CurlHttpClient: SSL connections fail on Windows when CRL server is unreachable (CRYPT_E_REVOCATION_OFFLINE)

[feueradam]

Describe the bug

SSL connections via CurlHttpClient fail on Windows when Certificate Revocation List (CRL) servers are unreachable. Schannel (the Windows libcurl SSL backend) performs mandatory CRL checking during the SSL handshake, and the SDK does not set CURLSSLOPT_REVOKE_BEST_EFFORT to handle offline revocation servers.

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

SSL connections succeed when the certificate itself is valid, even if the CRL distribution point is unreachable.

Current Behavior

SSL connections fail with:
curlCode: 35, SSL connect error
Details: schannel: next InitializeSecurityContext failed: CRYPT_E_REVOCATION_OFFLINE (0x80092013)
- The revocation function was unable to check revocation because the revocation server was offline.

Reproduction Steps

1. On a Windows machine, block outbound HTTP (port 80) to Amazon CRL endpoints (e.g., crl.r2m02.amazontrust.com) via firewall
2. Use the AWS C++ SDK to make any HTTPS request (e.g., S3 ListObjects)
3. The connection fails with curlCode 35 / CRYPT_E_REVOCATION_OFFLINE

Possible Solution

Add CURLSSLOPT_REVOKE_BEST_EFFORT in CurlHttpClient.cpp inside the if (m_verifySSL) block (aws-cpp-sdk-core/source/http/curl/CurlHttpClient.cpp:735) :

#if LIBCURL_VERSION_NUM >= 0x074600 // 7.70.0
curl_easy_setopt(connectionHandle, CURLOPT_SSL_OPTIONS, CURLSSLOPT_REVOKE_BEST_EFFORT);
#endif

This tells Schannel to proceed if the CRL server is offline while still checking revocation when reachable. SSL peer/host verification remains fully enabled.

Additional Information/Context

No response

AWS CPP SDK version used

1.11.747

Compiler and Version used

MSVC (Visual Studio 2022)

Operating System and version

Windows Server 2019/2022

[kai-ion]

@feueradam
Thanks for reporting this issue.
We plan to add a new option to ClientConfiguration to enable CURLSSLOPT_REVOKE_BEST_EFFORT. This will be off by default to maintain backward compatibility (existing behavior is unchanged). Customers who need to operate in environments where CRL servers may be unreachable can opt in explicitly.