diff options
| author | Nils Maier <maierman@web.de> | 2014-04-12 17:55:11 +0200 |
|---|---|---|
| committer | Nils Maier <maierman@web.de> | 2014-04-13 18:50:38 +0200 |
| commit | 0a51b8d172d3b51f8ff74f5410d936667aca4de2 (patch) | |
| tree | 71a3f242ee4f6e010d955155159c3b72978ad561 /src/WinTLSContext.cc | |
| parent | 13a202df070dd58bb930549c62627dcd97b02b86 (diff) | |
WinTLS: Accept chains with no revocation information.
This is kind what browser do anyway (IE, Firefox, Chrome tested), what
AppleTLS does, what GnuTLS does and what OpenSSL does. Actually, most
browsers will also be OK with the CRL/OCSP provider being offline.
WinTLS will still fail in that case.
Should revocation information be available in the trust chain (CRL or
OCSP) the certificate still will be checked!
"Real" CAs, aka. those provided by the OS or system CA bundle, usually
provide revocation information and are thus still checked.
It should be mostly (only?) custom (organization) CAs that lack
revocation information, but those users might want to use aria2 in their
intranets and VPNs anyway ;)
See #217
Diffstat (limited to 'src/WinTLSContext.cc')
| -rw-r--r-- | src/WinTLSContext.cc | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/WinTLSContext.cc b/src/WinTLSContext.cc index 8b7e4bb5..1c678409 100644 --- a/src/WinTLSContext.cc +++ b/src/WinTLSContext.cc @@ -94,7 +94,8 @@ void WinTLSContext::setVerifyPeer(bool verify) credentials_.dwFlags = SCH_CRED_NO_DEFAULT_CREDS | SCH_CRED_AUTO_CRED_VALIDATION | - SCH_CRED_REVOCATION_CHECK_CHAIN; + SCH_CRED_REVOCATION_CHECK_CHAIN | + SCH_CRED_IGNORE_NO_REVOCATION_CHECK; } else { credentials_.dwFlags = |