crypto/x509: make SystemCertPool work on Windows? #16736
Comments
|
I really don't know, I am not security expert. But I think you want to open LocalMachine\root (or maybe CurrentUser\root) certificate store, and read all certificates there with CertEnumCertificatesInStore or similar. What do you think? Alex |
|
Sounds plausible. I don't think this requires a security expert as much as somebody who can read MSDN docs. |
|
CL https://golang.org/cl/30578 mentions this issue. |
quentinmit
added
the
NeedsFix
SystemCertPool is not supported on windows in go 1.7. see golang/go#16736 Once 1.8 is released we can remove special condition and always append to system cert pool. [#133304007] Signed-off-by: Maria Shaldibina <mshaldibina@pivotal.io>
|
@jeffallen Done. Alex |
|
Hi, came from this issue #18609 and try to understand what can help. Maybe as an look over the fence this is how dotnetcore address this (https://github.com/dotnet/corefx/tree/master/src/System.Security.Cryptography.X509Certificates/src/System/Security/Cryptography/X509Certificates). Just trying to get a better understanding what fails and what could help. |
|
I have encountered the lack of support for this function on Windows, and would like to help resolve it :) |
@danielorbach, try this: #16736 (comment) |
As per https://golang.org/src/crypto/x509/cert_pool.go looks like there is no implementation of `SystemCertPool` for windows platform and it just return the error. ``` func SystemCertPool() (*CertPool, error) { if runtime.GOOS == "windows" { // Issue 16736, 18609: return nil, errors.New("crypto/x509: system root pool is not available on Windows") } .... ``` - golang/go#16736 - golang/go#46287
On Windows, x509.SystemCertPool returns an error: golang/go#16736 This commit reverts to the behaviour before commit b50dc99 when catching such an error. This means https_proxy=https://... will be broken for non-mitm https proxies. Such proxies were not usable before the PR adding b50dc99, so this should not have much impact for our existing users. These CAs are used: - when accessing telemetry - when checking for a new crc version - when downloading binaries (only happens with git builds)
On Windows, x509.SystemCertPool returns an error: golang/go#16736 This commit reverts to the behaviour before commit b50dc99 when catching such an error. This means https_proxy=https://... will be broken for non-mitm https proxies. Such proxies were not usable before the PR adding b50dc99, so this should not have much impact for our existing users. These CAs are used: - when accessing telemetry - when checking for a new crc version - when downloading binaries (only happens with git builds)
On Windows, x509.SystemCertPool returns an error: golang/go#16736 This commit reverts to the behaviour before commit b50dc99 when catching such an error. This means https_proxy=https://... will be broken for non-mitm https proxies. Such proxies were not usable before the PR adding b50dc99, so this should not have much impact for our existing users. These CAs are used: - when accessing telemetry - when checking for a new crc version - when downloading binaries (only happens with git builds) This fixes crc-org#2770
On Windows, x509.SystemCertPool returns an error: golang/go#16736 This commit reverts to the behaviour before commit b50dc99 when catching such an error. This means https_proxy=https://... will be broken for non-mitm https proxies. Such proxies were not usable before the PR adding b50dc99, so this should not have much impact for our existing users. These CAs are used: - when accessing telemetry - when checking for a new crc version - when downloading binaries (only happens with git builds) This fixes crc-org#2770
On Windows, x509.SystemCertPool returns an error: golang/go#16736 This commit reverts to the behaviour before commit b50dc99 when catching such an error. This means https_proxy=https://... will be broken for non-mitm https proxies. Such proxies were not usable before the PR adding b50dc99, so this should not have much impact for our existing users. These CAs are used: - when accessing telemetry - when checking for a new crc version - when downloading binaries (only happens with git builds) This fixes #2770
|
Change https://golang.org/cl/353589 mentions this issue: |
and others
https://golang.org/pkg/crypto/x509/#SystemCertPool doesn't work on Windows:
I checked it in with the commit message "SystemCertPool returns an error on Windows. Maybe it's fixable later." (a62ae9f, golang.org/cl/21293, #13335)
This bug is about fixing it.
/cc @alexbrainman
The text was updated successfully, but these errors were encountered: