Mirror
/
cpython
mirror of https://github.com/python/cpython
4
1
Fork 0
Code Issues Releases Wiki Activity

[3.13] gh-79846: Make ssl.create_default_context() ignore invalid certificates (GH-91740) (#122768) 

gh-79846: Make ssl.create_default_context() ignore invalid certificates (GH-91740)

An error in one certificate should not cause the whole thing to fail.

(cherry picked from commit 9e551f9b35)

Co-authored-by: pukkandan <pukkandan.ytdlp@gmail.com>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
This commit is contained in:
Miss Islington (bot) 2024-09-02 12:53:59 +02:00 committed by GitHub
parent 8a4f708220
commit 8c01b34268
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
Lib/ssl.py
View File

@ -513,18 +513,17 @@ class SSLContext(_SSLContext):
self._set_alpn_protocols(protos)
def _load_windows_store_certs(self, storename, purpose):
certs = bytearray()
try:
for cert, encoding, trust in enum_certificates(storename):
# CA certs are never PKCS#7 encoded
if encoding == "x509_asn":
if trust is True or purpose.oid in trust:
certs.extend(cert)
try:
self.load_verify_locations(cadata=cert)
except SSLError as exc:
warnings.warn(f"Bad certificate in Windows certificate store: {exc!s}")
except PermissionError:
warnings.warn("unable to enumerate Windows certificate store")
if certs:
self.load_verify_locations(cadata=certs)
return certs
def load_default_certs(self, purpose=Purpose.SERVER_AUTH):
if not isinstance(purpose, _ASN1Object):

2
Misc/NEWS.d/next/Windows/2022-04-20-18-32-30.gh-issue-79846.Vggv3f.rst Normal file
View File

@ -0,0 +1,2 @@
Makes :code:`ssl.create_default_context()` ignore invalid certificates in
the Windows certificate store