1
0
mirror of https://github.com/moparisthebest/curl synced 2024-12-23 16:48:49 -05:00
curl/docs
Johannes Schindelin 5450428491 schannel: add "best effort" revocation check option
- Implement new option CURLSSLOPT_REVOKE_BEST_EFFORT and
  --ssl-revoke-best-effort to allow a "best effort" revocation check.

A best effort revocation check ignores errors that the revocation check
was unable to take place. The reasoning is described in detail below and
discussed further in the PR.

---

When running e.g. with Fiddler, the schannel backend fails with an
unhelpful error message:

	Unknown error (0x80092012) - The revocation function was unable
	to check revocation for the certificate.

Sadly, many enterprise users who are stuck behind MITM proxies suffer
the very same problem.

This has been discussed in plenty of issues:
https://github.com/curl/curl/issues/3727,
https://github.com/curl/curl/issues/264, for example.

In the latter, a Microsoft Edge developer even made the case that the
common behavior is to ignore issues when a certificate has no recorded
distribution point for revocation lists, or when the server is offline.
This is also known as "best effort" strategy and addresses the Fiddler
issue.

Unfortunately, this strategy was not chosen as the default for schannel
(and is therefore a backend-specific behavior: OpenSSL seems to happily
ignore the offline servers and missing distribution points).

To maintain backward-compatibility, we therefore add a new flag
(`CURLSSLOPT_REVOKE_BEST_EFFORT`) and a new option
(`--ssl-revoke-best-effort`) to select the new behavior.

Due to the many related issues Git for Windows and GitHub Desktop, the
plan is to make this behavior the default in these software packages.

The test 2070 was added to verify this behavior, adapted from 310.

Based-on-work-by: georgeok <giorgos.n.oikonomou@gmail.com>
Co-authored-by: Markus Olsson <j.markus.olsson@gmail.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

