Repository navigation
Conversation
CryptoAPI got only the leaf, so it fetched an issuer from the leaf's AIA URL instead of using the intermediates the server sent. For accounts.spotify.com that issuer chains to Certainly Root R1, which Windows does not trust, while the server's own chain ends at Starfield Root G2. Add the server's intermediates to the store CryptoAPI builds the chain from. This covers the OpenSSL backend. Refs #2596
Windows adds a root it trusts to its store only when CryptoAPI needs it to build a chain. The OpenSSL store is loaded from the Windows store, so OpenSSL fails with "unable to get local issuer certificate" before the CryptoAPI check runs, and Windows never gets to fetch the root. When Windows certificate verification is enabled, leave that error to the CryptoAPI check. Since OpenSSL then skips its purpose check, request the server authentication usage from CryptoAPI, and fail instead of skipping the CryptoAPI check when the leaf cannot be encoded. Refs #2596
yhirose
force-pushed
the
windows-verify-intermediates
branch
from
October 2, 2026 13:30
1cdd4ed to
086a648
Compare
yhirose
force-pushed
the
windows-defer-missing-root
branch
from
October 2, 2026 13:30
e137c37 to
9af2341
Compare
yhirose
changed the title
yhirose
force-pushed
the
windows-verify-intermediates
branch
from
October 2, 2026 19:29
086a648 to
75cc18b
Compare
Owner
Author
|
Superseded by #2604, which makes CryptoAPI the only chain verifier for every backend instead of deferring only this OpenSSL error. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #2596. Stacked on #2602. Only the last commit belongs to this PR.
Problem
On Windows, the OpenSSL trust store is loaded from the Windows
ROOTandCAstores. Windows does not keep every root it trusts in those stores. It adds a root only when CryptoAPI needs it to build a chain.Starfield Root Certificate Authority - G2is one example. On a machine that has not needed it yet,accounts.spotify.comfails like this:OpenSSL fails first with
X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY. The CryptoAPI check, which would make Windows fetch the root, never runs.Fix
When Windows certificate verification is enabled, the OpenSSL backend no longer fails on
X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY. It leaves the decision to the CryptoAPI check that already runs afterwards. Two small changes keep that check complete:CERT_CHAIN_POLICY_SSLdoes not check the extended key usage either. SoCertGetCertificateChain()now requestsszOID_PKIX_KP_SERVER_AUTH.Behavior changes with Windows verification enabled
incomplete-chain.badssl.com).ssl_backend_error()holds the CryptoAPI status instead of20.Verification
All checks ran on a
windows-latestGitHub Actions runner with OpenSSL 3.x.accounts.spotify.com, Starfield Root G2 removed, automatic root update enableduntrusted-root,self-signed,expired,wrong.hoston badssl.comclientAuthEKU, under a root Windows trusts but OpenSSL does not haveCERT_TRUST_IS_NOT_VALID_FOR_USAGEAdded
SSLClientTest.WindowsCertificateVerification_UnknownIssuerRejected. It runs offline on Windows CI and checks that a chain under a root Windows does not trust is still rejected after the error is left to CryptoAPI.