Skip to content

Commit 62e7ec8

Browse files
dschoGit for Windows Build Agent
authored andcommitted
Merge pull request #3293 from pascalmuller/http-support-automatically-sending-client-certificate
http: Add support for enabling automatic sending of SSL client certificate
2 parents e70d590 + 8d30557 commit 62e7ec8

File tree

2 files changed

+27
-4
lines changed

2 files changed

+27
-4
lines changed

Documentation/config/http.txt

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,11 @@ http.schannelUseSSLCAInfo::
189189
when the `schannel` backend was configured via `http.sslBackend`,
190190
unless `http.schannelUseSSLCAInfo` overrides this behavior.
191191

192+
http.sslAutoClientCert::
193+
As of cURL v7.77.0, the Secure Channel backend won't automatically
194+
send client certificates from the Windows Certificate Store anymore.
195+
To opt in to the old behavior, http.sslAutoClientCert can be set.
196+
192197
http.pinnedpubkey::
193198
Public key of the https service. It may either be the filename of
194199
a PEM or DER encoded public key file or a string starting with

http.c

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,8 @@ static int http_schannel_check_revoke_mode =
147147
*/
148148
static int http_schannel_use_ssl_cainfo;
149149

150+
static int http_auto_client_cert;
151+
150152
size_t fread_buffer(char *ptr, size_t eltsize, size_t nmemb, void *buffer_)
151153
{
152154
size_t size = eltsize * nmemb;
@@ -311,6 +313,11 @@ static int http_options(const char *var, const char *value, void *cb)
311313
return 0;
312314
}
313315

316+
if (!strcmp("http.sslautoclientcert", var)) {
317+
http_auto_client_cert = git_config_bool(var, value);
318+
return 0;
319+
}
320+
314321
if (!strcmp("http.minsessions", var)) {
315322
min_curl_sessions = git_config_int(var, value);
316323
if (min_curl_sessions > 1)
@@ -821,13 +828,24 @@ static CURL *get_curl_handle(void)
821828
}
822829
#endif
823830

824-
if (http_ssl_backend && !strcmp("schannel", http_ssl_backend) &&
825-
http_schannel_check_revoke_mode) {
831+
if (http_ssl_backend && !strcmp("schannel", http_ssl_backend)) {
832+
long ssl_options = 0;
833+
if (http_schannel_check_revoke_mode) {
826834
#if LIBCURL_VERSION_NUM >= 0x072c00
827-
curl_easy_setopt(result, CURLOPT_SSL_OPTIONS, http_schannel_check_revoke_mode);
835+
ssl_options |= http_schannel_check_revoke_mode;
828836
#else
829-
warning(_("CURLSSLOPT_NO_REVOKE not supported with cURL < 7.44.0"));
837+
warning(_("CURLSSLOPT_NO_REVOKE not supported with cURL < 7.44.0"));
830838
#endif
839+
}
840+
841+
if (http_auto_client_cert) {
842+
#if LIBCURL_VERSION_NUM >= 0x074d00
843+
ssl_options |= CURLSSLOPT_AUTO_CLIENT_CERT;
844+
#endif
845+
}
846+
847+
if (ssl_options)
848+
curl_easy_setopt(result, CURLOPT_SSL_OPTIONS, ssl_options);
831849
}
832850

833851
if (http_proactive_auth)

0 commit comments

Comments
 (0)