Tags: wazuh/wazuh
Tags
fix: keep trusting the Windows certificate store Now that the Windows agent's curl is OpenSSL-backed it has no CA bundle at all - configure reports "ca cert bundle: no" - so every HTTPS request would fail verification. Schannel used to read the machine's ROOT and CA stores on its own; CURLSSLOPT_NATIVE_CA asks OpenSSL for the same ones through the Win32 crypto API. Applied where the agent speaks HTTPS on Windows: the https_client transport, and wurl_http_request, which is what agentd's uninstall check and the github, office365 and ms-graph modules go through. An explicitly configured <ca> still stands alone - the machine's stores are not added on top of it, or the trust set would silently widen. Looking the bundle up is also now skipped for plain HTTP, where it was never used.
fix: keep trusting the Windows certificate store Now that the Windows agent's curl is OpenSSL-backed it has no CA bundle at all - configure reports "ca cert bundle: no" - so every HTTPS request would fail verification. Schannel used to read the machine's ROOT and CA stores on its own; CURLSSLOPT_NATIVE_CA asks OpenSSL for the same ones through the Win32 crypto API. Applied where the agent speaks HTTPS on Windows: the https_client transport, and wurl_http_request, which is what agentd's uninstall check and the github, office365 and ms-graph modules go through. An explicitly configured <ca> still stands alone - the machine's stores are not added on top of it, or the trust set would silently widen. Looking the bundle up is also now skipped for plain HTTP, where it was never used.
fix: keep trusting the Windows certificate store Now that the Windows agent's curl is OpenSSL-backed it has no CA bundle at all - configure reports "ca cert bundle: no" - so every HTTPS request would fail verification. Schannel used to read the machine's ROOT and CA stores on its own; CURLSSLOPT_NATIVE_CA asks OpenSSL for the same ones through the Win32 crypto API. Applied where the agent speaks HTTPS on Windows: the https_client transport, and wurl_http_request, which is what agentd's uninstall check and the github, office365 and ms-graph modules go through. An explicitly configured <ca> still stands alone - the machine's stores are not added on top of it, or the trust set would silently widen. Looking the bundle up is also now skipped for plain HTTP, where it was never used.
fix(https_client): format the module to the astyle rules The RTR job for client-agent/https_client stops at its AStyle stage, so cppcheck is the only check that ever runs on the module. Two files disagree with ci/input/astyle.config: a continuation line in httpsClientFacade.cpp and, in statelessStream_test.cpp, another continuation plus a braced initializer whose brace has to sit on its own line under Allman. Output of build.py --sformat, so it is whitespace only.
Merge pull request #38271 from wazuh/fix/38265-remove-stale-ec2-timin… …g-exclusion-syscollector-rtr Remove stale EC2-timing exclusion in syscollector-rtr
Merge pull request #38059 from wazuh/fix/37526-error-1720-installing-… …wazuh-agent-on-windows-10-pro Remove WMI dependancy when installing msi packages
Merge pull request #37545 from wazuh/fix/887-hp-ux-compilation-error Compilation error in HP-UX arch
Merge pull request #37523 from wazuh/enhancement/wqa8102-bump-4.14.7 Bump 4.14.7 branch
PreviousNext