Implement complete server certificate verification

src/Cedar/Admin.c

@@ -7350,6 +7350,7 @@ UINT StGetLink(ADMIN *a, RPC_CREATE_LINK *t)
 		Copy(&t->Policy, k->Policy, sizeof(POLICY));
 
 		t->CheckServerCert = k->CheckServerCert;
+		t->AddDefaultCA = k->AddDefaultCA;
 		t->ServerCert = CloneX(k->ServerCert);
 	}
 	Unlock(k->lock);
@@ -7465,6 +7466,7 @@ UINT StSetLink(ADMIN *a, RPC_CREATE_LINK *t)
 		k->Option->RequireMonitorMode = false;	// Disable monitor mode
 
 		k->CheckServerCert = t->CheckServerCert;
+		k->AddDefaultCA = t->AddDefaultCA;
 		k->ServerCert = CloneX(t->ServerCert);
 	}
 	Unlock(k->lock);
@@ -7561,6 +7563,7 @@ UINT StCreateLink(ADMIN *a, RPC_CREATE_LINK *t)
 		// setting of verifying server certification
 		// 
 		k->CheckServerCert = t->CheckServerCert;
+		k->AddDefaultCA = t->AddDefaultCA;
 		k->ServerCert = CloneX(t->ServerCert);
 
 		// stay this off-line
@@ -13635,6 +13638,7 @@ void InRpcCreateLink(RPC_CREATE_LINK *t, PACK *p)
 	InRpcPolicy(&t->Policy, p);
 
 	t->CheckServerCert = PackGetBool(p, "CheckServerCert");
+	t->AddDefaultCA = PackGetBool(p, "AddDefaultCA");
 	b = PackGetBuf(p, "ServerCert");
 	if (b != NULL)
 	{
@@ -13657,6 +13661,7 @@ void OutRpcCreateLink(PACK *p, RPC_CREATE_LINK *t)
 	OutRpcPolicy(p, &t->Policy);
 
 	PackAddBool(p, "CheckServerCert", t->CheckServerCert);
+	PackAddBool(p, "AddDefaultCA", t->AddDefaultCA);
 	if (t->ServerCert != NULL)
 	{
 		BUF *b;

src/Cedar/Admin.h

@@ -436,6 +436,7 @@ struct RPC_CREATE_LINK
 	CLIENT_AUTH *ClientAuth;			// Client authentication data
 	POLICY Policy;						// Policy
 	bool CheckServerCert;				// Validate the server certificate
+	bool AddDefaultCA;					// Use default trust store
 	X *ServerCert;						// Server certificate
 };
 

src/Cedar/CM.c

@@ -6022,6 +6022,7 @@ void CmExportAccount(HWND hWnd, wchar_t *account_name)
 		t.StartupAccount = a->Startup;
 		t.CheckServerCert = a->CheckServerCert;
 		t.RetryOnServerCert = a->RetryOnServerCert;
+		t.AddDefaultCA = a->AddDefaultCA;
 		t.ServerCert = a->ServerCert;
 		t.ClientOption->FromAdminPack = false;
 
@@ -6161,6 +6162,7 @@ void CmImportAccountMainEx(HWND hWnd, wchar_t *filename, bool overwrite)
 					t->StartupAccount = get.StartupAccount;
 					t->CheckServerCert = get.CheckServerCert;
 					t->RetryOnServerCert = get.RetryOnServerCert;
+					t->AddDefaultCA = get.AddDefaultCA;
 					if (t->ServerCert != NULL)
 					{
 						FreeX(t->ServerCert);
@@ -6270,6 +6272,7 @@ void CmCopyAccount(HWND hWnd, wchar_t *account_name)
 	}
 	c.CheckServerCert = a->CheckServerCert;
 	c.RetryOnServerCert = a->RetryOnServerCert;
+	c.AddDefaultCA = a->AddDefaultCA;
 	c.StartupAccount = false;		// Don't copy the startup attribute
 
 	CALL(hWnd, CcCreateAccount(cm->Client, &c));
@@ -6686,9 +6689,13 @@ void CmEditAccountDlgUpdate(HWND hWnd, CM_ACCOUNT *a)
 	// To validate the server certificate
 	a->CheckServerCert = IsChecked(hWnd, R_CHECK_CERT);
 
+	// Trust default CA list
+	a->AddDefaultCA = IsChecked(hWnd, R_TRUST_DEFAULT);
+
 	if (a->NatMode)
 	{
 		Disable(hWnd, R_CHECK_CERT);
+		Disable(hWnd, R_TRUST_DEFAULT);
 		Disable(hWnd, B_TRUST);
 	}
 
@@ -7031,6 +7038,7 @@ void CmEditAccountDlgUpdate(HWND hWnd, CM_ACCOUNT *a)
 		SetEnable(hWnd, S_STATIC7, false);
 		SetEnable(hWnd, S_STATIC11, false);
 		SetEnable(hWnd, R_CHECK_CERT, false);
+		SetEnable(hWnd, R_TRUST_DEFAULT, false);
 		SetEnable(hWnd, B_TRUST, false);
 		SetEnable(hWnd, B_SERVER_CERT, false);
 		SetEnable(hWnd, B_VIEW_SERVER_CERT, false);
@@ -7132,6 +7140,9 @@ void CmEditAccountDlgInit(HWND hWnd, CM_ACCOUNT *a)
 	// Verify the server certificate
 	Check(hWnd, R_CHECK_CERT, a->CheckServerCert);
 
+	// Trust default CA list
+	Check(hWnd, R_TRUST_DEFAULT, a->AddDefaultCA);
+
 	// LAN card list
 	if (a->NatMode == false && a->LinkMode == false)
 	{
@@ -7364,6 +7375,7 @@ UINT CmEditAccountDlgProc(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam, voi
 		case R_HTTPS:
 		case R_SOCKS:
 		case R_CHECK_CERT:
+		case R_TRUST_DEFAULT:
 		case C_TYPE:
 		case E_USERNAME:
 		case E_PASSWORD:
@@ -8770,6 +8782,7 @@ void CmEditAccountDlgOnOk(HWND hWnd, CM_ACCOUNT *a)
 		Copy(c.ClientOption, a->ClientOption, sizeof(CLIENT_OPTION));
 		c.ClientAuth = CopyClientAuth(a->ClientAuth);
 		c.CheckServerCert = a->CheckServerCert;
+		c.AddDefaultCA = a->AddDefaultCA;
 		if (a->ServerCert != NULL)
 		{
 			c.ServerCert = CloneX(a->ServerCert);
@@ -8823,6 +8836,7 @@ void CmEditAccountDlgOnOk(HWND hWnd, CM_ACCOUNT *a)
 			Copy(t.ClientOption, a->ClientOption, sizeof(CLIENT_OPTION));
 			t.ClientAuth = CopyClientAuth(a->ClientAuth);
 			t.CheckServerCert = a->CheckServerCert;
+			t.AddDefaultCA = a->AddDefaultCA;
 			t.ServerCert = CloneX(a->ServerCert);
 
 			// Save the settings for cascade connection
@@ -9015,6 +9029,7 @@ CM_ACCOUNT *CmGetExistAccountObject(HWND hWnd, wchar_t *account_name)
 	a->EditMode = true;
 	a->CheckServerCert = c.CheckServerCert;
 	a->RetryOnServerCert = c.RetryOnServerCert;
+	a->AddDefaultCA = c.AddDefaultCA;
 	a->Startup = c.StartupAccount;
 	if (c.ServerCert != NULL)
 	{
@@ -9045,6 +9060,7 @@ CM_ACCOUNT *CmCreateNewAccountObject(HWND hWnd)
 	a->EditMode = false;
 	a->CheckServerCert = false;
 	a->RetryOnServerCert = false;
+	a->AddDefaultCA = false;
 	a->Startup = false;
 	a->ClientOption = ZeroMalloc(sizeof(CLIENT_OPTION));
 

src/Cedar/CMInner.h

@@ -140,6 +140,7 @@ typedef struct CM_ACCOUNT
 	bool Startup;						// Startup account
 	bool CheckServerCert;				// Check the server certificate
 	bool RetryOnServerCert;				// Retry on invalid server certificate
+	bool AddDefaultCA;					// Use default trust store
 	X *ServerCert;						// Server certificate
 	char old_server_name[MAX_HOST_NAME_LEN + 1];	// Old server name
 	bool Inited;						// Initialization flag

src/Cedar/Cedar.h

@@ -869,6 +869,7 @@
 #define	ERR_VPNGATE_INCLIENT_CANT_STOP	146	// Can not be stopped if operating within VPN Client mode
 #define	ERR_NOT_SUPPORTED_FUNCTION_ON_OPENSOURCE	147	// It is a feature that is not supported in the open source version
 #define	ERR_SUSPENDING					148	// System is suspending
+#define ERR_HOSTNAME_MISMATCH			149	// SSL hostname mismatch
 
