{"action":"created","issue":{"url":"https://api.github.com/repos/FreeTDS/freetds/issues/198","repository_url":"https://api.github.com/repos/FreeTDS/freetds","labels_url":"https://api.github.com/repos/FreeTDS/freetds/issues/198/labels{/name}","comments_url":"https://api.github.com/repos/FreeTDS/freetds/issues/198/comments","events_url":"https://api.github.com/repos/FreeTDS/freetds/issues/198/events","html_url":"https://github.com/FreeTDS/freetds/pull/198","id":304979897,"number":198,"title":"Using system root CAs when establishing a connection.","user":{"login":"alexloney","id":7762708,"avatar_url":"https://avatars1.githubusercontent.com/u/7762708?v=4","gravatar_id":"","url":"https://api.github.com/users/alexloney","html_url":"https://github.com/alexloney","followers_url":"https://api.github.com/users/alexloney/followers","following_url":"https://api.github.com/users/alexloney/following{/other_user}","gists_url":"https://api.github.com/users/alexloney/gists{/gist_id}","starred_url":"https://api.github.com/users/alexloney/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexloney/subscriptions","organizations_url":"https://api.github.com/users/alexloney/orgs","repos_url":"https://api.github.com/users/alexloney/repos","events_url":"https://api.github.com/users/alexloney/events{/privacy}","received_events_url":"https://api.github.com/users/alexloney/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-03-14T00:13:49Z","updated_at":"2018-04-11T16:29:25Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/FreeTDS/freetds/pulls/198","html_url":"https://github.com/FreeTDS/freetds/pull/198","diff_url":"https://github.com/FreeTDS/freetds/pull/198.diff","patch_url":"https://github.com/FreeTDS/freetds/pull/198.patch"},"body":"The issue with the method that existed already (the call to [SSL_CTX_set_default_verify_paths](https://www.openssl.org/docs/man1.1.0/ssl/SSL_CTX_set_default_verify_paths.html)) is that it will:\r\n\r\n> SSL_CTX_set_default_verify_paths() specifies that the default locations from which CA certificates are loaded should be used. There is one default directory and one default file. The default CA certificates directory is called \"certs\" in the default OpenSSL directory. Alternatively the SSL_CERT_DIR environment variable can be defined to override this location. The default CA certificates file is called \"cert.pem\" in the default OpenSSL directory. Alternatively the SSL_CERT_FILE environment variable can be defined to override this location.\r\n\r\nSo, from my understanding, it sets it to a default directory and a default file of certs.pem. Which would work fine if /etc/ssl/certs (default directory on my installation) contained a single consolidated certs.pem file, but it does not. It instead contains many .pem files, one for each root CA.\r\n\r\nFurthermore, when using FreeTDS on Windows, there is no directory of root certificates, instead all of the certificates are managed via the Microsoft Management Console through the Certificates store. As far as I'm aware, OpenSSL does not know of this system wide certificate store (it's the same store that Chrome and other browsers use to get their trusted root certificates).\r\n\r\nFinally, you should be able to see this lack of knowledge by FreeTDS/OpenSSL on either Linux or Windows by setting `encryption=require` and `ca file=system` in the freetds config for the server. This will force OpenSSL to establish a secure connection and attempt to use the system CA files. However, the connection should fail (at least it has failed in my build) because it does not successfully load the root CAs, and thus does not successfully verify the connection.\r\n\r\nThe change that I've proposed adds an additional function of `tds_update_cert_store_with_root_cas` to tls.c that will do two different things when called:\r\n\r\n1. On Windows, it will make a call to open the [CertOpenSystemStore](https://msdn.microsoft.com/es-es/library/windows/desktop/aa376560(v=vs.85).aspx), when open, it will loop through all root certificates in the store and add them to the OpenSSL context's root store, providing a chain of trust for OpenSSL to verify with.\r\n2. On Linux, it will get the default directory for OpenSSL to read certificates from via a call to X509_get_default_cert_dir_env or X509_get_default_cert_dir, it will then loop through every .pem file in that directory, read them in as X509 certs, and add them to the OpenSSL context.\r\n\r\nThe result is that, on both Windows and Linux, when using OpenSSL, the certificate chain will be able to be verified when `encryption=require` and `ca file=system` are both set.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/FreeTDS/freetds/issues/comments/380514529","html_url":"https://github.com/FreeTDS/freetds/pull/198#issuecomment-380514529","issue_url":"https://api.github.com/repos/FreeTDS/freetds/issues/198","id":380514529,"user":{"login":"alexloney","id":7762708,"avatar_url":"https://avatars1.githubusercontent.com/u/7762708?v=4","gravatar_id":"","url":"https://api.github.com/users/alexloney","html_url":"https://github.com/alexloney","followers_url":"https://api.github.com/users/alexloney/followers","following_url":"https://api.github.com/users/alexloney/following{/other_user}","gists_url":"https://api.github.com/users/alexloney/gists{/gist_id}","starred_url":"https://api.github.com/users/alexloney/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexloney/subscriptions","organizations_url":"https://api.github.com/users/alexloney/orgs","repos_url":"https://api.github.com/users/alexloney/repos","events_url":"https://api.github.com/users/alexloney/events{/privacy}","received_events_url":"https://api.github.com/users/alexloney/received_events","type":"User","site_admin":false},"created_at":"2018-04-11T16:29:25Z","updated_at":"2018-04-11T16:29:25Z","author_association":"NONE","body":"What issue are you seeing when you attempt to compile on Windows? I have successfully compiled with Microsoft Visual Studio 2012."}}
{"actor":{"display_login":"alexloney"}}