From abeeffb11c996aed90ea465fa2128bfa564a1542 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Mon, 28 Sep 2020 08:30:25 +0200 Subject: [PATCH] schannel: return CURLE_PEER_FAILED_VERIFICATION for untrusted root This matches what is returned in other TLS backends in the same situation. Reviewed-by: Jay Satiro Reviewed-by: Emil Engler Follow-up to 5a3efb1 Reported-by: iammrtau on github Fixes #6003 Closes #6018 --- lib/vtls/schannel.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/vtls/schannel.c b/lib/vtls/schannel.c index 1fe9b7b8db..c7e4e793cc 100644 --- a/lib/vtls/schannel.c +++ b/lib/vtls/schannel.c @@ -1181,6 +1181,10 @@ schannel_connect_step2(struct connectdata *conn, int sockindex) failf(data, "schannel: SNI or certificate check failed: %s", Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer))); return CURLE_PEER_FAILED_VERIFICATION; + case SEC_E_UNTRUSTED_ROOT: + failf(data, "schannel: %s", + Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer))); + return CURLE_PEER_FAILED_VERIFICATION; /* case SEC_E_INVALID_HANDLE: case SEC_E_INVALID_TOKEN: -- 2.47.3