• Tor Lillqvist's avatar
    Use the system root certificates in Neon's ne_ssl_trust_default_ca() on Win32 · 07073a19
    Tor Lillqvist yazdı
    Fixes a problem that was noticed when working on bnc#805901, which is about
    documents opened from WebDAV (using https) not being locked (in the WebDAV
    sense).
    
    For some reason, at least in the 3.6 branch, I noticed that LibreOffice did
    not manage to open any connection to the WebDAV server. The error message
    "Server error message: Server certificate verification failed: issuer is not
    trusted" was displayed.
    
    Turning on Neon logging I saw the OpenSSL error code 19
    (X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) passing by.
    
    Some googling turned up
    http://stackoverflow.com/questions/4103472/ssl-handshake-fails-with-a-verisign-chain-certificate-that-contains-two-ca-s
    . If I understand correctly, root certificates (which are the final ones in a
    certificate chain) are by definition self-signed.
    
    One can try this on Linux (or even on Windows, using the openssl command built
    as part of the LibreOffice built):
    
    openssl s_client -connect vibe.novell.com:443 -showcerts
    
    and see that it also displays a message about this "error": "verify
    error:num=19:self signed certificate in certificate chain"
    
    One can get around that by passing the -CApath option:
    
    openssl s_client -connect vibe.novell.com:443 -showcerts -CApath /etc/ssl/certs
    
    on Linux. There is no corresponding directory with trusted certificates as
    files on Windows.
    
    This tells OpenSSL where to find a list of trusted root certificates.
    Apparently when OpenSSL is used by LibreOffice it does not use the list of
    trusted root certificates that Windows knows automatically. This patch makes
    it do that when ne_ssl_trust_default_ca() is called.
    
    Change-Id: Iddbd3d61413aa52adbed3f9a0239a364e70668d8
    Reviewed-on: https://gerrit.libreoffice.org/2741Reviewed-by: 's avatarFridrich Strba <fridrich@documentfoundation.org>
    Tested-by: 's avatarFridrich Strba <fridrich@documentfoundation.org>
    07073a19
neon.patch 13.9 KB