aboutsummaryrefslogtreecommitdiff
path: root/contrib/epee/src
diff options
context:
space:
mode:
Diffstat (limited to 'contrib/epee/src')
-rw-r--r--contrib/epee/src/net_ssl.cpp42
1 files changed, 42 insertions, 0 deletions
diff --git a/contrib/epee/src/net_ssl.cpp b/contrib/epee/src/net_ssl.cpp
index 16454fce0..06997d3ba 100644
--- a/contrib/epee/src/net_ssl.cpp
+++ b/contrib/epee/src/net_ssl.cpp
@@ -43,6 +43,10 @@
// openssl req -new -key /tmp/KEY -out /tmp/REQ
// openssl x509 -req -days 999999 -sha256 -in /tmp/REQ -signkey /tmp/KEY -out /tmp/CERT
+#ifdef _WIN32
+static void add_windows_root_certs(SSL_CTX *ctx) noexcept;
+#endif
+
namespace
{
struct openssl_bio_free
@@ -324,7 +328,12 @@ boost::asio::ssl::context ssl_options_t::create_context() const
switch (verification)
{
case ssl_verification_t::system_ca:
+#ifdef _WIN32
+ try { add_windows_root_certs(ssl_context.native_handle()); }
+ catch (const std::exception &e) { ssl_context.set_default_verify_paths(); }
+#else
ssl_context.set_default_verify_paths();
+#endif
break;
case ssl_verification_t::user_certificates:
ssl_context.set_verify_depth(0);
@@ -558,3 +567,36 @@ bool ssl_support_from_string(ssl_support_t &ssl, boost::string_ref s)
} // namespace
} // namespace
+#ifdef _WIN32
+
+// https://stackoverflow.com/questions/40307541
+// Because Windows always has to do things wonkily
+#include <wincrypt.h>
+static void add_windows_root_certs(SSL_CTX *ctx) noexcept
+{
+ HCERTSTORE hStore = CertOpenSystemStore(0, "ROOT");
+ if (hStore == NULL) {
+ return;
+ }
+
+ X509_STORE *store = X509_STORE_new();
+ PCCERT_CONTEXT pContext = NULL;
+ while ((pContext = CertEnumCertificatesInStore(hStore, pContext)) != NULL) {
+ // convert from DER to internal format
+ X509 *x509 = d2i_X509(NULL,
+ (const unsigned char **)&pContext->pbCertEncoded,
+ pContext->cbCertEncoded);
+ if(x509 != NULL) {
+ X509_STORE_add_cert(store, x509);
+ X509_free(x509);
+ }
+ }
+
+ CertFreeCertificateContext(pContext);
+ CertCloseStore(hStore, 0);
+
+ // attach X509_STORE to boost ssl context
+ SSL_CTX_set_cert_store(ctx, store);
+}
+#endif
+