 
 ////////////////////////////

src/Cedar/Client.c

@@ -1957,6 +1957,7 @@ RPC_CLIENT_CREATE_ACCOUNT *CiCfgToAccount(BUF *b)
 	t->StartupAccount = a->StartupAccount;
 	t->CheckServerCert = a->CheckServerCert;
 	t->RetryOnServerCert = a->RetryOnServerCert;
+	t->AddDefaultCA = a->AddDefaultCA;
 	t->ServerCert = a->ServerCert;
 	Free(a);
 
@@ -1981,6 +1982,7 @@ BUF *CiAccountToCfg(RPC_CLIENT_CREATE_ACCOUNT *t)
 	a.ClientAuth = t->ClientAuth;
 	a.CheckServerCert = t->CheckServerCert;
 	a.RetryOnServerCert = t->RetryOnServerCert;
+	a.AddDefaultCA = t->AddDefaultCA;
 	a.ServerCert = t->ServerCert;
 	a.StartupAccount = t->StartupAccount;
 
@@ -4542,6 +4544,7 @@ void InRpcClientCreateAccount(RPC_CLIENT_CREATE_ACCOUNT *c, PACK *p)
 	c->StartupAccount = PackGetInt(p, "StartupAccount") ? true : false;
 	c->CheckServerCert = PackGetInt(p, "CheckServerCert") ? true : false;
 	c->RetryOnServerCert = PackGetInt(p, "RetryOnServerCert") ? true : false;
+	c->AddDefaultCA = PackGetInt(p, "AddDefaultCA") ? true : false;
 	b = PackGetBuf(p, "ServerCert");
 	if (b != NULL)
 	{
@@ -4565,6 +4568,7 @@ void OutRpcClientCreateAccount(PACK *p, RPC_CLIENT_CREATE_ACCOUNT *c)
 	PackAddInt(p, "StartupAccount", c->StartupAccount);
 	PackAddInt(p, "CheckServerCert", c->CheckServerCert);
 	PackAddInt(p, "RetryOnServerCert", c->RetryOnServerCert);
+	PackAddInt(p, "AddDefaultCA", c->AddDefaultCA);
 	if (c->ServerCert != NULL)
 	{
 		b = XToBuf(c->ServerCert, false);
@@ -4715,6 +4719,7 @@ void InRpcClientGetAccount(RPC_CLIENT_GET_ACCOUNT *c, PACK *p)
 	c->StartupAccount = PackGetInt(p, "StartupAccount") ? true : false;
 	c->CheckServerCert = PackGetInt(p, "CheckServerCert") ? true : false;
 	c->RetryOnServerCert = PackGetInt(p, "RetryOnServerCert") ? true : false;
+	c->AddDefaultCA = PackGetInt(p, "AddDefaultCA") ? true : false;
 	b = PackGetBuf(p, "ServerCert");
 	if (b != NULL)
 	{
@@ -4744,6 +4749,7 @@ void OutRpcClientGetAccount(PACK *p, RPC_CLIENT_GET_ACCOUNT *c)
 	PackAddInt(p, "StartupAccount", c->StartupAccount);
 	PackAddInt(p, "CheckServerCert", c->CheckServerCert);
 	PackAddInt(p, "RetryOnServerCert", c->RetryOnServerCert);
+	PackAddInt(p, "AddDefaultCA", c->AddDefaultCA);
 
 	if (c->ServerCert != NULL)
 	{
@@ -6467,9 +6473,9 @@ bool CtConnect(CLIENT *c, RPC_CLIENT_CONNECT *connect)
 						// Register a procedure for secure device authentication
 						r->ClientAuth->SecureSignProc = CiSecureSignProc;
 					}
-          else if (r->ClientAuth->AuthType == CLIENT_AUTHTYPE_OPENSSLENGINE)
+					else if (r->ClientAuth->AuthType == CLIENT_AUTHTYPE_OPENSSLENGINE)
 					{
-              /* r->ClientAuth->ClientK = OpensslEngineToK("asdf"); */
+						/* r->ClientAuth->ClientK = OpensslEngineToK("asdf"); */
 						r->ClientAuth->SecureSignProc = NULL;
 					}
 					else
@@ -6639,6 +6645,7 @@ bool CtGetAccount(CLIENT *c, RPC_CLIENT_GET_ACCOUNT *a)
 
 			a->CheckServerCert = r->CheckServerCert;
 			a->RetryOnServerCert = r->RetryOnServerCert;
+			a->AddDefaultCA = r->AddDefaultCA;
 			a->ServerCert = NULL;
 			if (r->ServerCert != NULL)
 			{
@@ -7173,6 +7180,7 @@ bool CtSetAccount(CLIENT *c, RPC_CLIENT_CREATE_ACCOUNT *a, bool inner)
 
 			ret->CheckServerCert = a->CheckServerCert;
 			ret->RetryOnServerCert = a->RetryOnServerCert;
+			ret->AddDefaultCA = a->AddDefaultCA;
 
 			if (a->ServerCert != NULL)
 			{
@@ -7272,6 +7280,7 @@ bool CtCreateAccount(CLIENT *c, RPC_CLIENT_CREATE_ACCOUNT *a, bool inner)
 
 		new_account->CheckServerCert = a->CheckServerCert;
 		new_account->RetryOnServerCert = a->RetryOnServerCert;
+		new_account->AddDefaultCA = a->AddDefaultCA;
 		if (a->ServerCert != NULL)
 		{
 			new_account->ServerCert = CloneX(a->ServerCert);
@@ -9336,6 +9345,7 @@ ACCOUNT *CiLoadClientAccount(FOLDER *f)
 	a->StartupAccount = CfgGetBool(f, "StartupAccount");
 	a->CheckServerCert = CfgGetBool(f, "CheckServerCert");
 	a->RetryOnServerCert = CfgGetBool(f, "RetryOnServerCert");
+	a->AddDefaultCA = CfgGetBool(f, "AddDefaultCA");
 	a->CreateDateTime = CfgGetInt64(f, "CreateDateTime");
 	a->UpdateDateTime = CfgGetInt64(f, "UpdateDateTime");
 	a->LastConnectDateTime = CfgGetInt64(f, "LastConnectDateTime");
@@ -9974,6 +9984,9 @@ void CiWriteAccountData(FOLDER *f, ACCOUNT *a)
 	// Retry on invalid server certificate flag
 	CfgAddBool(f, "RetryOnServerCert", a->RetryOnServerCert);
 
+	// Add default SSL trust store
+	CfgAddBool(f, "AddDefaultCA", a->AddDefaultCA);
+
 	// Date and time
 	CfgAddInt64(f, "CreateDateTime", a->CreateDateTime);
 	CfgAddInt64(f, "UpdateDateTime", a->UpdateDateTime);

src/Cedar/Client.h

@@ -61,6 +61,7 @@ struct ACCOUNT
 	CLIENT_AUTH *ClientAuth;				// Client authentication data
 	bool CheckServerCert;					// Check the server certificate
 	bool RetryOnServerCert;					// Retry on invalid server certificate
+	bool AddDefaultCA;						// Use default trust store
 	X *ServerCert;							// Server certificate
 	bool StartupAccount;					// Start-up account
 	UCHAR ShortcutKey[SHA1_SIZE];			// Key
@@ -239,6 +240,7 @@ struct RPC_CLIENT_CREATE_ACCOUNT
 	bool StartupAccount;					// Startup account
 	bool CheckServerCert;					// Checking of the server certificate
 	bool RetryOnServerCert;					// Retry on invalid server certificate
+	bool AddDefaultCA;						// Use default trust store
 	X *ServerCert;							// Server certificate
 	UCHAR ShortcutKey[SHA1_SIZE];			// Shortcut Key
 };
@@ -292,6 +294,7 @@ struct RPC_CLIENT_GET_ACCOUNT
 	bool StartupAccount;					// Startup account
 	bool CheckServerCert;					// Check the server certificate
 	bool RetryOnServerCert;					// Retry on invalid server certificate
+	bool AddDefaultCA;						// Use default trust store
 	X *ServerCert;							// Server certificate
 	UCHAR ShortcutKey[SHA1_SIZE];			// Shortcut Key
 	UINT64 CreateDateTime;					// Creation date and time (Ver 3.0 or later)

src/Cedar/Command.c

@@ -3109,6 +3109,8 @@ void PcMain(PC *pc)
 			{"AccountServerCertDisable", PcAccountServerCertDisable},
 			{"AccountRetryOnServerCertEnable", PcAccountRetryOnServerCertEnable},
 			{"AccountRetryOnServerCertDisable", PcAccountRetryOnServerCertDisable},
+			{"AccountDefaultCAEnable", PcAccountDefaultCAEnable},
+			{"AccountDefaultCADisable", PcAccountDefaultCADisable},
 			{"AccountServerCertSet", PcAccountServerCertSet},
 			{"AccountServerCertDelete", PcAccountServerCertDelete},
 			{"AccountServerCertGet", PcAccountServerCertGet},
@@ -4293,6 +4295,26 @@ UINT PcAccountCreate(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 	return ret;
 }
 
