how to Ignore certificate in HttpPOST request in WINAPI

问题

I have a VC++ HttpPOST method which works fine for both 80 and 443 port. (on popular websites like google.com)

Now when I connect to a secured host(172.17.9.93) having cgi script, Now when I connect using fiddler I get a warning of a invalid certificate and on accepting warning I am able to connect.

same behaviour I have to do it in C++ which is to ignore the certificate using below flags SECURITY_FLAG_IGNORE_UNKNOWN_CA, INTERNET_FLAG_IGNORE_CERT_CN_INVALID and some combinations in function HttpOpenRequest() but it fails and gives below output.

C++ Console Output

 172.17.9.93 : 443  data base-bin/hello.cgi

Error 12045 has occurred while HttpSendRequest
INVALID CA request received (12045)

Source Code VC++

#define _WIN32_WINNT 0x600
#include <windows.h>
#include <stdio.h>
#include <string>
#include <wininet.h>
#pragma comment(lib,"Wininet.lib")
using namespace std;

int doPost(std::string send, std::string &receive, LPCTSTR host, int port, LPCTSTR url)
{

    char szData[1024];
    int winret = 0;
    TCHAR szAccept[] = L"*/*";
    LPWSTR AcceptTypes[2] = { 0 };
    AcceptTypes[0] = szAccept;

    HINTERNET hInternet = ::InternetOpen(TEXT("mandar"), INTERNET_OPEN_TYPE_PRECONFIG, NULL, NULL, 0);
    if (hInternet != NULL)
    {
        printf("\n %S : %d  data %S \n", host, port, url);

        // open HTTP session
        HINTERNET hConnect;
        if (port == 80)
        {
            hConnect = ::InternetConnect(hInternet, host, INTERNET_DEFAULT_HTTP_PORT, NULL, NULL, INTERNET_SERVICE_HTTP, NULL, 0);
        }
        else
        {
            hConnect = ::InternetConnect(hInternet, host, port, NULL, NULL, INTERNET_SERVICE_HTTP, NULL, 0);
        }
        if (hConnect != NULL)
        {
            DWORD dwFlags = dwFlags |= INTERNET_FLAG_SECURE |
                SECURITY_FLAG_IGNORE_UNKNOWN_CA | INTERNET_FLAG_IGNORE_CERT_CN_INVALID|
                INTERNET_FLAG_IGNORE_CERT_DATE_INVALID;
            /*SECURITY_FLAG_IGNORE_UNKNOWN_CA |
            INTERNET_FLAG_IGNORE_CERT_CN_INVALID |
            INTERNET_FLAG_IGNORE_CERT_DATE_INVALID
            | SECURITY_FLAG_IGNORE_CERT_CN_INVALID
            | SECURITY_FLAG_IGNORE_CERT_DATE_INVALID;*/


            // open request
            HINTERNET hRequest;

            if (port == 80)
            {
                hRequest = ::HttpOpenRequest(hConnect, TEXT("POST"), url, HTTP_VERSION, NULL, 0, NULL, 0);
            }
            else
            {
                hRequest = ::HttpOpenRequest(hConnect, TEXT("POST"), url, HTTP_VERSION, NULL, 0, dwFlags, 0);
            }

            if (hRequest != NULL)
            {
                if (::HttpSendRequest(hRequest, NULL, 0, (LPVOID)send.c_str(), send.length()))
                {
                    for (;;)
                    {
                        // reading data
                        DWORD dwByteRead;
                        BOOL isRead = ::InternetReadFile(hRequest, szData, sizeof(szData) - 1, &dwByteRead);

                        // break cycle if error or end
                        if (isRead == FALSE || dwByteRead == 0)
                            break;

                        // saving result
                        szData[dwByteRead] = 0;
                        receive.append(szData);
                    }
                    printf(" receive data [%s]", receive.c_str());
                }
                else{
                    winret = GetLastError();
                    printf("\nError %d has occurred while HttpSendRequest", winret);
                    switch (winret)
                    {
                    case ERROR_INTERNET_INVALID_CA:
                        printf("\nINVALID CA request received (%d)\n", winret);
                        break;
                    case ERROR_INTERNET_CLIENT_AUTH_CERT_NEEDED:
                        printf("\nResubmitting for CLIENT_AUTH_CERT_NEEDED (%d)\n", winret);
                        break;
                    default:
                        printf("\nError %d has occurred while HttpSendRequest", winret);
                    }
                }

                // close request
                ::InternetCloseHandle(hRequest);
            }
            else{
                winret = GetLastError();
                printf("\nError %d has occurred while HttpOpenRequest", winret);
            }
            // close session
            ::InternetCloseHandle(hConnect);
        }
        else{
            winret = GetLastError();
            printf("\nError %d has occurred while InternetConnect", winret);
        }
        // close WinInet
        ::InternetCloseHandle(hInternet);
    }
    else
    {
        winret = GetLastError();
        printf("\nError %d has occurred while InternetOpen", winret);
    }


    return winret;
}
int main()
{
    std::string send;
    std::string receive;
    LPCTSTR host =  L"172.17.9.93";
    int port = 443;// 80;
    LPCTSTR url = L"base-bin/hello.cgi";
    doPost("<XMLhello>1</XMLhello>",receive,host,port,url);
}

回答1:

HttpOpenRequest work only with flags form INTERNET_FLAG_* - pass flag SECURITY_FLAG_IGNORE_UNKNOWN_CA to HttpOpenRequest this is error.

look for numeric values:

#define SECURITY_FLAG_IGNORE_UNKNOWN_CA         0x00000100

#define INTERNET_FLAG_PRAGMA_NOCACHE    0x00000100  // asking wininet to add "pragma: no-cache"

so if you try pass SECURITY_FLAG_IGNORE_UNKNOWN_CA to HttpOpenRequest you really pass INTERNET_FLAG_PRAGMA_NOCACHE flag

SECURITY_FLAG_IGNORE_UNKNOWN_CA is designed to use in InternetSetOption function with INTERNET_OPTION_SECURITY_FLAGS

so you need this code use:

DWORD dwFlags;
DWORD dwBuffLen = sizeof(dwFlags);

if (InternetQueryOption (hRequest, INTERNET_OPTION_SECURITY_FLAGS, &dwFlags, &dwBuffLen))
{
    dwFlags |= SECURITY_FLAG_IGNORE_UNKNOWN_CA;
    InternetSetOption (hRequest, INTERNET_OPTION_SECURITY_FLAGS, &dwFlags, sizeof (dwFlags));
}

also read How To Handle Invalid Certificate Authority Error with WinInet - Method 2. Without a UI: is exactly your case

来源：https://stackoverflow.com/questions/41357008/how-to-ignore-certificate-in-httppost-request-in-winapi