Adding ca_chain_with_root_store! to ssl.jl #210
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
authority chain instead of the bundled ca_cert.pem
…d x509_crl.jl mimicing x509_crt.jl
…ities. Added a TrustedPublisher as another store.
Codecov Report
@@ Coverage Diff @@
## master #210 +/- ##
==========================================
- Coverage 71.95% 58.35% -13.6%
==========================================
Files 12 14 +2
Lines 542 670 +128
==========================================
+ Hits 390 391 +1
- Misses 152 279 +127
Continue to review full report at Codecov.
|
|
Fixes #200 for Windows. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Recently I had a requirement to support reading certificates out of the Windows root certificate stores ("CA", "AuthRoot", "Root", "TrustedPublisher") instead of the
cacert.pemfile for our Julia application.I added that functionality and made it the default for Windows (see line 135 in MbedTLS.jl), so it would easily get used in HTTP.jl . This could be made the non-default to make this have a smaller impact; also I only worked with x64 windows machines.
It respects the CRLs found in Windows, but doesn't do anything with OCSPs or OCSP Stapling. Also I discovered a
DISALLOWED_FILETIMEproperty while comparing my certificates found from Windows API calls to the ones listed in the Windows Certificate Manager. (Mbed-TLS/mbedtls#2914)