Win32/SCHANNEL align --cacert behaviour with OpenSSL and LibreSSL

[rodwiddowson]

I'm pushing this PR to act as a point of reference for others.

I would not be surprised to see it rejected since I appreciate that there are disagreements on how the spec should be implemented.

Also, I feel uncomfortable changing behaviour by default (particularly in a way that renders the code more lenient) and the fact that the behaviour is different depending on the host OS version is weird. But the alternative is to build an entire option stack to do the exact opposite of CURLSSLOPT_NO_PARTIALCHAIN and it doesn't seem to be worth that

As per the commit message:

---

Win8/Server2012 widened the PKIX chain traversal API to allow certificate
traversal to terminate at an intermediate.

This behaviour (terminate at the fist matching intermediate) is the default
for LibreSSL and OpenSSL (with OpenSSL allowing control via
CURLSSLOPT_NO_PARTIALCHAIN)

This change uses the new API if it is available, and also allows the behaviour
to revert legacy if CURLSSLOPT_NO_PARTIALCHAIN is present.

[testclutch]

Analysis of PR #17418 at 877b181e:

Test 3028 failed, which has NOT been flaky recently, so there could be a real issue in this PR.

Generated by Testclutch

[rodwiddowson]

Apologies for the noise as I was getting the code style conformant across all architectures. Its been too long.

A bit surprised by

Test 3028 failed, which has NOT been flaky recently, so there could be a real issue in this PR.

AFAICS there are no failures. OTOH this is exactly something I would expect to see a regression test fail for

[dfandrich]

The failed test was on your first commit 877b181, not the two subsequent commits which you force pushed afterwards. Test Clutch only looks at one commit in any given PR.

[rodwiddowson]

thanks @dfandrich (and again sorry for the checkin noise)

[bagder]

It would be great if you could amend this by explaining what "align --cacert behaviour with OpenSSL and LibreSSL" actually means. Aligning how? I believe you refer to accepting intermediate certificates found in the CA store as trust-anchors ?

[rodwiddowson]

Updated the commit message slightly and force-pushed. Copied most of of the commit message into the PR description

[jay]

Ref: #4655

[jay]

I'll land this in the next feature window

[jay]

I think this should also have something in the documentation for CURLSSLOPT_NO_PARTIALCHAIN so I pushed a suggestion "Works with Schannel if the user specified certificates to verify the peer. (Added in 8.15.0)"

[jay]

Thanks