Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

crypto/x509: make SystemCertPool work on Windows? #16736

Closed
bradfitz opened this issue Aug 16, 2016 · 26 comments
Closed

crypto/x509: make SystemCertPool work on Windows? #16736

bradfitz opened this issue Aug 16, 2016 · 26 comments
Labels
FrozenDueToAge help wanted NeedsFix The path to resolution is known, but the work has not been done. OS-Windows
Milestone

Comments

@bradfitz
Copy link
Contributor

https://golang.org/pkg/crypto/x509/#SystemCertPool doesn't work on Windows:

    func SystemCertPool() (*CertPool, error) {
        if runtime.GOOS == "windows" {
            return nil, errors.New("crypto/x509: system root pool is not available on Windows")
        }
        ....

I checked it in with the commit message "SystemCertPool returns an error on Windows. Maybe it's fixable later." (a62ae9f, golang.org/cl/21293, #13335)

This bug is about fixing it.

/cc @alexbrainman

@bradfitz bradfitz added this to the Go1.8Maybe milestone Aug 16, 2016
@alexbrainman
Copy link
Member

I really don't know, I am not security expert. But I think you want to open LocalMachine\root (or maybe CurrentUser\root) certificate store, and read all certificates there with CertEnumCertificatesInStore or similar. What do you think?

Alex

@bradfitz
Copy link
Contributor Author

Sounds plausible.

I don't think this requires a security expert as much as somebody who can read MSDN docs.

@gopherbot
Copy link

CL https://golang.org/cl/30578 mentions this issue.

@quentinmit quentinmit added the NeedsFix The path to resolution is known, but the work has not been done. label Oct 10, 2016
mariash pushed a commit to vmware-archive/fly that referenced this issue Nov 21, 2016
SystemCertPool is not supported on windows in go 1.7.
see golang/go#16736
Once 1.8 is released we can remove special condition and always append
to system cert pool.

[#133304007]

Signed-off-by: Maria Shaldibina <mshaldibina@pivotal.io>
@jeffallen
Copy link
Contributor

Note: This change was rolled back in #18609. SystemCertPool on Windows on Go 1.8 still returns nil. @bradfitz Maybe you could re-open this and remove the go1.8maybe tag on it? Thanks.

@alexbrainman alexbrainman modified the milestones: Go1.9, Go1.8Maybe Feb 14, 2017
@alexbrainman alexbrainman reopened this Feb 14, 2017
@alexbrainman
Copy link
Member

@jeffallen Done.

Alex

@felixbecker
Copy link

Hi, came from this issue #18609 and try to understand what can help. Maybe as an look over the fence this is how dotnetcore address this (https://github.com/dotnet/corefx/tree/master/src/System.Security.Cryptography.X509Certificates/src/System/Security/Cryptography/X509Certificates). Just trying to get a better understanding what fails and what could help.

@danielorbach
Copy link

I have encountered the lack of support for this function on Windows, and would like to help resolve it :)

@siennathesane
Copy link

I have encountered the lack of support for this function on Windows, and would like to help resolve it :)

@danielorbach, try this: #16736 (comment)

praveenkumar added a commit to praveenkumar/proxy that referenced this issue Sep 28, 2021
As per https://golang.org/src/crypto/x509/cert_pool.go looks like there
is no implementation of  `SystemCertPool` for windows platform and it
just return the error.
```
func SystemCertPool() (*CertPool, error) {
	if runtime.GOOS == "windows" {
		// Issue 16736, 18609:
		return nil, errors.New("crypto/x509: system root pool is
not available on Windows")
	}
....
```

- golang/go#16736
- golang/go#46287
cfergeau added a commit to cfergeau/crc that referenced this issue Sep 28, 2021
On Windows, x509.SystemCertPool returns an error:
golang/go#16736

This commit reverts to the behaviour before commit b50dc99 when catching
such an error. This means https_proxy=https://... will be broken for
non-mitm https proxies. Such proxies were not usable before the PR
adding b50dc99, so this should not have much impact for our existing
users.

These CAs are used:
- when accessing telemetry
- when checking for a new crc version
- when downloading binaries (only happens with git builds)
cfergeau added a commit to cfergeau/crc that referenced this issue Sep 28, 2021
On Windows, x509.SystemCertPool returns an error:
golang/go#16736

This commit reverts to the behaviour before commit b50dc99 when catching
such an error. This means https_proxy=https://... will be broken for
non-mitm https proxies. Such proxies were not usable before the PR
adding b50dc99, so this should not have much impact for our existing
users.

These CAs are used:
- when accessing telemetry
- when checking for a new crc version
- when downloading binaries (only happens with git builds)
cfergeau added a commit to cfergeau/crc that referenced this issue Sep 28, 2021
On Windows, x509.SystemCertPool returns an error:
golang/go#16736

This commit reverts to the behaviour before commit b50dc99 when catching
such an error. This means https_proxy=https://... will be broken for
non-mitm https proxies. Such proxies were not usable before the PR
adding b50dc99, so this should not have much impact for our existing
users.

These CAs are used:
- when accessing telemetry
- when checking for a new crc version
- when downloading binaries (only happens with git builds)

This fixes crc-org#2770
cfergeau added a commit to cfergeau/crc that referenced this issue Sep 28, 2021
On Windows, x509.SystemCertPool returns an error:
golang/go#16736

This commit reverts to the behaviour before commit b50dc99 when catching
such an error. This means https_proxy=https://... will be broken for
non-mitm https proxies. Such proxies were not usable before the PR
adding b50dc99, so this should not have much impact for our existing
users.

These CAs are used:
- when accessing telemetry
- when checking for a new crc version
- when downloading binaries (only happens with git builds)

This fixes crc-org#2770
praveenkumar pushed a commit to crc-org/crc that referenced this issue Sep 29, 2021
On Windows, x509.SystemCertPool returns an error:
golang/go#16736

This commit reverts to the behaviour before commit b50dc99 when catching
such an error. This means https_proxy=https://... will be broken for
non-mitm https proxies. Such proxies were not usable before the PR
adding b50dc99, so this should not have much impact for our existing
users.

These CAs are used:
- when accessing telemetry
- when checking for a new crc version
- when downloading binaries (only happens with git builds)

This fixes #2770
@gopherbot
Copy link

Change https://golang.org/cl/353589 mentions this issue: crypto/x509: verification with system and custom roots

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
FrozenDueToAge help wanted NeedsFix The path to resolution is known, but the work has not been done. OS-Windows
Projects
None yet
Development

Successfully merging a pull request may close this issue.

17 participants