Fallback to System Certificate Store when CA Certificate Path Is Not Present

[dckorben]

"Fixes" #990

This isn't final, too duplicative. Need someone to verify it works on Windows/Linux as we've been bitten by behavior differences before and I don't have an admin box I can trust the generated CA with.

@dimaaik27 Please verify this works in your implementation before I clean up the code.

[dckorben]

Notable that this comment SAYS it validates against installed certificates but that is actually not true. It validates against installed certificates if it is a HTTPS/TLS connection, which was probably the intended meaning. If you specify a certificate but not a CA, it just fails. In the case of #990, you can specify a certificate from a Public CA but then validation fails and because many CAs use a lineage of certificates you cannot validate the chain with the existing configuration options.

[dckorben]

I do see a potential issue here where it doubles up the certificate chain validation for TLS/HTTPS connections because the function VerifyRemoteCertificate isn't aware of the certificate source.

[dimaaik27]

@dckorben yes it works now if I don't specify CA certificate and it checks it agains the installed ones.

[dckorben]

Are you a Linux test by chance?

[dckorben]

@dckorben yes it works now if I don't specify CA certificate and it checks it agains the installed ones.

The good aspect of this is you won't have to manage the CA key expirations manually. So, it's an improvement in function as well.

[dimaaik27]

nope, windows