+// Setup a RPC_CLIENT_CREATE_ACCOUNT from a RPC_CLIENT_GET_ACCOUNT
+void SetRpcClientCreateAccountFromGetAccount(RPC_CLIENT_CREATE_ACCOUNT *c, RPC_CLIENT_GET_ACCOUNT *t)
+{
+	if (c == NULL || t == NULL)
+	{
+		return;
+	}
+
+	Zero(c, sizeof(RPC_CLIENT_CREATE_ACCOUNT));
+
+	// Copy reference
+	c->ClientAuth = t->ClientAuth;
+	c->ClientOption = t->ClientOption;
+	c->CheckServerCert = t->CheckServerCert;
+	c->RetryOnServerCert = t->RetryOnServerCert;
+	c->AddDefaultCA = t->AddDefaultCA;
+	c->ServerCert = t->ServerCert;
+	c->StartupAccount = t->StartupAccount;
+}
+
 // Set the destination of the connection settings
 UINT PcAccountSet(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 {
@@ -4336,14 +4358,7 @@ UINT PcAccountSet(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 		t.ClientOption->HintStr[0] = 0;
 		StrCpy(t.ClientOption->HubName, sizeof(t.ClientOption->HubName), GetParamStr(o, "HUB"));
 
-		Zero(&c, sizeof(c));
-
-		c.ClientAuth = t.ClientAuth;
-		c.ClientOption = t.ClientOption;
-		c.CheckServerCert = t.CheckServerCert;
-		c.RetryOnServerCert = t.RetryOnServerCert;
-		c.ServerCert = t.ServerCert;
-		c.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&c, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &c);
 	}
@@ -4456,6 +4471,8 @@ UINT PcAccountGet(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 		{
 			CtInsert(ct, _UU("CMD_ACCOUNT_COLUMN_RETRY_ON_SERVER_CERT"),
 				t.RetryOnServerCert ? _UU("CMD_MSG_ENABLE") : _UU("CMD_MSG_DISABLE"));
+			CtInsert(ct, _UU("CMD_ACCOUNT_COLUMN_ADD_DEFAULT_CA"),
+				t.AddDefaultCA ? _UU("CMD_MSG_ENABLE") : _UU("CMD_MSG_DISABLE"));
 		}
 
 		// Device name to be used for the connection
@@ -4630,13 +4647,7 @@ UINT PcAccountUsernameSet(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 			c->Write(c, _UU("CMD_AccountUsername_Notice"));
 		}
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -4688,13 +4699,7 @@ UINT PcAccountAnonymousSet(CONSOLE *c, char *cmd_name, wchar_t *str, void *param
 		// Change the settings
 		t.ClientAuth->AuthType = CLIENT_AUTHTYPE_ANONYMOUS;
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -4770,13 +4775,7 @@ UINT PcAccountPasswordSet(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 
 		if (ret == ERR_NO_ERROR)
 		{
-			Zero(&z, sizeof(z));
-			z.CheckServerCert = t.CheckServerCert;
-			z.RetryOnServerCert = t.RetryOnServerCert;
-			z.ClientAuth = t.ClientAuth;
-			z.ClientOption = t.ClientOption;
-			z.ServerCert = t.ServerCert;
-			z.StartupAccount = t.StartupAccount;
+			SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 			ret = CcSetAccount(pc->RemoteClient, &z);
 		}
@@ -4849,13 +4848,7 @@ UINT PcAccountCertSet(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 		t.ClientAuth->ClientX = CloneX(x);
 		t.ClientAuth->ClientK = CloneK(k);
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -4970,13 +4963,7 @@ UINT PcAccountEncryptDisable(CONSOLE *c, char *cmd_name, wchar_t *str, void *par
 		// Change the settings
 		t.ClientOption->UseEncrypt = false;
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -5028,13 +5015,7 @@ UINT PcAccountEncryptEnable(CONSOLE *c, char *cmd_name, wchar_t *str, void *para
 		// Change the settings
 		t.ClientOption->UseEncrypt = true;
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -5086,13 +5067,7 @@ UINT PcAccountCompressEnable(CONSOLE *c, char *cmd_name, wchar_t *str, void *par
 		// Change the settings
 		t.ClientOption->UseCompress = true;
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -5144,13 +5119,7 @@ UINT PcAccountCompressDisable(CONSOLE *c, char *cmd_name, wchar_t *str, void *pa
 		// Change the settings
 		t.ClientOption->UseCompress = false;
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -5225,13 +5194,7 @@ UINT PcAccountHttpHeaderAdd(CONSOLE *c, char *cmd_name, wchar_t *str, void *para
 			if ((StrLen(s) + StrLen(t.ClientOption->CustomHttpHeader)) < sizeof(t.ClientOption->CustomHttpHeader)) {
 				StrCat(t.ClientOption->CustomHttpHeader, sizeof(s), s);
 
-				Zero(&z, sizeof(z));
-				z.CheckServerCert = t.CheckServerCert;
-				z.RetryOnServerCert = t.RetryOnServerCert;
-				z.ClientAuth = t.ClientAuth;
-				z.ClientOption = t.ClientOption;
-				z.ServerCert = t.ServerCert;
-				z.StartupAccount = t.StartupAccount;
+				SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 				ret = CcSetAccount(pc->RemoteClient, &z);
 			}
@@ -5296,13 +5259,7 @@ UINT PcAccountHttpHeaderDelete(CONSOLE *c, char *cmd_name, wchar_t *str, void *p
 		RPC_CLIENT_CREATE_ACCOUNT z;
 		char *value = GetParamStr(o, "NAME");
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		Zero(z.ClientOption->CustomHttpHeader, sizeof(z.ClientOption->CustomHttpHeader));
 
