mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2024-12-15 06:40:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

TODO: update regarding missing Schannel features

Browse Source 
Some aspects have already been implemented over the years.

15.1 Client certificates are now supported:

- System stores via e35b0256eb
- PKCS#12 files via 0fdf965126

15.2 Ciphers can now be specified through:

- Algorithms via 9aefbff30d

Reviewed-by: Daniel Stenberg and Marcel Raad
Closes #5358
This commit is contained in:
Marc Hoersken 2020-05-08 20:49:22 +02:00
parent 92501a12a2
commit 8329775abb
No known key found for this signature in database
GPG Key ID: 61E03CBED7BC859E
1 changed files with 12 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
docs/TODO
View File

@ -117,10 +117,10 @@
14. GnuTLS
14.2 check connection
15. WinSSL/SChannel
15.1 Add support for client certificate authentication
15.3 Add support for the --ciphers option
15.4 Add option to disable client certificate auto-send
15. Schannel
15.1 Extend support for client certificate authentication
15.2 Extend support for the --ciphers option
15.3 Add option to disable client certificate auto-send
16. SASL
16.1 Other authentication mechanisms
@ -793,31 +793,23 @@ that doesn't exist on the server, just like --ftp-create-dirs.
Add a way to check if the connection seems to be alive, to correspond to the
SSL_peak() way we use with OpenSSL.
15. WinSSL/SChannel
15. Schannel
15.1 Add support for client certificate authentication
15.1 Extend support for client certificate authentication
WinSSL/SChannel currently makes use of the OS-level system and user
certificate and private key stores. This does not allow the application
or the user to supply a custom client certificate using curl or libcurl.
Therefore support for the existing -E/--cert and --key options should be
implemented by supplying a custom certificate to the SChannel APIs, see:
The existing support for the -E/--cert and --key options could be
extended by supplying a custom certificate and key in PEM format, see:
- Getting a Certificate for Schannel
https://msdn.microsoft.com/en-us/library/windows/desktop/aa375447.aspx
15.3 Add support for the --ciphers option
15.2 Extend support for the --ciphers option
The cipher suites used by WinSSL/SChannel are configured on an OS-level
instead of an application-level. This does not allow the application or
the user to customize the configured cipher suites using curl or libcurl.
Therefore support for the existing --ciphers option should be implemented
by mapping the OpenSSL/GnuTLS cipher suites to the SChannel APIs, see
The existing support for the --ciphers option could be extended
by mapping the OpenSSL/GnuTLS cipher suites to the Schannel APIs, see
- Specifying Schannel Ciphers and Cipher Strengths
https://msdn.microsoft.com/en-us/library/windows/desktop/aa380161.aspx
15.4 Add option to disable client certificate auto-send
15.3 Add option to disable client certificate auto-send
Microsoft says "By default, Schannel will, with no notification to the client,
attempt to locate a client certificate and send it to the server." That could