search

sfackler / rust-native-tls

Apache License 2.0
470 stars 195 forks source link

Enable partial certificate chain validation #202

Open nicklan opened 3 years ago

nicklan commented 3 years ago

This adds code to the Openssl implementation to set the X509_V_FLAG_PARTIAL_CHAIN flag (see here).

The way I've written it, it defaults to true. This is the behavior of curl (see here), and also seems to match the default go http client. The curl page also claims this is the more common behavior.

If you'd possible accept this I can see what happens on mac/windows, but I couldn't find anything related to it in the schannel or security-framework docs. I'm not sure what their default behavior is, and testing on those platforms is a bit tricky, but I can figure it out if needed.

sfackler commented 3 years ago

Configuration options need to apply to every backend.

nicklan commented 3 years ago

i figured that would be an issue. so what about really useful features like this one that may not? just give up?

I'm guessing #cfging the higher level methods on the builder aren't an option?

nicklan commented 3 years ago

btw, this page suggests to me that at least schannel defaults to this behavior, since curl provides an option to turn it OFF, which is only available to the openssl backend.

if that was the case, would you accept a pr to bring the openssl implementation in line with the schannel one?