TlsSockets don't work in XP but BareboneThunks do?

[gaouservbf]

1599.219 [ERROR] The certificate or one of the certificates in the certificate chain does not have a valid signature &H80040000 [Form1.pvInitHttpRequest, cTlsSocket.pvPkiCertValidate]

I get this when I use the built in "Basic" test example for TlsSocket.

[wqweto]

Possible. The Basic test project is a hodgepodge of snippets I've used to excercise different aspects of the classes and decided to leave them for "inspiration" as samples i.e. failure is expected.

This particular failure comes from server certificate validation i.e. depends on the version of Windows the whole verification is done on e.g. XP does not understand ECDSA certificates.

[gaouservbf]

So cTlsSockets impossible to use on XP? Am I left with a pool of 255 WinSock's control-array?

[gaouservbf]

Also yes I did update my certs.

[wqweto]

So cTlsSockets impossible to use on XP?

Impossible - no. Somewhat limited - yes. E.g. you cannot validate ECDSA server certificates (no elliptic curves cryptography available) but TLS 1.3 works fine by skipping these validation failures.

It's perfectly possible to use older (and more compatible) RSA certificates which are validated ok on Win98 too. Most of the internet servers use these for this particular reason. ECDSA certificates are smaller (less traffic) and faster to validate so eventually everyone will be migrated to these.

[gaouservbf]

Validating server certs seems a bit useless to me(as somebody who used bare HTTP a few months ago), any way to disable that?

[gaouservbf]

Possible. The Basic test project is a hodgepodge of snippets I've used to excercise different aspects of the classes and decided to leave them for "inspiration" as samples i.e. failure is expected.

This particular failure comes from server certificate validation i.e. depends on the version of Windows the whole verification is done on e.g. XP does not understand ECDSA certificates.

By the way, on Win11 25H2 and Win10 it did work. Can you provide the const/parameter to disable server TLS cert vertification or using RSA?

[wqweto]

To skip certificate validation you can use ucsTlsIgnoreServerCertificateErrors flag with LocalFeatures parameter of TlsInitClient call.

For instance in Form1 of BareboneTls modify Connect procedure like this

Private Enum UcsTlsLocalFeaturesEnum '--- bitmask
    ucsTlsSupportTls10 = 2 ^ 0
    ucsTlsSupportTls11 = 2 ^ 1
    ucsTlsSupportTls12 = 2 ^ 2
    ucsTlsSupportTls13 = 2 ^ 3
    ucsTlsIgnoreServerCertificateErrors = 2 ^ 4
    ucsTlsSupportAll = ucsTlsSupportTls10 Or ucsTlsSupportTls11 Or ucsTlsSupportTls12 Or ucsTlsSupportTls13
End Enum

Private Sub Connect(ByVal sServer As String, ByVal lPort As Long)
+   Call TlsInitClient(m_uCtx, sServer, LocalFeatures:=ucsTlsSupportAll Or ucsTlsIgnoreServerCertificateErrors)
    wscSocket.Close
    wscSocket.Connect sServer, lPort
End Sub

[gaouservbf]

Works like magic! Thank you for the support. Now its time I tell it to the WebSocket library maintainer :D

[wqweto]

Probably they should consider adding a new Insecure As Boolean property to the user-control which manages this flag on TlsInitClient the same way curl has -k parameter to suppress certificate validation:

C:\Users\wqw>curl --help all | findstr -i insecure
 -k, --insecure                                    Allow insecure server connections

[gaouservbf]

Agreed. Also you can add an NT ver check to use RSA no matter the config is.

[wqweto]

Agreed. Also you can add an NT ver check to use RSA no matter the config is.

Unfortunately NT cannot even check if a certificate is ECDSA based one. It knows RSA only and the rest are just of unknown type.

It's possible to implement special logic on NT4-to-XP versions -- if RSA then verify else skip -- but this might unknowingly allow MITM attacks on ECDSA certificates (which will be skipped by default) so I prefer to err on the side of being explicit in allowing insecure communications.

In theory it's possble to add an ucsTlsIgnoreUnknownServerCertificateErrors flag but the "demand" and my "incentive" is currently low (it just looks half-baked solution).

[gaouservbf]

Maybe if NT is below 6. Just default to RSA no matter what.