mirrors/zig
1
0
Fork 0
mirror of https://codeberg.org/ziglang/zig.git synced 2025-12-06 13:54:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

skip certificate which is not part of the chain

Browse source 
Fixes: 25606

Browsers and curl ignore extra irrelevant certificates in the chain.

This fix skips certificate which is not part of the chain. Remaining
certificates still form an unbroken chain of signatures with the
last one trusted by root CA.

Some other domain which also have extra certificates in the chain:
 - jhu.edu
 - last.fm
 - terra.com.br
This commit is contained in:
Igor Anić 2025-10-17 16:33:06 +02:00
parent 2ab0ca13bb
commit 91e04a24af
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
lib/std/crypto/tls/Client.zig
View file

@ -637,7 +637,14 @@ pub fn init(input: *Reader, output: *Writer, options: Options) InitError!Client
// certificate_verify message later.
try main_cert_pub_key.init(subject.pub_key_algo, subject.pubKey());
} else {
try prev_cert.verify(subject, now_sec);
prev_cert.verify(subject, now_sec) catch |err| switch (err) {
error.CertificateIssuerMismatch => {
// Skip certificate which is not part of the chain
cert_index += 1;
continue;
},
else => |e| return e,
};
}
switch (options.ca) {