sslrootcert-system-win-2.diff
application/octet-stream
Filename: sslrootcert-system-win-2.diff
Type: application/octet-stream
Part: 0
Patch
Same data as JSON:
GET /api/v1/attachments/:id/patch
the parsed metadata as JSON — format, series position, per-file stats; never the diff bytes.
API reference →
Format: unified
| File | + | − |
|---|---|---|
| src/interfaces/libpq/fe-secure-openssl.c | 13 | 1 |
diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
index 5bb9d9779d828..e0ad63fa9c5c6 100644
--- a/src/interfaces/libpq/fe-secure-openssl.c
+++ b/src/interfaces/libpq/fe-secure-openssl.c
@@ -839,8 +839,20 @@ initialize_SSL(PGconn *conn)
* differ by platform. Note that the default system locations may be
* further overridden by the SSL_CERT_DIR and SSL_CERT_FILE
* environment variables.
+ *
+ * On Windows, we use the system store
+ * (https://docs.openssl.org/master/man7/OSSL_STORE-winstore/) as long
+ * as neither of these environment variables is set.
*/
- if (SSL_CTX_set_default_verify_paths(SSL_context) != 1)
+
+ int rootcert_result =
+#if defined(WIN32) && OPENSSL_VERSION_PREREQ(3, 2)
+ getenv("SSL_CERT_DIR") == NULL && getenv("SSL_CERT_FILE") == NULL ?
+ SSL_CTX_load_verify_store(SSL_context, "org.openssl.winstore:") :
+#endif
+ SSL_CTX_set_default_verify_paths(SSL_context);
+
+ if (rootcert_result != 1)
{
char *err = SSLerrmessage(ERR_get_error());