Add CA certificate filter to MumbleSSL::addSystemCA() to work around issue 1271.

1 files changed, 24 insertions, 0 deletions

diff --git a/src/SSL.cpp b/src/SSL.cpp
index 2ba3d272d..09b2c27dd 100644
--- a/src/SSL.cpp
+++ b/src/SSL.cpp
@@ -147,4 +147,28 @@ void MumbleSSL::addSystemCA() {
 	// Don't perform on-demand loading of root certificates
 	QSslSocket::addDefaultCaCertificates(QSslSocket::systemCaCertificates());
 #endif
+
+#ifdef Q_OS_WIN
+	// Work around issue #1271.
+	// Skype's click-to-call feature creates an enormous
+	// amount of certificates in the Root CA store.
+	{
+		QSslConfiguration sslCfg = QSslConfiguration::defaultConfiguration();
+		QList<QSslCertificate> caList = sslCfg.caCertificates();
+
+		QList<QSslCertificate> filteredCaList;
+		foreach (QSslCertificate cert, caList) {
+			QString ou = cert.subjectInfo(QSslCertificate::Organization);
+			if (ou.contains(QLatin1String("Skype"), Qt::CaseInsensitive)) {
+				continue;
+			}
+			filteredCaList.append(cert);
+		}
+
+		sslCfg.setCaCertificates(filteredCaList);
+		QSslConfiguration::setDefaultConfiguration(sslCfg);
+
+		qWarning("SSL: CA certificate filter applied. Filtered size: %i, original size: %i", filteredCaList.size(), caList.size());
+	}
+#endif
 }