Commit 836436cfb9 for ffmpeg

commit 836436cfb9926fc69606a3772fea8f9941aec06e
Author: J-RAP <srrapero720@hotmail.com>
Date:   Mon Oct 26 05:07:37 2026 -0600

    avformat/tls_openssl: also trust the Windows certificate store

    The tls and dtls protocols verify the peer by default. Without ca_file,
    OpenSSL only looks in the default locations configured when it was
    built, which on Windows usually do not exist, so every connection fails
    certificate verification unless the caller provides a CA file. The
    Schannel backend uses the system store and does not have this problem.

    OpenSSL 3.2 added a store loader for the Windows ROOT system store.
    When no ca_file is given, register it in addition to the default
    locations, unless OpenSSL was built without it. Its certificates are
    looked up during verification, with the usual OpenSSL checks; trust
    restrictions that Windows keeps as certificate properties are not
    enforced by the loader.

    OpenSSL 3.5.0 crashes in this loader (openssl/openssl#27355, fixed in
    3.5.1); no workaround is added for that superseded release.

    Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
    Signed-off-by: J-RAP <srrapero720@hotmail.com>

diff --git a/doc/protocols.texi b/doc/protocols.texi
index 4544ed3d3f..031e257d3f 100644
--- a/doc/protocols.texi
+++ b/doc/protocols.texi
@@ -2319,6 +2319,12 @@ as trusted. If the linked TLS library contains a default this might not
 need to be specified for verification to work, but not all libraries and
 setups have defaults built in.
 The file must be in OpenSSL PEM format.
+When no file is given, Windows builds using OpenSSL 3.2 or later with
+Windows certificate store support also use certificates from the system
+ROOT store. OpenSSL applies its usual certificate checks. Additional
+trust restrictions stored as Windows certificate properties, rather than
+encoded in the certificates themselves, are not enforced by its Windows
+certificate store loader.

 @item tls_verify, verify=@var{1|0}
 If enabled, try to verify the peer that we are communicating with.
@@ -2392,6 +2398,12 @@ as trusted. If the linked TLS library contains a default this might not
 need to be specified for verification to work, but not all libraries and
 setups have defaults built in.
 The file must be in OpenSSL PEM format.
+When no file is given, Windows builds using OpenSSL 3.2 or later with
+Windows certificate store support also use certificates from the system
+ROOT store. OpenSSL applies its usual certificate checks. Additional
+trust restrictions stored as Windows certificate properties, rather than
+encoded in the certificates themselves, are not enforced by its Windows
+certificate store loader.

 @item tls_verify, verify=@var{1|0}
 If enabled, try to verify the peer that we are communicating with.
diff --git a/libavformat/tls_openssl.c b/libavformat/tls_openssl.c
index 0075288d61..3bcd1e74dd 100644
--- a/libavformat/tls_openssl.c
+++ b/libavformat/tls_openssl.c
@@ -719,6 +719,14 @@ static av_cold int openssl_init_ca_key_cert(URLContext *h)
             av_log(h, AV_LOG_WARNING, "Failure setting default verify locations: %s\n",
                 openssl_get_error(c));
         }
+#if defined(_WIN32) && !defined(OPENSSL_NO_WINSTORE) && \
+    OPENSSL_VERSION_NUMBER >= 0x30200000L /* OpenSSL 3.2 */
+        // Windows has no default CA directory, so also trust its ROOT system store
+        if (!SSL_CTX_load_verify_store(c->ctx, "org.openssl.winstore://")) {
+            av_log(h, AV_LOG_WARNING, "Failure registering the Windows certificate store: %s\n",
+                openssl_get_error(c));
+        }
+#endif
     }

     if (s->cert_file) {