32 lines
1.8 KiB
Diff
32 lines
1.8 KiB
Diff
diff --git a/src/network/ssl/qsslsocket_schannel.cpp b/src/network/ssl/qsslsocket_schannel.cpp
|
|
index c956ce3c..86381886 100644
|
|
--- a/src/network/ssl/qsslsocket_schannel.cpp
|
|
+++ b/src/network/ssl/qsslsocket_schannel.cpp
|
|
@@ -1880,6 +1880,26 @@ bool QSslSocketBackendPrivate::verifyCertContext(CERT_CONTEXT *certContext)
|
|
if (configuration.peerVerifyDepth > 0 && DWORD(configuration.peerVerifyDepth) < verifyDepth)
|
|
verifyDepth = DWORD(configuration.peerVerifyDepth);
|
|
|
|
+ if (!rootCertOnDemandLoadingAllowed()
|
|
+ && !(chain->TrustStatus.dwErrorStatus & CERT_TRUST_IS_PARTIAL_CHAIN)
|
|
+ && (q->peerVerifyMode() == QSslSocket::VerifyPeer
|
|
+ || (isClient && q->peerVerifyMode() == QSslSocket::AutoVerifyPeer))) {
|
|
+ // When verifying a peer Windows "helpfully" builds a chain that
|
|
+ // may include roots from the system store. But we don't want that if
|
|
+ // the user has set their own CA certificates.
|
|
+ // Since Windows claims this is not a partial chain the root is included
|
|
+ // and we have to check that it is one of our configured CAs.
|
|
+ CERT_CHAIN_ELEMENT *element = chain->rgpElement[chain->cElement - 1];
|
|
+ QSslCertificate certificate = getCertificateFromChainElement(element);
|
|
+ if (!caCertificates.contains(certificate)) {
|
|
+ auto error = QSslError(QSslError::CertificateUntrusted, certificate);
|
|
+ sslErrors += error;
|
|
+ emit q->peerVerifyError(error);
|
|
+ if (q->state() != QAbstractSocket::ConnectedState)
|
|
+ return false;
|
|
+ }
|
|
+ }
|
|
+
|
|
for (DWORD i = 0; i < verifyDepth; i++) {
|
|
CERT_CHAIN_ELEMENT *element = chain->rgpElement[i];
|
|
QSslCertificate certificate = getCertificateFromChainElement(element);
|