@@ -5422,13 +5379,7 @@ UINT PcAccountProxyNone(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 		// Change the settings
 		t.ClientOption->ProxyType = PROXY_DIRECT;
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -5494,13 +5445,7 @@ UINT PcAccountProxyHttp(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 			Free(host);
 		}
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -5566,13 +5511,7 @@ UINT PcAccountProxySocks(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 			Free(host);
 		}
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -5638,13 +5577,7 @@ UINT PcAccountProxySocks5(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 			Free(host);
 		}
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -5696,13 +5629,7 @@ UINT PcAccountServerCertEnable(CONSOLE *c, char *cmd_name, wchar_t *str, void *p
 		// Change the settings
 		t.CheckServerCert = true;
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -5754,13 +5681,7 @@ UINT PcAccountServerCertDisable(CONSOLE *c, char *cmd_name, wchar_t *str, void *
 		// Change the settings
 		t.CheckServerCert = false;
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -5812,13 +5733,7 @@ UINT PcAccountRetryOnServerCertEnable(CONSOLE *c, char *cmd_name, wchar_t *str,
 		// Change the settings
 		t.RetryOnServerCert = true;
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -5870,13 +5785,111 @@ UINT PcAccountRetryOnServerCertDisable(CONSOLE *c, char *cmd_name, wchar_t *str,
 		// Change the settings
 		t.RetryOnServerCert = false;
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
+
+		ret = CcSetAccount(pc->RemoteClient, &z);
+	}
+
+	if (ret != ERR_NO_ERROR)
+	{
+		// Error has occurred
+		CmdPrintError(c, ret);
+	}
+
+	CiFreeClientGetAccount(&t);
+
+	// Release of the parameter list
+	FreeParamValueList(o);
+
+	return ret;
+}
+
+// Enable trusting default CA list
+UINT PcAccountDefaultCAEnable(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
+{
+	LIST *o;
+	PC *pc = (PC *)param;
+	UINT ret = ERR_NO_ERROR;
+	RPC_CLIENT_GET_ACCOUNT t;
+	// Parameter list that can be specified
+	PARAM args[] =
+	{
+		{"[name]", CmdPrompt, _UU("CMD_AccountCreate_Prompt_Name"), CmdEvalNotEmpty, NULL},
+	};
+
+	// Get the parameter list
+	o = ParseCommandList(c, cmd_name, str, args, sizeof(args) / sizeof(args[0]));
+	if (o == NULL)
+	{
+		return ERR_INVALID_PARAMETER;
+	}
+
+	// RPC call
+	Zero(&t, sizeof(t));
+
+	UniStrCpy(t.AccountName, sizeof(t.AccountName), GetParamUniStr(o, "[name]"));
+
+	ret = CcGetAccount(pc->RemoteClient, &t);
+
+	if (ret == ERR_NO_ERROR)
+	{
+		RPC_CLIENT_CREATE_ACCOUNT z;
+		// Change the settings
+		t.AddDefaultCA = true;
+
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
+
+		ret = CcSetAccount(pc->RemoteClient, &z);
+	}
+
+	if (ret != ERR_NO_ERROR)
+	{
+		// Error has occurred
+		CmdPrintError(c, ret);
+	}
+
+	CiFreeClientGetAccount(&t);
+
+	// Release of the parameter list
+	FreeParamValueList(o);
+
+	return ret;
+}
+
+// Disable trusting default CA list
+UINT PcAccountDefaultCADisable(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
+{
+	LIST *o;
+	PC *pc = (PC *)param;
+	UINT ret = ERR_NO_ERROR;
+	RPC_CLIENT_GET_ACCOUNT t;
+	// Parameter list that can be specified
+	PARAM args[] =
+	{
+		{"[name]", CmdPrompt, _UU("CMD_AccountCreate_Prompt_Name"), CmdEvalNotEmpty, NULL},
+	};
+
+	// Get the parameter list
+	o = ParseCommandList(c, cmd_name, str, args, sizeof(args) / sizeof(args[0]));
+	if (o == NULL)
+	{
+		return ERR_INVALID_PARAMETER;
+	}
+
+	// RPC call
+	Zero(&t, sizeof(t));
+
+	UniStrCpy(t.AccountName, sizeof(t.AccountName), GetParamUniStr(o, "[name]"));
+
+	ret = CcGetAccount(pc->RemoteClient, &t);
+
+	if (ret == ERR_NO_ERROR)
+	{
+		RPC_CLIENT_CREATE_ACCOUNT z;
+		// Change the settings
+		t.AddDefaultCA = false;
+
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -5942,13 +5955,7 @@ UINT PcAccountServerCertSet(CONSOLE *c, char *cmd_name, wchar_t *str, void *para
 		}
 		t.ServerCert = CloneX(x);
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -6006,13 +6013,7 @@ UINT PcAccountServerCertDelete(CONSOLE *c, char *cmd_name, wchar_t *str, void *p
 		}
 		t.ServerCert = NULL;
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -6061,23 +6062,20 @@ UINT PcAccountServerCertGet(CONSOLE *c, char *cmd_name, wchar_t *str, void *para
 
 	if (ret == ERR_NO_ERROR)
 	{
-		RPC_CLIENT_CREATE_ACCOUNT z;
-		// Change the settings
-		if (t.ServerCert != NULL)
+		// Save the certificate
+		if (t.ServerCert == NULL)
 		{
-			FreeX(t.ServerCert);
+			c->Write(c, _UU("CMD_CERT_NOT_EXISTS"));
+			ret = ERR_INTERNAL_ERROR;
+		}
+		else
+		{
+			if (XToFileW(t.ServerCert, GetParamUniStr(o, "SAVECERT"), true) == false)
+			{
+				c->Write(c, _UU("CMD_SAVECERT_FAILED"));
+				ret = ERR_INTERNAL_ERROR;
+			}
 		}
-		t.ServerCert = NULL;
-
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
-
-		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
 
 	if (ret != ERR_NO_ERROR)
@@ -6152,12 +6150,7 @@ UINT PcAccountDetailSet(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 		t.ClientOption->DisableQoS = GetParamYes(o, "NOQOS");
 		t.ClientOption->NoUdpAcceleration = GetParamYes(o, "DISABLEUDP");
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -6400,14 +6393,7 @@ UINT PcAccountNicSet(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 		StrCpy(t.ClientOption->DeviceName, sizeof(t.ClientOption->DeviceName),
 			GetParamStr(o, "NICNAME"));
 
-		Zero(&c, sizeof(c));
-
-		c.ClientAuth = t.ClientAuth;
-		c.ClientOption = t.ClientOption;
-		c.CheckServerCert = t.CheckServerCert;
-		c.RetryOnServerCert = t.RetryOnServerCert;
-		c.ServerCert = t.ServerCert;
-		c.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&c, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &c);
 	}
@@ -6459,13 +6445,7 @@ UINT PcAccountStatusShow(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 		// Change the settings
 		t.ClientOption->HideStatusWindow = false;
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -6517,13 +6497,7 @@ UINT PcAccountStatusHide(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 		// Change the settings
 		t.ClientOption->HideStatusWindow = true;
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -6581,13 +6555,7 @@ UINT PcAccountSecureCertSet(CONSOLE *c, char *cmd_name, wchar_t *str, void *para
 		StrCpy(t.ClientAuth->SecurePrivateKeyName, sizeof(t.ClientAuth->SecurePrivateKeyName),
 			GetParamStr(o, "KEYNAME"));
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -6639,24 +6607,19 @@ UINT PcAccountOpensslEngineCertSet(CONSOLE *c, char *cmd_name, wchar_t *str, voi
 	{
 		RPC_CLIENT_CREATE_ACCOUNT z;
 		t.ClientAuth->AuthType = CLIENT_AUTHTYPE_OPENSSLENGINE;
-    X *x;
-	  x = FileToXW(GetParamUniStr(o, "LOADCERT"));
-    if (x == NULL)
-    {
+		X *x;
+		x = FileToXW(GetParamUniStr(o, "LOADCERT"));
+		if (x == NULL)
+		{
 			c->Write(c, _UU("CMD_LOADCERT_FAILED"));
-    }
+		}
 		StrCpy(t.ClientAuth->OpensslEnginePrivateKeyName, sizeof(t.ClientAuth->OpensslEnginePrivateKeyName),
 					 GetParamStr(o, "KEYNAME"));
 		StrCpy(t.ClientAuth->OpensslEngineName, sizeof(t.ClientAuth->OpensslEngineName),
 					 GetParamStr(o, "ENGINENAME"));
 		t.ClientAuth->ClientX = CloneX(x);
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -6721,13 +6684,7 @@ UINT PcAccountRetrySet(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 		t.ClientOption->NumRetry = (num == 999) ? INFINITE : num;
 		t.ClientOption->RetryInterval = interval;
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -6780,13 +6737,7 @@ UINT PcAccountStartupSet(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 		// Change the settings
 		t.StartupAccount = true;
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -6838,13 +6789,7 @@ UINT PcAccountStartupRemove(CONSOLE *c, char *cmd_name, wchar_t *str, void *para
 		// Change the settings
 		t.StartupAccount = false;
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.RetryOnServerCert = t.RetryOnServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		ret = CcSetAccount(pc->RemoteClient, &z);
 	}
@@ -6901,12 +6846,7 @@ UINT PcAccountExport(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 		UINT buf_size;
 		UCHAR bom[] = {0xef, 0xbb, 0xbf, };
 
-		Zero(&z, sizeof(z));
-		z.CheckServerCert = t.CheckServerCert;
-		z.ClientAuth = t.ClientAuth;
-		z.ClientOption = t.ClientOption;
-		z.ServerCert = t.ServerCert;
-		z.StartupAccount = t.StartupAccount;
+		SetRpcClientCreateAccountFromGetAccount(&z, &t);
 
 		b = CiAccountToCfg(&z);
 
