:00
bG9jYWxob3N0MYIKbG9jYWxob3N0MoIJbG9jYWxob3N0MAsGA1UdDwQEAwIDqDAT
certs/Server-localhost-lastSAN-sv: regenerate with sha256 All other certificates were regenerated in commit ba782baac30, but this one was missed. Fixes test3001 on modern systems. Closes https://github.com/curl/curl/pull/4551
2019-11-02 09:04:28 -04:00
BgNVHSUEDDAKBggrBgEFBQcDATAdBgNVHQ4EFgQUTlRjlaFYDPq9Plgmr6+k82Ya
yyUwHwYDVR0jBBgwFoAUEsq6S0YEp3WKLOgOVJS8EmWme84wCQYDVR0TBAIwADAN
BgkqhkiG9w0BAQsFAAOCAQEALPlIM3yTyjycWJKMK4dhnw2cnehDQxLWo0Bx7Msx
doBosVTRhvSznshQYrSHEr6b1jwrzyIOZibCMd0fxpceYaRR6mh1gWa5O6Yf9oDs
a6plZgwCq8lXvWpObSQwE3tlF2CaFDdX9yJmVX0aGlsnQzvUiLwv09e71T+bJSZd
OaBMioQs2wSHit9JfUvShXoJXt9rG7VunLsr9sUBGVqH0M8WZ4tUQYfBM8Mh9uWE
0oRd2oLNOU1Ql/ODN57lBA7cxiDRs/bHPd2Vvoy5cnJ6cWaqSo7PNzjoyAZpaI3Y
1otMI1An+um7KqaJVq2+Tb2+DNdVtPS592q1LH9fn9/2YQ==
schannel: add support for CURLOPT_CAINFO - Move verify_certificate functionality in schannel.c into a new file called schannel_verify.c. Additionally, some structure defintions from schannel.c have been moved to schannel.h to allow them to be used in schannel_verify.c. - Make verify_certificate functionality for Schannel available on all versions of Windows instead of just Windows CE. verify_certificate will be invoked on Windows CE or when the user specifies CURLOPT_CAINFO and CURLOPT_SSL_VERIFYPEER. - In verify_certificate, create a custom certificate chain engine that exclusively trusts the certificate store backed by the CURLOPT_CAINFO file. - doc updates of --cacert/CAINFO support for schannel - Use CERT_NAME_SEARCH_ALL_NAMES_FLAG when invoking CertGetNameString when available. This implements a TODO in schannel.c to improve handling of multiple SANs in a certificate. In particular, all SANs will now be searched instead of just the first name. - Update tool_operate.c to not search for the curl-ca-bundle.crt file when using Schannel to maintain backward compatibility. Previously, any curl-ca-bundle.crt file found in that search would have been ignored by Schannel. But, with CAINFO support, the file found by that search would have been used as the certificate store and could cause issues for any users that have curl-ca-bundle.crt in the search path. - Update url.c to not set the build time CURL_CA_BUNDLE if the selected SSL backend is Schannel. We allow setting CA location for schannel only when explicitly specified by the user via CURLOPT_CAINFO / --cacert. - Add new test cases 3000 and 3001. These test cases check that the first and last SAN, respectively, matches the connection hostname. New test certificates have been added for these cases. For 3000, the certificate prefix is Server-localhost-firstSAN and for 3001, the certificate prefix is Server-localhost-secondSAN. - Remove TODO 15.2 (Add support for custom server certificate validation), this commit addresses it. Closes https://github.com/curl/curl/pull/1325
2017-03-10 15:27:30 -05:00
-----END CERTIFICATE-----
Reference in New Issue Copy Permalink