[QPID-5356] Windows can provide an unspecified client certificate in SSL negotiation

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.24
• Fix Version/s: 0.27
• Component/s: C++ Client

Environment

Windows, SSL

• Assignee: Clifford Jansen
• Reporter: Clifford Jansen
• Created: 19/Nov/13 07:58
• Updated: 03/Jun/14 15:35
• Resolved: 04/Dec/13 23:04

Description

By default, the SChannel package from Microsoft will attempt to guess an appropriate client certificate during SSL/TLS negotiation if a client certificate is requested by the server and none is supplied by the client in its credentials structure. This behavior can be changed to only work with an explicitly specified certificate (if any) by the client.

By doing so, the behavior of clients is made more consistent across platforms and this eliminates unexpected false positives in testing.