PR #25482 opened by J-RAP (SrRapero720) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25482 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25482.patch
# Summary of changes Make the OpenSSL backend trust the Windows certificate store when no `ca_file` is given. **Problem** The tls protocol verifies the peer by default. Without `ca_file`, OpenSSL only looks in the default locations configured when it was built, and on Windows those usually do not exist. Every https connection then fails with `certificate verify failed` unless the caller provides a CA file. The Schannel backend uses the system store and is not affected. **Change** - `avformat/tls_openssl: also trust the Windows certificate store`: when no `ca_file` is given, load the Windows ROOT system store through the `org.openssl.winstore://` loader added in OpenSSL 3.2, in addition to the default locations. The code is only built on Windows, with OpenSSL 3.2 or later, and when OpenSSL was not built with `no-winstore`. A failure to load the store only logs a warning, like the existing default-locations failure. Documentation is updated in the tls section of `doc/protocols.texi`. Related: !25472 makes `ca_file` and `tls_verify` reach the nested connections of HLS and DASH. That PR covers a caller-supplied `ca_file`; this one covers the default when there is none. The two are independent and can be merged in either order. **Testing** MSVC build with OpenSSL 3.6.5 (MSYS2 package) and Schannel disabled. OpenSSL's default locations were pointed at nonexistent paths through `SSL_CERT_FILE` and `SSL_CERT_DIR`, as on a typical Windows setup, and URLs were opened with the default `tls_verify=1`: | URL | master | this PR | |---|---|---| | `https://example.com/` | certificate verify failed | ok | | `https://wrong.host.badssl.com/` | fails | fails | | `https://self-signed.badssl.com/` | fails | fails | Trusting the system store does not weaken host name checking or accept self-signed certificates. Not tested: OpenSSL older than 3.2 (the code is not compiled there) and OpenSSL builds with `no-winstore`. >From e0484fe91b20dd65fafbe8f606ae2675b9e6717b Mon Sep 17 00:00:00 2001 From: J-RAP <[email protected]> Date: Mon, 26 Oct 2026 05:07:37 -0600 Subject: [PATCH] avformat/tls_openssl: also trust the Windows certificate store The tls protocol verifies the peer by default. Without ca_file, OpenSSL only looks in the default locations configured when it was built, which on Windows usually do not exist, so every https connection fails certificate verification unless the caller provides a CA file. The Schannel backend uses the system store and does not have this problem. OpenSSL 3.2 added a store loader for the Windows ROOT system store. When no ca_file is given, load it in addition to the default locations, unless OpenSSL was built without it. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Signed-off-by: J-RAP <[email protected]> --- doc/protocols.texi | 2 ++ libavformat/tls_openssl.c | 8 ++++++++ 2 files changed, 10 insertions(+) diff --git a/doc/protocols.texi b/doc/protocols.texi index aaee2292e9d..aff1e0b7dee 100644 --- a/doc/protocols.texi +++ b/doc/protocols.texi @@ -2314,6 +2314,8 @@ as trusted. If the linked TLS library contains a default this might not need to be specified for verification to work, but not all libraries and setups have defaults built in. The file must be in OpenSSL PEM format. +When no file is given and FFmpeg uses OpenSSL 3.2 or later on Windows, the +certificates of the system ROOT store are trusted as well. @item tls_verify, verify=@var{1|0} If enabled, try to verify the peer that we are communicating with. diff --git a/libavformat/tls_openssl.c b/libavformat/tls_openssl.c index 0075288d617..4a7e07ced83 100644 --- a/libavformat/tls_openssl.c +++ b/libavformat/tls_openssl.c @@ -719,6 +719,14 @@ static av_cold int openssl_init_ca_key_cert(URLContext *h) av_log(h, AV_LOG_WARNING, "Failure setting default verify locations: %s\n", openssl_get_error(c)); } +#if defined(_WIN32) && !defined(OPENSSL_NO_WINSTORE) && \ + OPENSSL_VERSION_NUMBER >= 0x30200000L /* OpenSSL 3.2 */ + // Windows has no default CA directory, so also trust its ROOT system store + if (!SSL_CTX_load_verify_store(c->ctx, "org.openssl.winstore://")) { + av_log(h, AV_LOG_WARNING, "Failure loading the Windows certificate store: %s\n", + openssl_get_error(c)); + } +#endif } if (s->cert_file) { -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
