src/openssl/tls.c
static int
add_WIN_cacerts_to_openssl_store(SSL_CTX* tls_ctx, const getdns_log_config* log)
{
	HCERTSTORE      hSystemStore;
	PCCERT_CONTEXT  pTargetCert = NULL;

	_getdns_log(log, GETDNS_LOG_SYS_STUB, GETDNS_LOG_DEBUG
	    , "%s: %s\n", STUB_DEBUG_SETUP_TLS
	    , "Adding Windows certificates from system root store to CA store")
	    ;

	/* load just once per context lifetime for this version of getdns
	   TODO: dynamically update CA trust changes as they are available */
	assert(tls_ctx);

	/* Call wincrypt's CertOpenStore to open the CA root store. */

	if ((hSystemStore = CertOpenStore(
		CERT_STORE_PROV_SYSTEM,
		0,
		0,
		/* NOTE: mingw does not have this const: replace with 1 << 16 from code
		   CERT_SYSTEM_STORE_CURRENT_USER, */
		1 << 16,
		L"root")) == 0)
	{
		_getdns_log(log, GETDNS_LOG_SYS_STUB, GETDNS_LOG_ERR
		    , "%s: %s\n", STUB_DEBUG_SETUP_TLS
		    , "Could not CertOpenStore()");
		return 0;
	}

	X509_STORE* store = SSL_CTX_get_cert_store(tls_ctx);
	if (!store) {
		_getdns_log(log, GETDNS_LOG_SYS_STUB, GETDNS_LOG_ERR
		    , "%s: %s\n", STUB_DEBUG_SETUP_TLS
		    , "Could not SSL_CTX_get_cert_store()");
		return 0;
	}

	/* failure if the CA store is empty or the call fails */
	if ((pTargetCert = CertEnumCertificatesInStore(
	    hSystemStore, pTargetCert)) == 0) {
		_getdns_log(log, GETDNS_LOG_SYS_STUB, GETDNS_LOG_NOTICE
		    , "%s: %s\n", STUB_DEBUG_SETUP_TLS
		    , "CA certificate store for Windows is empty.");
		return 0;
	}
	/* iterate over the windows cert store and add to openssl store */
	do
	{
		X509 *cert1 = d2i_X509(NULL,
			(const unsigned char **)&pTargetCert->pbCertEncoded,
			pTargetCert->cbCertEncoded);
		if (!cert1) {
			/* return error if a cert fails */
			_getdns_log(log
			    , GETDNS_LOG_SYS_STUB, GETDNS_LOG_ERR
			    , "%s: %s %d:%s\n"
			    , STUB_DEBUG_SETUP_TLS
			    , "Unable to parse certificate in memory"
			    , ERR_get_error()
			    , ERR_error_string(ERR_get_error(), NULL));
			return 0;
		}
		else {
			/* return error if a cert add to store fails */
			if (X509_STORE_add_cert(store, cert1) == 0) {
				unsigned long error = ERR_peek_last_error();

				/* Ignore error X509_R_CERT_ALREADY_IN_HASH_TABLE which means the
				* certificate is already in the store.  */
				if(ERR_GET_LIB(error) != ERR_LIB_X509 ||
				   ERR_GET_REASON(error) != X509_R_CERT_ALREADY_IN_HASH_TABLE) {
					_getdns_log(log
					    , GETDNS_LOG_SYS_STUB
					    , GETDNS_LOG_ERR
					    , "%s: %s %d:%s\n"
					    , STUB_DEBUG_SETUP_TLS
					    , "Error adding certificate"
					    , ERR_get_error()
					    , ERR_error_string( ERR_get_error()
					                      , NULL)
					    );
					X509_free(cert1);
					return 0;
				}
			}
			X509_free(cert1);
		}
	} while ((pTargetCert = CertEnumCertificatesInStore(
		hSystemStore, pTargetCert)) != 0);

