From: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> Date: Fri, 9 Aug 2024 16:55:36 +0000 (+0200) Subject: [3.12] gh-79846: Make ssl.create_default_context() ignore invalid certificates (GH... X-Git-Tag: v3.12.6~81 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=22fdeeb3cb84284f20d6c6e77bb0bfb7d3235735;p=thirdparty%2FPython%2Fcpython.git [3.12] gh-79846: Make ssl.create_default_context() ignore invalid certificates (GH-91740) (#122769) An error in one certificate should not cause the whole thing to fail. (cherry picked from commit 9e551f9b351440ebae79e07a02d0e4a1b61d139e) Co-authored-by: pukkandan Co-authored-by: Serhiy Storchaka --- diff --git a/Lib/ssl.py b/Lib/ssl.py index 983c2db63618..42ebb8ed3846 100644 --- a/Lib/ssl.py +++ b/Lib/ssl.py @@ -513,18 +513,17 @@ class SSLContext(_SSLContext): self._set_alpn_protocols(protos) def _load_windows_store_certs(self, storename, purpose): - certs = bytearray() try: for cert, encoding, trust in enum_certificates(storename): # CA certs are never PKCS#7 encoded if encoding == "x509_asn": if trust is True or purpose.oid in trust: - certs.extend(cert) + try: + self.load_verify_locations(cadata=cert) + except SSLError as exc: + warnings.warn(f"Bad certificate in Windows certificate store: {exc!s}") except PermissionError: warnings.warn("unable to enumerate Windows certificate store") - if certs: - self.load_verify_locations(cadata=certs) - return certs def load_default_certs(self, purpose=Purpose.SERVER_AUTH): if not isinstance(purpose, _ASN1Object): diff --git a/Misc/NEWS.d/next/Windows/2022-04-20-18-32-30.gh-issue-79846.Vggv3f.rst b/Misc/NEWS.d/next/Windows/2022-04-20-18-32-30.gh-issue-79846.Vggv3f.rst new file mode 100644 index 000000000000..82c26701e0e0 --- /dev/null +++ b/Misc/NEWS.d/next/Windows/2022-04-20-18-32-30.gh-issue-79846.Vggv3f.rst @@ -0,0 +1,2 @@ +Makes :code:`ssl.create_default_context()` ignore invalid certificates in +the Windows certificate store