schannel: when importing PFX, disable key persistence

By default, the PFXImportCertStore API persists the key in the user's
key store (as though the certificate was being imported for permanent,
ongoing use.)

The documentation specifies that keys that are not to be persisted
should be imported with the flag PKCS12_NO_PERSIST_KEY.
NOTE: this flag is only supported on versions of Windows newer than XP
and Server 2003.

--

This is take 2 of the original fix. It extends the lifetime of the
client certificate store to that of the credential handle. The original
fix which landed in 70d010d and was later reverted in aec8d30 failed to
work properly because it did not do that.

Minor changes were made to the schannel credential context to support
closing the client certificate store handle at the end of an SSL session.

--

Reported-by: ShadowZzj@users.noreply.github.com

Fixes https://github.com/curl/curl/issues/9300
Supersedes https://github.com/curl/curl/pull/9363
Closes https://github.com/curl/curl/pull/9460
2 files changed
tree: c8f4b04695aa7ffea2dc2b6e134f2970f28b051a
  1. .circleci/
  2. .github/
  3. .lift/
  4. .reuse/
  5. CMake/
  6. docs/
  7. include/
  8. lib/
  9. LICENSES/
  10. m4/
  11. packages/
  12. plan9/
  13. projects/
  14. scripts/
  15. src/
  16. tests/
  17. winbuild/
  18. zuul.d/
  19. .azure-pipelines.yml
  20. .cirrus.yml
  21. .dcignore
  22. .dir-locals.el
  23. .git-blame-ignore-revs
  24. .gitattributes
  25. .gitignore
  26. .lgtm.yml
  27. .mailmap
  28. acinclude.m4
  29. appveyor.yml
  30. buildconf
  31. buildconf.bat
  32. CHANGES
  33. CMakeLists.txt
  34. configure.ac
  35. COPYING
  36. curl-config.in
  37. GIT-INFO
  38. libcurl.pc.in
  39. MacOSX-Framework
  40. Makefile.am
  41. Makefile.dist
  42. maketgz
  43. mlc_config.json
  44. README
  45. README.md
  46. RELEASE-NOTES
  47. SECURITY.md
README.md

curl logo

OpenSSF Best Practices Coverity passed AppVeyor Build Status Azure DevOps Build Status Cirrus Build Status GitHub Actions Linux Build Status GitHub Actions macOS Build Status Backers on Open Collective Sponsors on Open Collective Language Grade: C/C++ Fuzzing Status REUSE status

Curl is a command-line tool for transferring data specified with URL syntax. Find out how to use curl by reading the curl.1 man page or the MANUAL document. Find out how to install Curl by reading the INSTALL document.

libcurl is the library curl is using to do its job. It is readily available to be used by your software. Read the libcurl.3 man page to learn how.

You can find answers to the most frequent questions we get in the FAQ document.

Study the COPYING file for distribution terms.

Contact

If you have problems, questions, ideas or suggestions, please contact us by posting to a suitable mailing list.

All contributors to the project are listed in the THANKS document.

Commercial support

For commercial support, maybe private and dedicated help with your problems or applications using (lib)curl visit the support page.

Website

Visit the curl website for the latest news and downloads.

Git

To download the latest source from the Git server, do this:

git clone https://github.com/curl/curl.git

(you will get a directory named curl created, filled with the source code)

Security problems

Report suspected security problems via our HackerOne page and not in public.

Notice

Curl contains pieces of source code that is Copyright (c) 1998, 1999 Kungliga Tekniska Högskolan. This notice is included here to comply with the distribution terms.

Backers

Thank you to all our backers! 🙏 [Become a backer]

Open Collective Backers

Sponsors

Support this project by becoming a sponsor. Your logo will show up here with a link to your website. [Become a sponsor]

Open Collective Sponsor 0 Open Collective Sponsor 1 Open Collective Sponsor 2 Open Collective Sponsor 3 Open Collective Sponsor 4 Open Collective Sponsor 5 Open Collective Sponsor 6 Open Collective Sponsor 7 Open Collective Sponsor 8 Open Collective Sponsor 9