@@ -7710,6 +7650,8 @@ void PsMain(PS *ps)
 			{"CascadeProxySocks5", PsCascadeProxySocks5},
 			{"CascadeServerCertEnable", PsCascadeServerCertEnable},
 			{"CascadeServerCertDisable", PsCascadeServerCertDisable},
+			{"CascadeDefaultCAEnable", PsCascadeDefaultCAEnable},
+			{"CascadeDefaultCADisable", PsCascadeDefaultCADisable},
 			{"CascadeServerCertSet", PsCascadeServerCertSet},
 			{"CascadeServerCertDelete", PsCascadeServerCertDelete},
 			{"CascadeServerCertGet", PsCascadeServerCertGet},
@@ -13287,6 +13229,12 @@ UINT PsCascadeGet(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 			CtInsert(ct, _UU("CMD_ACCOUNT_COLUMN_SERVER_CERT_NAME"), tmp);
 		}
 
+		if (t.CheckServerCert)
+		{
+			CtInsert(ct, _UU("CMD_ACCOUNT_COLUMN_ADD_DEFAULT_CA"),
+				t.AddDefaultCA ? _UU("CMD_MSG_ENABLE") : _UU("CMD_MSG_DISABLE"));
+		}
+
 		// Device name to be used for the connection
 		StrToUni(tmp, sizeof(tmp), t.ClientOption->DeviceName);
 		CtInsert(ct, _UU("CMD_ACCOUNT_COLUMN_DEVICE_NAME"), tmp);
@@ -14705,6 +14653,134 @@ UINT PsCascadeServerCertDisable(CONSOLE *c, char *cmd_name, wchar_t *str, void *
 	return 0;
 }
 
+// Enable trusting default CA list for cascade connection
+UINT PsCascadeDefaultCAEnable(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
+{
+	LIST *o;
+	PS *ps = (PS *)param;
+	UINT ret = 0;
+	RPC_CREATE_LINK t;
+	// Parameter list that can be specified
+	PARAM args[] =
+	{
+		// "name", prompt_proc, prompt_param, eval_proc, eval_param
+		{"[name]", CmdPrompt, _UU("CMD_CascadeCreate_Prompt_Name"), CmdEvalNotEmpty, NULL},
+	};
+	
+	// If virtual HUB is not selected, it's an error
+	if (ps->HubName == NULL)
+	{
+		c->Write(c, _UU("CMD_Hub_Not_Selected"));
+		return ERR_INVALID_PARAMETER;
+	}
+
+	o = ParseCommandList(c, cmd_name, str, args, sizeof(args) / sizeof(args[0]));
+	if (o == NULL)
+	{
+		return ERR_INVALID_PARAMETER;
+	}
+
+	Zero(&t, sizeof(t));
+	StrCpy(t.HubName, sizeof(t.HubName), ps->HubName);
+	t.ClientOption = ZeroMalloc(sizeof(CLIENT_OPTION));
+	UniStrCpy(t.ClientOption->AccountName, sizeof(t.ClientOption->AccountName), GetParamUniStr(o, "[name]"));
+
+	// RPC call
+	ret = ScGetLink(ps->Rpc, &t);
+
+	if (ret != ERR_NO_ERROR)
+	{
+		// An error has occured
+		CmdPrintError(c, ret);
+		FreeParamValueList(o);
+		return ret;
+	}
+	else
+	{
+		// Data change
+		t.AddDefaultCA = true;
+
+		ret = ScSetLink(ps->Rpc, &t);
+		if (ret != ERR_NO_ERROR)
+		{
+			// An error has occured
+			CmdPrintError(c, ret);
+			FreeParamValueList(o);
+			return ret;
+		}
+
+		FreeRpcCreateLink(&t);
+	}
+
+	FreeParamValueList(o);
+
+	return 0;
+}
+
+// Disable trusting default CA list for cascade connection
+UINT PsCascadeDefaultCADisable(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
+{
+	LIST *o;
+	PS *ps = (PS *)param;
+	UINT ret = 0;
+	RPC_CREATE_LINK t;
+	// Parameter list that can be specified
+	PARAM args[] =
+	{
+		// "name", prompt_proc, prompt_param, eval_proc, eval_param
+		{"[name]", CmdPrompt, _UU("CMD_CascadeCreate_Prompt_Name"), CmdEvalNotEmpty, NULL},
+	};
+	
+	// If virtual HUB is not selected, it's an error
+	if (ps->HubName == NULL)
+	{
+		c->Write(c, _UU("CMD_Hub_Not_Selected"));
+		return ERR_INVALID_PARAMETER;
+	}
+
+	o = ParseCommandList(c, cmd_name, str, args, sizeof(args) / sizeof(args[0]));
+	if (o == NULL)
+	{
+		return ERR_INVALID_PARAMETER;
+	}
+
+	Zero(&t, sizeof(t));
+	StrCpy(t.HubName, sizeof(t.HubName), ps->HubName);
+	t.ClientOption = ZeroMalloc(sizeof(CLIENT_OPTION));
+	UniStrCpy(t.ClientOption->AccountName, sizeof(t.ClientOption->AccountName), GetParamUniStr(o, "[name]"));
+
+	// RPC call
+	ret = ScGetLink(ps->Rpc, &t);
+
+	if (ret != ERR_NO_ERROR)
+	{
+		// An error has occured
+		CmdPrintError(c, ret);
+		FreeParamValueList(o);
+		return ret;
+	}
+	else
+	{
+		// Data change
+		t.AddDefaultCA = false;
+
+		ret = ScSetLink(ps->Rpc, &t);
+		if (ret != ERR_NO_ERROR)
+		{
+			// An error has occured
+			CmdPrintError(c, ret);
+			FreeParamValueList(o);
+			return ret;
+		}
+
+		FreeRpcCreateLink(&t);
+	}
+
+	FreeParamValueList(o);
+
+	return 0;
+}
+
 // Server-specific certificate settings of cascade connection
 UINT PsCascadeServerCertSet(CONSOLE *c, char *cmd_name, wchar_t *str, void *param)
 {

src/Cedar/Command.h

@@ -342,6 +342,7 @@ UINT PcNicDisable(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
 UINT PcNicList(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
 UINT PcAccountList(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
 UINT PcAccountCreate(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
+void SetRpcClientCreateAccountFromGetAccount(RPC_CLIENT_CREATE_ACCOUNT *c, RPC_CLIENT_GET_ACCOUNT *t);
 UINT PcAccountSet(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
 UINT PcAccountGet(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
 UINT PcAccountDelete(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
@@ -365,6 +366,8 @@ UINT PcAccountServerCertEnable(CONSOLE *c, char *cmd_name, wchar_t *str, void *p
 UINT PcAccountServerCertDisable(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
 UINT PcAccountRetryOnServerCertEnable(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
 UINT PcAccountRetryOnServerCertDisable(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
+UINT PcAccountDefaultCAEnable(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
+UINT PcAccountDefaultCADisable(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
 UINT PcAccountServerCertSet(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
 UINT PcAccountServerCertDelete(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
 UINT PcAccountServerCertGet(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
@@ -510,6 +513,8 @@ UINT PsCascadeProxySocks(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
 UINT PsCascadeProxySocks5(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
 UINT PsCascadeServerCertEnable(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
 UINT PsCascadeServerCertDisable(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
+UINT PsCascadeDefaultCAEnable(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
+UINT PsCascadeDefaultCADisable(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
 UINT PsCascadeServerCertSet(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
 UINT PsCascadeServerCertDelete(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);
 UINT PsCascadeServerCertGet(CONSOLE *c, char *cmd_name, wchar_t *str, void *param);

src/Cedar/Link.h

@@ -31,6 +31,7 @@ struct LINK
 	UINT CurrentSendPacketQueueSize;	// Current send packet queue size
 	UINT LastError;					// Last error
 	bool CheckServerCert;			// To check the server certificate
+	bool AddDefaultCA;				// Use default trust store
 	X *ServerCert;					// Server certificate
 	bool LockFlag;					// Lock flag
 	bool *StopAllLinkFlag;			// Stop all link flag

src/Cedar/Protocol.c

@@ -4295,7 +4295,6 @@ bool ClientCheckServerCert(CONNECTION *c, bool *expired)
 	X *x;
 	CHECK_CERT_THREAD_PROC *p;
 	THREAD *thread;
-	CEDAR *cedar;
 	bool ret;
 	UINT64 start;
 	// Validate arguments
@@ -4310,31 +4309,10 @@ bool ClientCheckServerCert(CONNECTION *c, bool *expired)
 	}
 
 	auth = c->Session->ClientAuth;
-	cedar = c->Cedar;
 
