New submission from Adam Goodman: Starting with Vista, Microsoft began shipping only a very minimal set of root CA certificates with Windows. Microsoft does trust many other authorities, but for these, Windows relies on the "Update Root Certificates" feature: http://technet.microsoft.com/en-us/library/cc749331(WS.10).aspx
"... if the application is presented with a certificate issued by a certification authority in a PKI that is not directly trusted, the Update Root Certificates feature (if it is not turned off) will contact the Windows Update Web site to see if Microsoft has added the certificate of the root CA to its list of trusted root certificates. If the CA has been added to the Microsoft list of trusted authorities, its certificate will automatically be added to the set of trusted root certificates on the user's computer." Critically, this update mechanism is only invoked if you're using CryptoAPI functions to validate a specific chain; if you just ask Windows to enumerate the certificates it knows about, it won't pull anything down from Windows Update. (Some concrete numbers: on a clean installation of Windows 8.1, running certmgr.msc shows 18 certificates listed in the "Trusted Root Certification Authorities"; by contrast, OS X comes with over 200 trusted roots). To confirm this is an issue, I did the following: 1. Start with a clean Windows 8.1 VM image (I used the one from from http://www.modern.ie/en-us/virtualization-tools#downloads). It is critical that the image be completely clean - i.e. you have never visited https://python.org in any web browser, etc. 2. Install Python 3.4.0 RC 3 (32-bit) 3. Run the attached script (which just does a request to https://python.org/ with cert validation enabled). It prints out 14 CA certificate subjects, then fails with "ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:598)". At the time I'm reporting this issue, python.org uses a certificate that chains back to the "DigiCert High Assurance EV Root CA", which is not included in clean installations of Windows. 4. Browse to https://python.org in Internet Explorer 5. Run the attached script again. Now it prints out 17 CA certificate subjects, and the HTTPS request completes successfully. Right now, the only idea I have for resolving this would require significant architectural changes - instead of pulling the certificates from Windows into an OpenSSL context, hook the OpenSSL verify callbacks to retrieve the leaf and intermediate certificates provided by the server, then use CryptoAPI functions (probably CertGetCertificateChain?) to have Windows perform the actual chain validation. ---------- components: Extension Modules messages: 213452 nosy: Adam.Goodman, christian.heimes priority: normal severity: normal status: open title: ssl.enum_certificates() will not return all certificates trusted by Windows type: behavior versions: Python 3.4 _______________________________________ Python tracker <rep...@bugs.python.org> <http://bugs.python.org/issue20916> _______________________________________ _______________________________________________ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
