[3.12] gh-79846: Make ssl.create_default_context() ignore invalid certificates (GH...

An error in one certificate should not cause the whole thing to fail.

(cherry picked from commit 9e551f9b351440ebae79e07a02d0e4a1b61d139e)

Co-authored-by: pukkandan <pukkandan.ytdlp@gmail.com>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

diff --git a/Lib/ssl.py b/Lib/ssl.py
index 983c2db6361898db6503bc732b25b74ba4ef9128..42ebb8ed38466d28560e493bb422f66cb7cad3b5 100644 (file)
--- a/Lib/ssl.py
+++ b/Lib/ssl.py
@@ -513,18 +513,17 @@ class SSLContext(_SSLContext):
         self._set_alpn_protocols(protos)
 
     def _load_windows_store_certs(self, storename, purpose):
-        certs = bytearray()
         try:
             for cert, encoding, trust in enum_certificates(storename):
                 # CA certs are never PKCS#7 encoded
                 if encoding == "x509_asn":
                     if trust is True or purpose.oid in trust:
-                        certs.extend(cert)
+                        try:
+                            self.load_verify_locations(cadata=cert)
+                        except SSLError as exc:
+                            warnings.warn(f"Bad certificate in Windows certificate store: {exc!s}")
         except PermissionError:
             warnings.warn("unable to enumerate Windows certificate store")
-        if certs:
-            self.load_verify_locations(cadata=certs)
-        return certs
 
     def load_default_certs(self, purpose=Purpose.SERVER_AUTH):
         if not isinstance(purpose, _ASN1Object):

diff --git a/Misc/NEWS.d/next/Windows/2022-04-20-18-32-30.gh-issue-79846.Vggv3f.rst b/Misc/NEWS.d/next/Windows/2022-04-20-18-32-30.gh-issue-79846.Vggv3f.rst
new file mode 100644 (file)
index 0000000..82c2670
--- /dev/null
+++ b/Misc/NEWS.d/next/Windows/2022-04-20-18-32-30.gh-issue-79846.Vggv3f.rst
@@ -0,0 +1,2 @@
+Makes :code:`ssl.create_default_context()` ignore invalid certificates in
+the Windows certificate store