Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

The CURLCode CURLE_SSL_PEER_CERTIFICATE (with value 51) is obsolete. Explicitly update to use CURLE_PEER_FAILED_VERIFICATION #5538

Closed
ahsonkhan opened this issue Apr 16, 2024 · 0 comments · Fixed by #5545
Closed

The CURLCode CURLE_SSL_PEER_CERTIFICATE (with value 51) is obsolete. Explicitly update to use CURLE_PEER_FAILED_VERIFICATION #5538

ahsonkhan opened this issue Apr 16, 2024 · 0 comments · Fixed by #5545
Assignees
@ahsonkhan
Labels
Azure.Core

Comments

@ahsonkhan
Copy link
Member

This symbol was added in version 7.8 but later deprecated in version 7.17.1:
https://curl.se/changes.html#7_17_1

This current implementation of the CurlConnection ctor needs to be looked into further. Particularly, this code snippet:

azure-sdk-for-cpp/sdk/core/azure-core/src/http/curl/curl.cpp

Lines 2521 to 2539 in 698490f

auto performResult = curl_easy_perform(m_handle.get());
if (performResult != CURLE_OK)
{
#if defined(AZ_PLATFORM_LINUX)
if (performResult == CURLE_SSL_PEER_CERTIFICATE)
{
curl_easy_getinfo(m_handle.get(), CURLINFO_SSL_VERIFYRESULT, &result);
throw Http::TransportException(
_detail::DefaultFailedToGetNewConnectionTemplate + hostDisplayName + ". "
+ std::string(curl_easy_strerror(performResult))
+ ". Underlying error: " + X509_verify_cert_error_string(result));
}
else
#endif
{
throw Http::TransportException(
_detail::DefaultFailedToGetNewConnectionTemplate + hostDisplayName + ". "
+ std::string(curl_easy_strerror(performResult)));
}

The curl documentation doesn't mention CURLE_SSL_PEER_CERTIFICATE and says the following:

Obsolete errors (50-51)
Not used in modern versions.

https://curl.se/libcurl/c/libcurl-errors.html

It looks like the current version of that error is:

CURLE_PEER_FAILED_VERIFICATION (60)
The remote server's SSL certificate or SSH fingerprint was deemed not OK. This error code has been unified with CURLE_SSL_CACERT since 7.62.0. Its previous value was 51.

The only reason the code continues to work is due to this macro, which treats this error the same as 60, which could be removed at any time:
https://github.com/curl/curl/blob/565d28dc8e910386d9d215e0440291bb8c4238f8/include/curl/curl.h#L661-L663
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ahsonkhan ahsonkhan

Labels
Azure.Core
Projects
None yet
Milestone
No milestone
1 participant
@ahsonkhan