-	if (auth->CheckCertProc == NULL && c->Session->LinkModeClient == false)
+	if (auth->CheckCertProc == NULL)
 	{
-		// No checking function
-		return true;
-	}
-
-	if (c->Session->LinkModeClient && c->Session->Link->CheckServerCert == false)
-	{
-		// It's in cascade connection mode, but do not check the server certificate
-		return true;
-	}
-
-	if (c->UseTicket)
-	{
-		// Check the certificate of the redirected VPN server
-		if (CompareX(c->FirstSock->RemoteX, c->ServerX) == false)
-		{
-			return false;
-		}
-		else
-		{
-			return true;
-		}
+		return false;
 	}
 
 	x = CloneX(c->FirstSock->RemoteX);
@@ -4344,63 +4322,6 @@ bool ClientCheckServerCert(CONNECTION *c, bool *expired)
 		return false;
 	}
 
-	if (CheckXDateNow(x))
-	{
-		// Check whether it is signed by the root certificate to trust
-		if (c->Session->LinkModeClient == false)
-		{
-			// Normal VPN Client mode
-			if (CheckSignatureByCa(cedar, x))
-			{
-				// This certificate can be trusted because it is signed
-				FreeX(x);
-				return true;
-			}
-		}
-		else
-		{
-			// Cascade connection mode
-			if (CheckSignatureByCaLinkMode(c->Session, x))
-			{
-				// This certificate can be trusted because it is signed
-				FreeX(x);
-				return true;
-			}
-		}
-	}
-
-	if (c->Session->LinkModeClient)
-	{
-		if (CheckXDateNow(x))
-		{
-			Lock(c->Session->Link->lock);
-			{
-				if (c->Session->Link->ServerCert != NULL)
-				{
-					if (CompareX(c->Session->Link->ServerCert, x))
-					{
-						Unlock(c->Session->Link->lock);
-						// Exactly match the certificate that is registered in the cascade configuration
-						FreeX(x);
-						return true;
-					}
-				}
-			}
-			Unlock(c->Session->Link->lock);
-		}
-		else
-		{
-			if (expired != NULL)
-			{
-				*expired = true;
-			}
-		}
-
-		// Verification failure at this point in the case of cascade connection mode
-		FreeX(x);
-		return false;
-	}
-
 	p = ZeroMalloc(sizeof(CHECK_CERT_THREAD_PROC));
 	p->ServerX = x;
 	p->CheckCertProc = auth->CheckCertProc;
@@ -4418,7 +4339,8 @@ bool ClientCheckServerCert(CONNECTION *c, bool *expired)
 		{
 			// Send a NOOP periodically for disconnection prevention
 			start = Tick64();
-			ClientUploadNoop(c);
+			// Do not send because we now ask for user permission before sending signature
+			//ClientUploadNoop(c);
 		}
 		if (p->UserSelected)
 		{
@@ -4477,10 +4399,43 @@ REDIRECTED:
 	s = ClientConnectToServer(c);
 	if (s == NULL)
 	{
+		// Do not retry if untrusted or hostname mismatched
+		if (c->Session->LinkModeClient == false && (c->Err == ERR_CERT_NOT_TRUSTED || c->Err == ERR_HOSTNAME_MISMATCH)
+			&& (c->Session->Account == NULL || ! c->Session->Account->RetryOnServerCert))
+		{
+			c->Session->ForceStopFlag = true;
+		}
 		PrintStatus(sess, L"free");
 		return false;
 	}
 
+	PrintStatus(sess, _UU("STATUS_5"));
+
+	// Prompt user whether to continue on verification errors
+	if ((c->Err == ERR_CERT_NOT_TRUSTED || c->Err == ERR_HOSTNAME_MISMATCH || c->Err == ERR_SERVER_CERT_EXPIRES) && ClientCheckServerCert(c, &expired) == false)
+	{
+		if (expired)
+		{
+			c->Err = ERR_SERVER_CERT_EXPIRES;
+		}
+
+		// Do not retry if untrusted or hostname mismatched
+		if (c->Session->LinkModeClient == false && (c->Err == ERR_CERT_NOT_TRUSTED || c->Err == ERR_HOSTNAME_MISMATCH)
+			&& (c->Session->Account == NULL || ! c->Session->Account->RetryOnServerCert))
+		{
+			c->Session->ForceStopFlag = true;
+		}
+
+		goto CLEANUP;
+	}
+
+	// Check the certificate of the redirected VPN server
+	if (c->UseTicket && CompareX(s->RemoteX, c->ServerX) == false)
+	{
+		c->Err = ERR_CERT_NOT_TRUSTED;
+		goto CLEANUP;
+	}
+
 	Copy(&server_ip, &s->RemoteIP, sizeof(IP));
 
 	if (c->Halt)
@@ -4532,8 +4487,6 @@ REDIRECTED:
 		goto CLEANUP;
 	}
 
-	PrintStatus(sess, _UU("STATUS_5"));
-
 	// Receive a Hello packet
 	Debug("Downloading Hello...\n");
 	if (ClientDownloadHello(c, s) == false)
@@ -4569,27 +4522,6 @@ REDIRECTED:
 	// During user authentication
 	c->Session->ClientStatus = CLIENT_STATUS_AUTH;
 
-	// Verify the server certificate by the client
-	if (ClientCheckServerCert(c, &expired) == false)
-	{
-		if (expired == false)
-		{
-			c->Err = ERR_CERT_NOT_TRUSTED;
-		}
-		else
-		{
-			c->Err = ERR_SERVER_CERT_EXPIRES;
-		}
-
-		if (c->Session->LinkModeClient == false && c->Err == ERR_CERT_NOT_TRUSTED
-			&& (c->Session->Account == NULL || ! c->Session->Account->RetryOnServerCert))
-		{
-			c->Session->ForceStopFlag = true;
-		}
-
-		goto CLEANUP;
-	}
-
 	PrintStatus(sess, _UU("STATUS_6"));
 
 	// Send the authentication data
@@ -6218,16 +6150,29 @@ SOCK *ClientConnectToServer(CONNECTION *c)
 	SetTimeout(s, CONNECTING_TIMEOUT);
 
 	// Start the SSL communication
-	if (StartSSLEx(s, x, k, 0, c->ServerName) == false)
+	UINT err = 0;
+	if (StartSSLEx3(s, x, k, NULL, 0, c->ServerName, c->Session->SslOption, &err) == false)
 	{
 		// SSL communication start failure
 		Disconnect(s);
 		ReleaseSock(s);
 		c->FirstSock = NULL;
-		c->Err = ERR_SERVER_IS_NOT_VPN;
+		if (err != 0)
+		{
+			c->Err = err;
+		}
+		else
+		{
+			c->Err = ERR_SERVER_IS_NOT_VPN;
+		}
 		return NULL;
 	}
 
+	if (err != 0)
+	{
+		c->Err = err;
+	}
+
 	if (s->RemoteX == NULL)
 	{
 		// SSL communication start failure
@@ -6297,6 +6242,7 @@ SOCK *ClientConnectGetSocket(CONNECTION *c, bool additional_connect)
 
 	if (o->ProxyType == PROXY_DIRECT)
 	{
+		UINT ssl_err = 0;
 		UINT nat_t_err = 0;
 		wchar_t tmp[MAX_SIZE];
 		UniFormat(tmp, sizeof(tmp), _UU("STATUS_4"), hostname);
@@ -6306,9 +6252,10 @@ SOCK *ClientConnectGetSocket(CONNECTION *c, bool additional_connect)
 		{
 			// If additional_connect == false, enable trying to NAT-T connection
 			// If additional_connect == true, follow the IsRUDPSession setting in this session
+			// In additional connect or redirect we do not need ssl verification as the certificate is always compared with a saved one
 			sock = TcpIpConnectEx2(hostname, c->ServerPort,
 				(bool *)cancel_flag, c->hWndForUI, &nat_t_err, (additional_connect ? (!sess->IsRUDPSession) : false),
-				true, o->HintStr, &resolved_ip);
+				true, ((additional_connect || c->UseTicket) ? NULL : sess->SslOption), &ssl_err, o->HintStr, &resolved_ip);
 		}
 		else
 		{
@@ -6331,7 +6278,14 @@ SOCK *ClientConnectGetSocket(CONNECTION *c, bool additional_connect)
 			// Connection failure
 			if (nat_t_err != RUDP_ERROR_NAT_T_TWO_OR_MORE)
 			{
-				c->Err = ERR_CONNECT_FAILED;
+				if (ssl_err != 0)
+				{
+					c->Err = ssl_err;
+				}
+				else
+				{
+					c->Err = ERR_CONNECT_FAILED;
+				}
 			}
 			else
 			{
@@ -6340,6 +6294,11 @@ SOCK *ClientConnectGetSocket(CONNECTION *c, bool additional_connect)
 
