> On 2 Apr 2025, at 08:32, Daniel Gustafsson wrote: > >> On 1 Apr 2025, at 23:46, Jacob Champion wrote: >> On Tue, Apr 1, 2025 at 2:05 PM George MacKerron wrote: > >>> I’ve recently been trying to get it more widely supported, with some success (details at end of this message). >> >> (Thank you!) > > +many > >>> I’m not a Windows or OpenSSL expert, but so far the patched code seems to work in theory and in practice (sources below, and I’ve compiled and tested it working on Windows 11 x64). >> >> While this will get things working -- if you plan to use the Windows >> store! -- I worry that it's an incompatible change, and anyone who is >> actually happy with the way things currently work (i.e. not using the >> EDB installers) will be broken. The meaning of `sslrootcert=system` is >> "do whatever OpenSSL wants to do by default." That includes >> modification by the OpenSSL environment variables, which (I think) >> this patch disables. > > Correct, this patch changes from using the defaults (directory, file and store) > and thus the env variable overrides, to hardcoding the new winstore which came > in 3.2 as the only option. While I agree that we probably should allow > winstore (and other such stores for other platforms when/if they happen) I > don't think making it the only option is the right way. > >> The winstore is new to me. Is there no way to get OpenSSL to switch >> its default store without code changes? > > AFAIK one cannot change the default store in OpenSSL short of recompiling > OpenSSL. > > -- > Daniel Gustafsson >