diff --git a/Release/include/cpprest/http_client.h b/Release/include/cpprest/http_client.h index fb7c6067ab..86f12b1063 100644 --- a/Release/include/cpprest/http_client.h +++ b/Release/include/cpprest/http_client.h @@ -99,7 +99,8 @@ class http_client_config , m_chunksize(0) , m_request_compressed(false) #if !defined(__cplusplus_winrt) - , m_validate_certificates(true) + , m_validate_certificates(true), + , m_check_ssl_certificate_revocation(true) #endif #if !defined(_WIN32) && !defined(__cplusplus_winrt) || defined(CPPREST_FORCE_HTTP_CLIENT_ASIO) , m_tlsext_sni_enabled(true) @@ -262,6 +263,19 @@ class http_client_config /// otherwise. Note ignoring certificate errors can be dangerous and should be done with /// caution. void set_validate_certificates(bool validate_certs) { m_validate_certificates = validate_certs; } + + /// + /// Gets the enable SSL revocation property. + /// + /// True if certificates revocation is to be checked, false otherwise. + bool check_ssl_certificate_revocation() const { return m_check_ssl_certificate_revocation; } + + /// + /// Sets the enable SSL revocation property. + /// + /// True to check certificate validation, false to skip these checks. + /// Note ignoring certificate revocation can be dangerous and should be done with caution. + void set_check_ssl_certificate_revocation(bool check_ssl_certificate_revocation) { m_check_ssl_certificate_revocation = check_ssl_certificate_revocation; } #endif #if (defined(_WIN32) && !defined(__cplusplus_winrt)) || defined(CPPREST_FORCE_HTTP_CLIENT_WINHTTPPAL) @@ -414,6 +428,7 @@ class http_client_config #if !defined(__cplusplus_winrt) // IXmlHttpRequest2 doesn't allow configuration of certificate verification. bool m_validate_certificates; + bool m_check_ssl_certificate_revocation; #endif std::function m_set_user_nativehandle_options; diff --git a/Release/src/http/client/http_client_winhttp.cpp b/Release/src/http/client/http_client_winhttp.cpp index d6cdb5384a..56015b1cac 100644 --- a/Release/src/http/client/http_client_winhttp.cpp +++ b/Release/src/http/client/http_client_winhttp.cpp @@ -1091,16 +1091,19 @@ class winhttp_client final : public _http_client_communicator DWORD ignoredCertificateValidationSteps = 0; if (client_config().validate_certificates()) { - // if we are validating certificates, also turn on revocation checking - DWORD dwEnableSSLRevocationOpt = WINHTTP_ENABLE_SSL_REVOCATION; - if (!WinHttpSetOption(winhttp_context->m_request_handle, - WINHTTP_OPTION_ENABLE_FEATURE, - &dwEnableSSLRevocationOpt, - sizeof(dwEnableSSLRevocationOpt))) - { - auto errorCode = GetLastError(); - request->report_error(errorCode, build_error_msg(errorCode, "Error enabling SSL revocation check")); - return; + // Check to see if we are checking certificate revocation as well + if (client_config().check_ssl_certificate_revocation()) + { + DWORD dwEnableSSLRevocationOpt = WINHTTP_ENABLE_SSL_REVOCATION; + if (!WinHttpSetOption(winhttp_context->m_request_handle, + WINHTTP_OPTION_ENABLE_FEATURE, + &dwEnableSSLRevocationOpt, + sizeof(dwEnableSSLRevocationOpt))) + { + auto errorCode = GetLastError(); + request->report_error(errorCode, build_error_msg(errorCode, "Error enabling SSL revocation check")); + return; + } } // check if the user has overridden the desired Common Name with the host header