	/* Clean up memory and quit. */
	if (pTargetCert)
		CertFreeCertificateContext(pTargetCert);
	if (hSystemStore)
	{
		if (!CertCloseStore(hSystemStore, 0)) {
			_getdns_log(log
			    , GETDNS_LOG_SYS_STUB, GETDNS_LOG_ERR
			    , "%s: %s\n", STUB_DEBUG_SETUP_TLS
			    , "Could not CertCloseStore()");
			return 0;
		}
	}
	_getdns_log(log, GETDNS_LOG_SYS_STUB, GETDNS_LOG_INFO
	    , "%s: %s\n", STUB_DEBUG_SETUP_TLS
	    , "Completed adding Windows certificates to CA store successfully")
	    ;
	return 1;
}
/* For windows, the CA trust store is not read by openssl.
   Add code to open the trust store using wincrypt API and add
   the root certs into openssl trust store */
For windows, the CA trust store is not read by openssl.
Add code to open the trust store using wincrypt API and add
the root certs into openssl trust store
For windows the CA trust store is not read by openssl . Add code to open the trust store using wincrypt API and add the root certs into openssl trust store
static int
add_WIN_cacerts_to_openssl_store(SSL_CTX* tls_ctx, const getdns_log_config* log)
{
	HCERTSTORE      hSystemStore;
	PCCERT_CONTEXT  pTargetCert = NULL;
	_getdns_log(log, GETDNS_LOG_SYS_STUB, GETDNS_LOG_DEBUG
	    , "%s: %s\n", STUB_DEBUG_SETUP_TLS
	    , "Adding Windows certificates from system root store to CA store")
	    ;
	assert(tls_ctx);
	if ((hSystemStore = CertOpenStore(
		CERT_STORE_PROV_SYSTEM,
		0,
		0,
		1 << 16,
		L"root")) == 0)
	{
		_getdns_log(log, GETDNS_LOG_SYS_STUB, GETDNS_LOG_ERR
		    , "%s: %s\n", STUB_DEBUG_SETUP_TLS
		    , "Could not CertOpenStore()");
		return 0;
	}
	X509_STORE* store = SSL_CTX_get_cert_store(tls_ctx);
	if (!store) {
		_getdns_log(log, GETDNS_LOG_SYS_STUB, GETDNS_LOG_ERR
		    , "%s: %s\n", STUB_DEBUG_SETUP_TLS
		    , "Could not SSL_CTX_get_cert_store()");
		return 0;
	}
	if ((pTargetCert = CertEnumCertificatesInStore(
	    hSystemStore, pTargetCert)) == 0) {
		_getdns_log(log, GETDNS_LOG_SYS_STUB, GETDNS_LOG_NOTICE
		    , "%s: %s\n", STUB_DEBUG_SETUP_TLS
		    , "CA certificate store for Windows is empty.");
		return 0;
	}
	do
	{
		X509 *cert1 = d2i_X509(NULL,
			(const unsigned char **)&pTargetCert->pbCertEncoded,
			pTargetCert->cbCertEncoded);
		if (!cert1) {
			_getdns_log(log
			    , GETDNS_LOG_SYS_STUB, GETDNS_LOG_ERR
			    , "%s: %s %d:%s\n"
			    , STUB_DEBUG_SETUP_TLS
			    , "Unable to parse certificate in memory"
			    , ERR_get_error()
			    , ERR_error_string(ERR_get_error(), NULL));
			return 0;
		}
		else {
			if (X509_STORE_add_cert(store, cert1) == 0) {
				unsigned long error = ERR_peek_last_error();
				if(ERR_GET_LIB(error) != ERR_LIB_X509 ||
				   ERR_GET_REASON(error) != X509_R_CERT_ALREADY_IN_HASH_TABLE) {
					_getdns_log(log
					    , GETDNS_LOG_SYS_STUB
					    , GETDNS_LOG_ERR
					    , "%s: %s %d:%s\n"
					    , STUB_DEBUG_SETUP_TLS
					    , "Error adding certificate"
					    , ERR_get_error()
					    , ERR_error_string( ERR_get_error()
					                      , NULL)
					    );
					X509_free(cert1);
					return 0;
				}
			}
			X509_free(cert1);
		}
	} while ((pTargetCert = CertEnumCertificatesInStore(
		hSystemStore, pTargetCert)) != 0);
	if (pTargetCert)
		CertFreeCertificateContext(pTargetCert);
	if (hSystemStore)
	{
