Use the shipped cacerts.pem instead of the global one #23660
Conversation
The one we ship may cause problems since Equifax is not included anymore (SHA-1 certs) are deprecated. We should just be consistent here and also use the certificate file which is used by the other calls in the library.
|
By analyzing the blame information on this pull request, we identified @MTGap, @PVince81, @icewind1991 and @Xenopathic to be potential reviewers |
|
@karlitschek Backport to stable9? Otherwise Google Drive is broken on some cURL / OpenSSL combinations on it. Older versions are not affected. |
|
Eww... did they recently changed their certs ?? 👍 |
|
hmm. ok. please backport 👍 |
Nope. That is caused due to the performance patch of you at #21732 which was added to 9.0 🙈 Your cURL version may be happy with it because it's clever enough to use the proper chain. Older versions are not 🙈 |
|
stable9: #23662 |
|
This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs. |
The one we ship may cause problems since Equifax is not included anymore (SHA-1 certs are deprecated). We should just be consistent here and also use the certificate file which is used by the other calls in the library.
cc @PVince81 Caused by the recent changes you have done here. Mind testing? Might also fix #23518 (comment)