search

microsoft / cpprestsdk

The C++ REST SDK is a Microsoft project for cloud-based client-server communication in native code using a modern asynchronous C++ API design. This project aims to help C++ developers connect to and interact with services.
Other
7.96k stars 1.65k forks source link

Certificate revocation checking cannot be disabled. #664

Open kobykahane opened 6 years ago

kobykahane commented 6 years ago

PR #516 enabled certificate revocation checking on WinHTTP by calling WinHttpSetOption with WINHTTP_OPTION_ENABLE_FEATURE and WINHTTP_ENABLE_SSL_REVOCATION.

However, if a client wants to opt out from this behavior, the callback invoked by invoke_nativehandle_options and set with set_nativehandle_options cannot be used. This is because subsequent calls to WINHTTP_OPTION_ENABLE_FEATURE are additive, so even setting the input flags to 0 does not reset the previously enabled 'enable SSL revocation' option.

Furthermore, revocation checks are performed even when set_validate_certificates(false) has been called.

Instead, http_client_config should provide an explicit way to opt out of revocation checks. If the appropriate flag is set, it should never call WinHttpSetOption with WINHTTP_ENABLE_SSL_REVOCATION.

tishion commented 6 years ago

agree with this totally

saifbohra commented 6 years ago

agree with this totally, I had the same issue

sinall commented 6 years ago

I have the same problem. This is a critical issue.

tvarsis commented 6 years ago

Getting the REV_FAILED error on thousands of machines after the ISRG root cert from Lets Encrypt was added to the trusted root store in Windows by Microsoft a couple of days ago. So this issue is critical to fix now.

tvarsis commented 6 years ago

So I finally mange to fix the error. It was related to OCSP. I added this to the Apache vhost:

SSLUseStapling on SSLStaplingReturnResponderErrors off SSLStaplingResponderTimeout 5

As well as this to the ssl.conf file: SSLStaplingCache "shmcb:/opt/bitnami/apache2/logs/ssl_stapling(128000)"

And that got rid of the error. Did not see this error before ISRG was in the Windows root store, but at least this solves it if anybody else runs into similar issues.