summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAndy Shaw <andy.shaw@digia.com>2015-01-14 21:47:55 (GMT)
committerAndy Shaw <andy.shaw@digia.com>2015-01-14 22:05:15 (GMT)
commit7fcb100bbf6e8482039f915a9df93d951f7d52e6 (patch)
tree13f55d3aa2dac52ca70c9c9ff8003471566eecf0
parent8032b176785c0a7d068a039a10fe7b1b59292a20 (diff)
downloadQt-7fcb100bbf6e8482039f915a9df93d951f7d52e6.zip
Qt-7fcb100bbf6e8482039f915a9df93d951f7d52e6.tar.gz
Qt-7fcb100bbf6e8482039f915a9df93d951f7d52e6.tar.bz2
Ignore expired certificate during certificate validation
OpenSSL has a bug when validating a chain with two certificates. If a certificate exists twice (which is a valid use case for renewed CAs), and the first one it hits is expired (which depends on the order on data structure internal to OpenSSL), it will fail to validate the chain. This is only a bandaid fix, which trades improved chain validation for error reporting accuracy. However given that reissuing of CA certs is a real problem that is only getting worse, this fix is needed. See also: https://www.openssl.org/docs/ssl/SSL_CTX_load_verify_locations.html#WARNINGS [ChangeLog][QtNetwork][QSslSocket] Added a workaround to an OpenSSL problem that may cause errors when the trust store contains two certificates of the issuing CA, one of which is expired. Task-number: QTBUG-38896 (cherry picked and adapted from qtbase/0065b55da42b8c6ee0095264b5275fb708887c9d) Change-Id: I2515d79a442bec96734ea88ea850e6e8c2123a6c Reviewed-by: Richard J. Moore <rich@kde.org>
-rw-r--r--src/network/ssl/qsslsocket_openssl.cpp31
1 files changed, 12 insertions, 19 deletions
diff --git a/src/network/ssl/qsslsocket_openssl.cpp b/src/network/ssl/qsslsocket_openssl.cpp
index 0ea174e..5fe55d5 100644
--- a/src/network/ssl/qsslsocket_openssl.cpp
+++ b/src/network/ssl/qsslsocket_openssl.cpp
@@ -350,26 +350,19 @@ init_context:
}
// Add all our CAs to this store.
- QList<QSslCertificate> expiredCerts;
foreach (const QSslCertificate &caCertificate, q->caCertificates()) {
- // add expired certs later, so that the
- // valid ones are used before the expired ones
- if (! caCertificate.isValid()) {
- expiredCerts.append(caCertificate);
- } else {
- q_X509_STORE_add_cert(ctx->cert_store, (X509 *)caCertificate.handle());
- }
- }
-
- bool addExpiredCerts = true;
-#if defined(Q_OS_MAC) && (MAC_OS_X_VERSION_MAX_ALLOWED == MAC_OS_X_VERSION_10_5)
- //On Leopard SSL does not work if we add the expired certificates.
- if (QSysInfo::MacintoshVersion == QSysInfo::MV_10_5)
- addExpiredCerts = false;
-#endif
- // now add the expired certs
- if (addExpiredCerts) {
- foreach (const QSslCertificate &caCertificate, expiredCerts) {
+ // From https://www.openssl.org/docs/ssl/SSL_CTX_load_verify_locations.html:
+ //
+ // If several CA certificates matching the name, key identifier, and
+ // serial number condition are available, only the first one will be
+ // examined. This may lead to unexpected results if the same CA
+ // certificate is available with different expiration dates. If a
+ // ``certificate expired'' verification error occurs, no other
+ // certificate will be searched. Make sure to not have expired
+ // certificates mixed with valid ones.
+ //
+ // See also: QSslContext::fromConfiguration()
+ if (caCertificate.expiryDate() >= QDateTime::currentDateTime()) {
q_X509_STORE_add_cert(ctx->cert_store, (X509 *)caCertificate.handle());
}
}