4

I have a Qt application which succeeds in making an HTTPS request to our website on OSX 10.7, but fails on 10.5.8 with the QSslError::errorString "The root CA certificate is not trusted for this purpose".

I am setting the root certificate with:

QFile certFile1(":/Equifax_Secure_Certificate_Authority.pem.txt");
QSslCertificate cert1(&certFile1, QSsl::Pem);
certList.append(cert1);

QSslConfiguration sslConfig(request.sslConfiguration());
sslConfig.setCaCertificates(certList);
request.setSslConfiguration(sslConfig);

If I set some other certificate, I get two error strings "The issuer certificate of a locally looked up certificate could not be found" AND "The root CA certificate is not trusted for this purpose", on both OSX 10.5.8 and 10.7. This is what I'd expect.

What makes Qt not trust the Equifax certificate only on 10.5.8?

EDIT: Possible clue (or red herring): looking at the respective WireShark traces, the 10.5.8 client doesn't include Server Name Indication or Session Ticket TLS extensions in its client hello handshake.

EDIT 2: Building as 32-bit on 10.5.8 works. Also, building as universal (32 and 64-bit Intel) on 10.7 and running on 10.5.8, linking against 32-bit Qt libraries built on 10.5.8 works.

EDIT 3: I have placed an example at https://github.com/cdemel/SO_examples/tree/master/soqtssl, using a different website (Twitter) and root cert, with the same behavior.

ctd
  • 1,693
  • 12
  • 27
  • It would be a lot easier to really understand what is going on if you provided (the smallest possible) running code. Back to the question, are you sure you are actually passing a valid certificate? If for example the file doesn't exist, QSslCertificate will still be constructed (no throw). Before appending to the list, you should call cert1.isNull(). – marco.m Nov 01 '12 at 21:07
  • I check cert1.isValid(), which fails if it's a null cert. I'll make a small example. Thanks! – ctd Nov 02 '12 at 17:37
  • OK, I have put a small link on github and added a link in the question. – ctd Nov 02 '12 at 18:27

1 Answers1

0

Well, this has been unanswered for too long, so I'm going to give my uninformed solution as the answer:

Have the app link to Qt libraries built on 10.5.8. This worked for me, but I can't tell you why.

ctd
  • 1,693
  • 12
  • 27