 			return NULL;
 		}
+
+		if (ssl_err != 0)
+		{
+			c->Err = ssl_err;
+		}
 	}
 	else
 	{
@@ -6445,20 +6404,20 @@ UINT ProxyCodeToCedar(UINT code)
 // TCP connection function
 SOCK *TcpConnectEx3(char *hostname, UINT port, UINT timeout, bool *cancel_flag, void *hWnd, bool no_nat_t, UINT *nat_t_error_code, bool try_start_ssl, IP *ret_ip)
 {
-	return TcpConnectEx4(hostname, port, timeout, cancel_flag, hWnd, no_nat_t, nat_t_error_code, try_start_ssl, NULL, ret_ip);
+	return TcpConnectEx4(hostname, port, timeout, cancel_flag, hWnd, no_nat_t, nat_t_error_code, try_start_ssl, NULL, NULL, NULL, ret_ip);
 }
-SOCK *TcpConnectEx4(char *hostname, UINT port, UINT timeout, bool *cancel_flag, void *hWnd, bool no_nat_t, UINT *nat_t_error_code, bool try_start_ssl, char *hint_str, IP *ret_ip)
+SOCK *TcpConnectEx4(char *hostname, UINT port, UINT timeout, bool *cancel_flag, void *hWnd, bool no_nat_t, UINT *nat_t_error_code, bool try_start_ssl, SSL_VERIFY_OPTION *ssl_option, UINT *ssl_err, char *hint_str, IP *ret_ip)
 {
 #ifdef	OS_WIN32
 	if (hWnd == NULL)
 	{
 #endif	// OS_WIN32
-		return ConnectEx5(hostname, port, timeout, cancel_flag, (no_nat_t ? NULL : VPN_RUDP_SVC_NAME), nat_t_error_code, try_start_ssl, true, hint_str, ret_ip);
+		return ConnectEx5(hostname, port, timeout, cancel_flag, (no_nat_t ? NULL : VPN_RUDP_SVC_NAME), nat_t_error_code, try_start_ssl, true, ssl_option, ssl_err, hint_str, ret_ip);
 #ifdef	OS_WIN32
 	}
 	else
 	{
-		return WinConnectEx4((HWND)hWnd, hostname, port, timeout, 0, NULL, NULL, nat_t_error_code, (no_nat_t ? NULL : VPN_RUDP_SVC_NAME), try_start_ssl, hint_str);
+		return WinConnectEx4((HWND)hWnd, hostname, port, timeout, 0, NULL, NULL, nat_t_error_code, (no_nat_t ? NULL : VPN_RUDP_SVC_NAME), try_start_ssl, ssl_option, ssl_err, hint_str);
 	}
 #endif	// OS_WIN32
 }
@@ -6466,9 +6425,9 @@ SOCK *TcpConnectEx4(char *hostname, UINT port, UINT timeout, bool *cancel_flag,
 // Connect with TCP/IP
 SOCK *TcpIpConnectEx(char *hostname, UINT port, bool *cancel_flag, void *hWnd, UINT *nat_t_error_code, bool no_nat_t, bool try_start_ssl, IP *ret_ip)
 {
-	return TcpIpConnectEx2(hostname, port, cancel_flag, hWnd, nat_t_error_code, no_nat_t, try_start_ssl, NULL, ret_ip);
+	return TcpIpConnectEx2(hostname, port, cancel_flag, hWnd, nat_t_error_code, no_nat_t, try_start_ssl, NULL, NULL, NULL, ret_ip);
 }
-SOCK *TcpIpConnectEx2(char *hostname, UINT port, bool *cancel_flag, void *hWnd, UINT *nat_t_error_code, bool no_nat_t, bool try_start_ssl, char *hint_str, IP *ret_ip)
+SOCK *TcpIpConnectEx2(char *hostname, UINT port, bool *cancel_flag, void *hWnd, UINT *nat_t_error_code, bool no_nat_t, bool try_start_ssl, SSL_VERIFY_OPTION *ssl_option, UINT *ssl_err, char *hint_str, IP *ret_ip)
 {
 	SOCK *s = NULL;
 	UINT dummy_int = 0;
@@ -6483,7 +6442,7 @@ SOCK *TcpIpConnectEx2(char *hostname, UINT port, bool *cancel_flag, void *hWnd,
 		return NULL;
 	}
 
-	s = TcpConnectEx4(hostname, port, 0, cancel_flag, hWnd, no_nat_t, nat_t_error_code, try_start_ssl, hint_str, ret_ip);
+	s = TcpConnectEx4(hostname, port, 0, cancel_flag, hWnd, no_nat_t, nat_t_error_code, try_start_ssl, ssl_option, ssl_err, hint_str, ret_ip);
 	if (s == NULL)
 	{
 		return NULL;

src/Cedar/Protocol.h

@@ -114,7 +114,7 @@ bool ServerAccept(CONNECTION *c);
 bool ClientConnect(CONNECTION *c);
 SOCK *ClientConnectToServer(CONNECTION *c);
 SOCK *TcpIpConnectEx(char *hostname, UINT port, bool *cancel_flag, void *hWnd, UINT *nat_t_error_code, bool no_nat_t, bool try_start_ssl, IP *ret_ip);
-SOCK *TcpIpConnectEx2(char *hostname, UINT port, bool *cancel_flag, void *hWnd, UINT *nat_t_error_code, bool no_nat_t, bool try_start_ssl, char *hint_str, IP *ret_ip);
+SOCK *TcpIpConnectEx2(char *hostname, UINT port, bool *cancel_flag, void *hWnd, UINT *nat_t_error_code, bool no_nat_t, bool try_start_ssl, SSL_VERIFY_OPTION *ssl_option, UINT *ssl_err, char *hint_str, IP *ret_ip);
 bool ClientUploadSignature(SOCK *s);
 bool ClientDownloadHello(CONNECTION *c, SOCK *s);
 bool ServerDownloadSignature(CONNECTION *c, char **error_detail_str);
@@ -122,7 +122,7 @@ bool ServerUploadHello(CONNECTION *c);
 bool ClientUploadAuth(CONNECTION *c);
 SOCK *ClientConnectGetSocket(CONNECTION *c, bool additional_connect);
 SOCK *TcpConnectEx3(char *hostname, UINT port, UINT timeout, bool *cancel_flag, void *hWnd, bool no_nat_t, UINT *nat_t_error_code, bool try_start_ssl, IP *ret_ip);
-SOCK *TcpConnectEx4(char *hostname, UINT port, UINT timeout, bool *cancel_flag, void *hWnd, bool no_nat_t, UINT *nat_t_error_code, bool try_start_ssl, char *hint_str, IP *ret_ip);
+SOCK *TcpConnectEx4(char *hostname, UINT port, UINT timeout, bool *cancel_flag, void *hWnd, bool no_nat_t, UINT *nat_t_error_code, bool try_start_ssl, SSL_VERIFY_OPTION *ssl_option, UINT *ssl_err, char *hint_str, IP *ret_ip);
 
 UINT ProxyCodeToCedar(UINT code);
 

src/Cedar/SM.c

@@ -10286,6 +10286,7 @@ bool SmLinkEdit(HWND hWnd, SM_HUB *s, wchar_t *name)
 	a.ClientAuth = CopyClientAuth(t.ClientAuth);
 	Copy(&a.Policy, &t.Policy, sizeof(POLICY));
 	a.CheckServerCert = t.CheckServerCert;
+	a.AddDefaultCA = t.AddDefaultCA;
 	a.ServerCert = CloneX(t.ServerCert);
 	a.HideTrustCert = GetCapsBool(s->p->CapsList, "b_support_config_hub");
 	FreeRpcCreateLink(&t);

src/Cedar/Server.c

@@ -3400,6 +3400,7 @@ void SiWriteHubLinkCfg(FOLDER *f, LINK *k)
 		}
 
 		CfgAddBool(f, "CheckServerCert", k->CheckServerCert);
+		CfgAddBool(f, "AddDefaultCA", k->AddDefaultCA);
 
 		if (k->ServerCert != NULL)
 		{
@@ -3450,6 +3451,7 @@ void SiLoadHubLinkCfg(FOLDER *f, HUB *h)
 	{
 		BUF *b;
 		k->CheckServerCert = CfgGetBool(f, "CheckServerCert");
+		k->AddDefaultCA = CfgGetBool(f, "AddDefaultCA");
 		b = CfgGetBuf(f, "ServerCert");
 		if (b != NULL)
 		{

src/Cedar/Session.c

@@ -1270,6 +1270,13 @@ void CleanupSession(SESSION *s)
 		Free(s->ClientAuth);
 	}
 