Closes https://github.com/curl/curl/pull/4981
2020-03-18 03:23:39 -04:00
..
cmdline-opts schannel: add "best effort" revocation check option 2020-03-18 03:23:39 -04:00
examples Makefile.m32: Improve windres parameter compatibility 2020-03-14 19:08:17 -04:00
libcurl schannel: add "best effort" revocation check option 2020-03-18 03:23:39 -04:00
.gitignore gitignore: Ignore man page dist files 2017-03-07 23:27:31 +01:00
ALTSVC.md docs: fix typos 2019-11-28 12:58:47 +01:00
BINDINGS.md BINDINGS: PureBasic, Net::Curl for perl and Nim 2019-09-29 22:39:31 +02:00
BUG-BOUNTY.md BUG-BOUNTY: minor formatting fixes [ci skip] 2019-05-09 23:30:26 +02:00
BUGS docs/BUG-BOUNTY: bug bounty time [skip ci] 2019-04-22 17:19:19 +02:00
CHECKSRC.md checksrc: add COPYRIGHTYEAR check 2018-12-03 23:13:40 +01:00
CIPHERS.md CIPHERS.md: Explain Schannel error SEC_E_ALGORITHM_MISMATCH 2019-07-17 01:08:23 -04:00
CMakeLists.txt cmake: add support for building HTML and PDF docs 2017-03-21 14:49:53 +01:00
CODE_OF_CONDUCT.md docs: Update to secure URL versions 2017-09-04 14:08:54 +00:00
CODE_STYLE.md docs: Markdown and misc improvements [ci skip] 2019-05-16 22:11:27 +00:00
CONTRIBUTE.md CONTRIBUTE.md: Fix grammatical errors 2019-02-05 11:56:04 +01:00
curl-config.1 curl-config: add --ssl-backends 2017-12-06 00:12:48 +01:00
CURL-DISABLE.md docs: fix some typos 2019-12-06 13:20:30 +01:00
DEPRECATE.md polarssl: removed 2020-01-16 11:55:56 +01:00
ESNI.md docs: fix some typos 2019-12-06 13:20:30 +01:00
EXPERIMENTAL.md docs/EXPERIMENTAL: explain what it means and what's experimental now 2019-08-07 14:52:02 +02:00
FAQ TLS: add BearSSL vtls implementation 2019-11-26 08:32:23 +01:00
FEATURES axtls: removed 2018-11-01 10:29:53 +01:00
GOVERNANCE.md docs/GOVERNANCE: refreshed + added "donations" and "commercial support" 2020-02-18 09:18:28 +01:00
HELP-US.md HELP-US: rename the subtitle too since the label is changed 2017-10-27 11:19:44 +02:00
HISTORY.md HISTORY: OSS-Fuzz started fuzzing libcurl in 2017 2019-12-20 11:04:34 +01:00
HTTP2.md winssl: be consistent in Schannel capitalization 2018-11-07 10:11:13 +01:00
HTTP3.md altsvc: both h3 backends now speak h3-27 2020-03-02 00:07:37 +01:00
HTTP-COOKIES.md HTTP-COOKIES: mention that a trailing newline is required 2020-02-19 08:04:35 +01:00
INSTALL INSTALL: converted to markdown => INSTALL.md 2016-10-21 15:57:29 +02:00
INSTALL.cmake whitespace fixes 2018-09-23 22:24:02 +00:00
INSTALL.md polarssl: remove more references and mentions 2020-03-05 07:57:45 +01:00
INTERNALS.md polarssl: remove more references and mentions 2020-03-05 07:57:45 +01:00
KNOWN_BUGS KNOWN_BUGS: configure --with-gssapi with Heimdal is ignored on macOS 2020-03-05 14:27:14 +01:00
LICENSE-MIXING.md TLS: add BearSSL vtls implementation 2019-11-26 08:32:23 +01:00
MAIL-ETIQUETTE spelling fixes 2018-06-03 12:14:45 +00:00
Makefile.am CURL-DISABLE: initial docs for the CURL_DISABLE_* defines 2019-11-12 09:35:39 +01:00
MANUAL.md MANUAL: update a dict-using command line 2020-03-05 14:30:13 +01:00
mk-ca-bundle.1 docs/comments: Update to secure URL versions 2017-08-08 21:41:07 +02:00
PARALLEL-TRANSFERS.md docs: fix typos 2019-11-28 12:58:47 +01:00
README.cmake removed execute file permission 2011-12-30 03:53:25 +01:00
README.md replace rawgit links [ci skip] 2018-10-12 21:04:37 +00:00
README.netware whitespace fixes 2018-09-23 22:24:02 +00:00
README.win32 whitespace fixes 2018-09-23 22:24:02 +00:00
RELEASE-PROCEDURE.md RELEASE-PROCEDURE: feature win is closed post-release a few days 2020-02-04 22:29:56 +01:00
RESOURCES RESOURCES: update spec names 2017-12-04 09:15:39 +01:00
ROADMAP.md ROADMAP: thread-safe curl_global_init() 2020-01-17 12:58:35 +01:00
SECURITY-PROCESS.md SECURITY-PROCESS: fix links [ci skip] 2019-05-11 17:50:37 +02:00
SSL-PROBLEMS.md docs: Markdown and misc improvements [ci skip] 2019-05-16 22:11:27 +00:00
SSLCERTS.md SSLCERTS: improve the openssl command line 2018-08-20 14:05:28 +02:00
THANKS THANKS: from the 7.69.1 release 2020-03-11 00:36:17 +01:00
THANKS-filter THANKS-filter: deal with my typos 'Jat' => 'Jay' 2019-09-20 13:53:23 +02:00
TheArtOfHttpScripting whitespace fixes 2018-09-23 22:24:02 +00:00
TODO TODO: TLS-PSK with OpenSSL 2020-03-15 11:34:14 +01:00
VERSIONS VERSIONS: now using markdown 2015-06-10 00:21:06 +02:00

curl logo

Documentation

You'll find a mix of various documentation in this directory and subdirectories, using several different formats. Some of them are not ideal for reading directly in your browser.

If you'd rather see the rendered version of the documentation, check out the curl web site's documentation section for general curl stuff or the libcurl section for libcurl related documentation.