		if (!CertCloseStore(hSystemStore, 0)) {
			_getdns_log(log
			    , GETDNS_LOG_SYS_STUB, GETDNS_LOG_ERR
			    , "%s: %s\n", STUB_DEBUG_SETUP_TLS
			    , "Could not CertCloseStore()");
			return 0;
		}
	}
	_getdns_log(log, GETDNS_LOG_SYS_STUB, GETDNS_LOG_INFO
	    , "%s: %s\n", STUB_DEBUG_SETUP_TLS
	    , "Completed adding Windows certificates to CA store successfully")
	    ;
	return 1;
}
static int add_WIN_cacerts_to_openssl_store ( SSL_CTX * tls_ctx , const getdns_log_config * log ) { HCERTSTORE hSystemStore ; PCCERT_CONTEXT pTargetCert = NULL ; _getdns_log ( log , GETDNS_LOG_SYS_STUB , GETDNS_LOG_DEBUG , " \n " , STUB_DEBUG_SETUP_TLS , " " ) ; assert ( tls_ctx ) ; if ( ( hSystemStore = CertOpenStore ( CERT_STORE_PROV_SYSTEM , 0 , 0 , 1 << 16 , L" " ) ) == 0 ) { _getdns_log ( log , GETDNS_LOG_SYS_STUB , GETDNS_LOG_ERR , " \n " , STUB_DEBUG_SETUP_TLS , " " ) ; return 0 ; } X509_STORE * store = SSL_CTX_get_cert_store ( tls_ctx ) ; if ( ! store ) { _getdns_log ( log , GETDNS_LOG_SYS_STUB , GETDNS_LOG_ERR , " \n " , STUB_DEBUG_SETUP_TLS , " " ) ; return 0 ; } if ( ( pTargetCert = CertEnumCertificatesInStore ( hSystemStore , pTargetCert ) ) == 0 ) { _getdns_log ( log , GETDNS_LOG_SYS_STUB , GETDNS_LOG_NOTICE , " \n " , STUB_DEBUG_SETUP_TLS , " " ) ; return 0 ; } do { X509 * cert1 = d2i_X509 ( NULL , ( const unsigned char * * ) & pTargetCert -> pbCertEncoded , pTargetCert -> cbCertEncoded ) ; if ( ! cert1 ) { _getdns_log ( log , GETDNS_LOG_SYS_STUB , GETDNS_LOG_ERR , " \n " , STUB_DEBUG_SETUP_TLS , " " , ERR_get_error ( ) , ERR_error_string ( ERR_get_error ( ) , NULL ) ) ; return 0 ; } else { if ( X509_STORE_add_cert ( store , cert1 ) == 0 ) { unsigned long error = ERR_peek_last_error ( ) ; if ( ERR_GET_LIB ( error ) != ERR_LIB_X509 || ERR_GET_REASON ( error ) != X509_R_CERT_ALREADY_IN_HASH_TABLE ) { _getdns_log ( log , GETDNS_LOG_SYS_STUB , GETDNS_LOG_ERR , " \n " , STUB_DEBUG_SETUP_TLS , " " , ERR_get_error ( ) , ERR_error_string ( ERR_get_error ( ) , NULL ) ) ; X509_free ( cert1 ) ; return 0 ; } } X509_free ( cert1 ) ; } } while ( ( pTargetCert = CertEnumCertificatesInStore ( hSystemStore , pTargetCert ) ) != 0 ) ; if ( pTargetCert ) CertFreeCertificateContext ( pTargetCert ) ; if ( hSystemStore ) { if ( ! CertCloseStore ( hSystemStore , 0 ) ) { _getdns_log ( log , GETDNS_LOG_SYS_STUB , GETDNS_LOG_ERR , " \n " , STUB_DEBUG_SETUP_TLS , " " ) ; return 0 ; } } _getdns_log ( log , GETDNS_LOG_SYS_STUB , GETDNS_LOG_INFO , " \n " , STUB_DEBUG_SETUP_TLS , " " ) ; return 1 ; }
For windows, the CA trust store is not read by openssl.
For windows the CA trust store is not read by openssl .
/* load just once per context lifetime for this version of getdns
	   TODO: dynamically update CA trust changes as they are available */ /* Call wincrypt's CertOpenStore to open the CA root store. */ /* NOTE: mingw does not have this const: replace with 1 << 16 from code
		   CERT_SYSTEM_STORE_CURRENT_USER, */ /* failure if the CA store is empty or the call fails */ /* iterate over the windows cert store and add to openssl store */ /* return error if a cert fails */ /* return error if a cert add to store fails */ /* Ignore error X509_R_CERT_ALREADY_IN_HASH_TABLE which means the
				* certificate is already in the store.  */ /* Clean up memory and quit. */