+	if (s->SslOption != NULL)
+	{
+		FreeXList(s->SslOption->CaList);
+		FreeX(s->SslOption->SavedCert);
+		Free(s->SslOption);
+	}
+
 	FreeTraffic(s->Traffic);
 	Free(s->Name);
 
@@ -1949,23 +1956,55 @@ SESSION *NewClientSessionEx(CEDAR *cedar, CLIENT_OPTION *option, CLIENT_AUTH *au
 	{
 		s->ClientAuth->ClientX = CloneX(s->ClientAuth->ClientX);
 	}
-  if (s->ClientAuth->ClientK != NULL)
-  {
-    if (s->ClientAuth->AuthType != CLIENT_AUTHTYPE_OPENSSLENGINE)
-    {
-      s->ClientAuth->ClientK = CloneK(s->ClientAuth->ClientK);
-    }
-    else
-    {
-      s->ClientAuth->ClientK = OpensslEngineToK(s->ClientAuth->OpensslEnginePrivateKeyName, s->ClientAuth->OpensslEngineName);
-    }
-  }
+	if (s->ClientAuth->ClientK != NULL)
+	{
+		if (s->ClientAuth->AuthType != CLIENT_AUTHTYPE_OPENSSLENGINE)
+		{
+			s->ClientAuth->ClientK = CloneK(s->ClientAuth->ClientK);
+		}
+		else
+		{
+			s->ClientAuth->ClientK = OpensslEngineToK(s->ClientAuth->OpensslEnginePrivateKeyName, s->ClientAuth->OpensslEngineName);
+		}
+	}
 
 	if (StrCmpi(s->ClientOption->DeviceName, LINK_DEVICE_NAME) == 0)
 	{
 		// Link client mode
 		s->LinkModeClient = true;
 		s->Link = (LINK *)s->PacketAdapter->Param;
+		if (s->Link != NULL && s->Link->CheckServerCert && s->Link->Hub->HubDb != NULL)
+		{
+			// Enable SSL peer verification
+			s->SslOption = ZeroMalloc(sizeof(SSL_VERIFY_OPTION));
+			s->SslOption->VerifyPeer = true;
+			s->SslOption->AddDefaultCA = s->Link->AddDefaultCA;
+			s->SslOption->VerifyHostname = true;
+			s->SslOption->SavedCert = CloneX(s->Link->ServerCert);
+
+			// Copy trusted CA
+			LIST *o = s->Link->Hub->HubDb->RootCertList;
+			s->SslOption->CaList = CloneXList(o);
+		}
+	}
+	else
+	{
+		if (account != NULL && account->CheckServerCert)
+		{
+			// Enable SSL peer verification
+			s->SslOption = ZeroMalloc(sizeof(SSL_VERIFY_OPTION));
+			s->SslOption->VerifyPeer = true;
+#ifdef	OS_WIN32
+			s->SslOption->PromptOnVerifyFail = true;
+#endif
+			s->SslOption->AddDefaultCA = account->AddDefaultCA;
+			s->SslOption->VerifyHostname = true;
+			s->SslOption->SavedCert = CloneX(account->ServerCert);
+
+			// Copy trusted CA
+			LIST *o = cedar->CaList;
+			s->SslOption->CaList = CloneXList(o);
+		}
 	}
 
 	if (StrCmpi(s->ClientOption->DeviceName, SNAT_DEVICE_NAME) == 0)

src/Cedar/Session.h

@@ -91,6 +91,7 @@ struct SESSION
 	char ClientIP[64];				// Client IP
 	CLIENT_OPTION *ClientOption;	// Client connection options
 	CLIENT_AUTH *ClientAuth;		// Client authentication data
+	SSL_VERIFY_OPTION *SslOption;	// SSL verification option
 	volatile bool Halt;				// Halting flag
 	volatile bool CancelConnect;	// Cancel the connection
 	EVENT *HaltEvent;				// Halting event

src/Cedar/WinUi.c

@@ -1329,7 +1329,7 @@ void WinConnectDlgThread(THREAD *thread, void *param)
 		nat_t_svc_name = d->nat_t_svc_name;
 	}
 
-	s = ConnectEx5(d->hostname, d->port, d->timeout, &d->cancel, nat_t_svc_name, &nat_t_error_code, d->try_start_ssl, false, d->hint_str, NULL);
+	s = ConnectEx5(d->hostname, d->port, d->timeout, &d->cancel, nat_t_svc_name, &nat_t_error_code, d->try_start_ssl, false, d->ssl_option, d->ssl_err, d->hint_str, NULL);
 
 	d->ret_sock = s;
 	d->nat_t_error_code = nat_t_error_code;
@@ -1399,9 +1399,9 @@ UINT WinConnectDlgProc(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam, void *
 // TCP connection with showing the UI
 SOCK *WinConnectEx3(HWND hWnd, char *server, UINT port, UINT timeout, UINT icon_id, wchar_t *caption, wchar_t *info, UINT *nat_t_error_code, char *nat_t_svc_name, bool try_start_ssl)
 {
-	return WinConnectEx4(hWnd, server, port, timeout, icon_id, caption, info, nat_t_error_code, nat_t_svc_name, try_start_ssl, NULL);
+	return WinConnectEx4(hWnd, server, port, timeout, icon_id, caption, info, nat_t_error_code, nat_t_svc_name, try_start_ssl, NULL, NULL, NULL);
 }
-SOCK *WinConnectEx4(HWND hWnd, char *server, UINT port, UINT timeout, UINT icon_id, wchar_t *caption, wchar_t *info, UINT *nat_t_error_code, char *nat_t_svc_name, bool try_start_ssl, char *hint_str)
+SOCK *WinConnectEx4(HWND hWnd, char *server, UINT port, UINT timeout, UINT icon_id, wchar_t *caption, wchar_t *info, UINT *nat_t_error_code, char *nat_t_svc_name, bool try_start_ssl, SSL_VERIFY_OPTION *ssl_option, UINT *ssl_err, char *hint_str)
 {
 	wchar_t tmp[MAX_SIZE];
 	wchar_t tmp2[MAX_SIZE];
@@ -1444,6 +1444,8 @@ SOCK *WinConnectEx4(HWND hWnd, char *server, UINT port, UINT timeout, UINT icon_
 	d.timeout = timeout;
 	d.hostname = server;
 	d.port = port;
+	d.ssl_option = ssl_option;
+	d.ssl_err = ssl_err;
 	d.hint_str = hint_str;
 	StrCpy(d.nat_t_svc_name, sizeof(d.nat_t_svc_name), nat_t_svc_name);
 

src/Cedar/WinUi.h

@@ -331,6 +331,8 @@ typedef struct WINCONNECT_DLG_DATA
 	char nat_t_svc_name[MAX_SIZE];
 	UINT nat_t_error_code;
 	bool try_start_ssl;
+	SSL_VERIFY_OPTION *ssl_option;
+	UINT *ssl_err;
 	char *hint_str;
 } WINCONNECT_DLG_DATA;
 
@@ -695,7 +697,7 @@ HFONT GetMeiryoFontEx(UINT font_size);
 HFONT GetMeiryoFontEx2(UINT font_size, bool bold);
 bool ShowWindowsNetworkConnectionDialog();
 SOCK *WinConnectEx3(HWND hWnd, char *server, UINT port, UINT timeout, UINT icon_id, wchar_t *caption, wchar_t *info, UINT *nat_t_error_code, char *nat_t_svc_name, bool try_start_ssl);
-SOCK *WinConnectEx4(HWND hWnd, char *server, UINT port, UINT timeout, UINT icon_id, wchar_t *caption, wchar_t *info, UINT *nat_t_error_code, char *nat_t_svc_name, bool try_start_ssl, char *hint_str);
+SOCK *WinConnectEx4(HWND hWnd, char *server, UINT port, UINT timeout, UINT icon_id, wchar_t *caption, wchar_t *info, UINT *nat_t_error_code, char *nat_t_svc_name, bool try_start_ssl, SSL_VERIFY_OPTION *ssl_option, UINT *ssl_err, char *hint_str);
 UINT WinConnectDlgProc(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam, void *param);
 void WinConnectDlgThread(THREAD *thread, void *param);
 void NicInfo(UI_NICINFO *info);