luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

gtls: Add P12 format support

Browse Source 
This change adds P12 format support for GnuTLS backend.

Closes #14991
This commit is contained in:
Tatsuhiro Tsujikawa 2024-09-20 18:04:46 +09:00 committed by Daniel Stenberg
parent a4703dac13
commit 7307c1a289
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
docs/libcurl/opts/CURLOPT_SSLCERTTYPE.md
View File

@ -39,7 +39,7 @@ the format of your certificate.
Supported formats are "PEM" and "DER", except with Secure Transport or Supported formats are "PEM" and "DER", except with Secure Transport or
Schannel. OpenSSL (versions 0.9.3 and later), Secure Transport (on iOS 5 or Schannel. OpenSSL (versions 0.9.3 and later), Secure Transport (on iOS 5 or
later, or macOS 10.7 or later) and Schannel support "P12" for PKCS#12-encoded later, or macOS 10.7 or later) and Schannel support "P12" for PKCS#12-encoded
files. files. GnuTLS supports P12 starting with curl 8.11.0.
The application does not have to keep the string around after setting this The application does not have to keep the string around after setting this
option. option.

14
lib/vtls/gtls.c
View File

@ -936,7 +936,19 @@ static CURLcode gtls_client_init(struct Curl_cfilter *cf,
if(result) if(result)
return result; return result;
} }
if(ssl_config->key_passwd) { if(ssl_config->cert_type && strcasecompare(ssl_config->cert_type, "P12")) {
rc = gnutls_certificate_set_x509_simple_pkcs12_file(
gtls->shared_creds->creds, config->clientcert, GNUTLS_X509_FMT_DER,
ssl_config->key_passwd ? ssl_config->key_passwd : "");
if(rc != GNUTLS_E_SUCCESS) {
failf(data,
"error reading X.509 potentially-encrypted key or certificate "
"file: %s",
gnutls_strerror(rc));
return CURLE_SSL_CONNECT_ERROR;
}
}
else if(ssl_config->key_passwd) {
const unsigned int supported_key_encryption_algorithms = const unsigned int supported_key_encryption_algorithms =
GNUTLS_PKCS_USE_PKCS12_3DES | GNUTLS_PKCS_USE_PKCS12_ARCFOUR | GNUTLS_PKCS_USE_PKCS12_3DES | GNUTLS_PKCS_USE_PKCS12_ARCFOUR |
GNUTLS_PKCS_USE_PKCS12_RC2_40 | GNUTLS_PKCS_USE_PBES2_3DES | GNUTLS_PKCS_USE_PKCS12_RC2_40 | GNUTLS_PKCS_USE_PBES2_3DES |