After successful asynchronous certificate validation, file transfer from client to server is not successful.

[madhura5655]

OS: Linux

PFA the output when I try to run. I am currently not implementing mTLS. Only trying to authenticate the client.

• I am using the QUIC_CONNECTION_EVENT_PEER_CERTIFICATE_RECEIVED event to set up a callback for custom certificate validation.
• I return QUIC_STATUS_PENDING from the callback in the QUIC_CONNECTION_EVENT_PEER_CERTIFICATE_RECEIVED event.
• I use MsQuic->ConnectionCertificateValidationComplete to inform MsQuic of the validation result.

> 'MsQuic->ConnectionCertificateValidationComplete(Connection, TRUE, QUIC_TLS_ALERT_CODE_SUCCESS);'

I have also created a structure to hold the validation result, so that a response will be sent back to the main thread to indicate whether the certificate is valid or invalid.
I am using a combination of a condition variable along with a mutex to synchronize the result back to the main thread. This way, the main thread can wait for the validation result and then decide whether to proceed with the file transfer.
But even after doing this, I am facing the same error.

After calling MsQuic->ConnectionCertificateValidationComplete, the server should be ready to accept data from the client but how do I ensure that ? When certificate is valid, how do we resume callbacks to connect ?

[madhura5655]

Currently, the QUIC_CONNECTION_EVENT_CONNECTED event is not being received as the connection is not fully established before the validation completes. Instead of returning QUIC_STATUS_PENDING,I am allowing the connection to proceed without blocking it. The validation still happens in a separate thread, and I handle the result of the validation asynchronously.

[nibanks]

You should return PENDING, as otherwise you're letting data through before you validate. If returning pending and then calling ConnectionCertificateValidationComplete isn't working for you, you'll need to collect the logs to see what's going on.

[madhura5655]

Okay.
"A combination of a condition variable along with a mutex to synchronize the result back to the main thread, so that the main thread can wait for the validation result and then decide whether to proceed with the file transfer"
Will this not work ?

[anrossi]

The error prefix 0xBEBC300 indicates a certificate validation failure.
In addition to the QUIC_CREDENTIAL_FLAG_INDICATE_CERTIFICATE_RECEIVED flag, are you also setting the QUIC_CREDENTIAL_FLAG_NO_CERTIFICATE_VALIDATION or QUIC_CREDENTIAL_FLAG_DEFER_CERTIFICATE_VALIDATION flag? Even with the INDICATE_CERTIFICATE_RECEIVED flag, MsQuic will continue to do the usual certificate validation that the TLS library does, which will override your custom validation and end the handshake before your custom validation can complete.

If you want to rely only on your own custom certificate validation, then you need to set QUIC_CREDENTIAL_FLAG_NO_CERTIFICATE_VALIDATION on your QUIC_CREDENTIAL_CONFIG. If you want MsQuic to do the usual certificate validation, but leave the ultimate decision to you whether to accept/reject the certificate, then you need to set QUIC_CREDENTIAL_FLAG_DEFER_CERTIFICATE_VALIDATION and can read the result of this validation in the DeferredStatus field in the PEER_CERTIFICATE_RECEIVED event.

[madhura5655]

Yes, I had set the QUIC_CREDENTIAL_FLAG_NO_CERTIFICATE_VALIDATION flag.
Actually, the problem all along was that I was freeing the receivedCert in my asynchronous validation function. My bad. It's working fine now after I removed that line. I should not free the receivedCert.
Also removed the structure that I had created containing a condition variable & a mutex as it's redundant now.