From 2d2dd857669baf51fadad9608e6d6a0c08bbb373 Mon Sep 17 00:00:00 2001 From: Timur Pocheptsov Date: Mon, 24 Apr 2017 16:33:08 +0200 Subject: [PATCH] QSslSocket (SecureTransport) - use anchors only from QSslConfiguration Calling SecTrustSetAnchorCertificatesOnly(trust, false) we actually extend what our user provided in QSslConfiguration as CA certificates (caCertificates, setCaCertificates) - Secure Transport will also use a default set provided by the system and SSL handshake can surprisingly (for a user) succeed. And the default content of these caCertificates, if not altered by setCaCertificates call - are those system CA certificates. Task-number: QTBUG-60233 Change-Id: I8c1094bb7eec260f5202a47085f9f75e720eda7b Reviewed-by: Edward Welbourne Reviewed-by: Timur Pocheptsov --- src/network/ssl/qsslsocket_mac.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/network/ssl/qsslsocket_mac.cpp b/src/network/ssl/qsslsocket_mac.cpp index a2dee75895..fec5fbefc0 100644 --- a/src/network/ssl/qsslsocket_mac.cpp +++ b/src/network/ssl/qsslsocket_mac.cpp @@ -1223,7 +1223,8 @@ bool QSslSocketBackendPrivate::verifyPeerTrust() CFArrayAppendValue(certArray, certRef); } SecTrustSetAnchorCertificates(trust, certArray); - SecTrustSetAnchorCertificatesOnly(trust, false); + // Secure Transport should use anchors only from our QSslConfiguration: + SecTrustSetAnchorCertificatesOnly(trust, true); SecTrustResultType trustResult = kSecTrustResultInvalid; SecTrustEvaluate(trust, &trustResult);