How to reject a certificate with access_denied?

[Matt Caswell]

On 06/06/2022 18:08, Christian Schmidt wrote:
> Hi,
> 
> I am building a server application that allows a user to log in by
> providing a certificate. In order to do custom checks, I have added a
> verify callback to my code to check the certificate on top of its
> cryptographic features (CA Valid, etc).
> 
> If the certificate does not pass my extended checks, I would like to
> return the access_denied alert as per RFC8446 section 6.2:
> 
> access_denied:  A valid certificate or PSK was received, but when
>     access control was applied, the sender decided not to proceed with
>     negotiation.
> 
> However, I can't find a way to generate this alert in openssl, although
> openssl can handle receiving it.
> 
> How do I make a callback return a non-defined (as in not defined in the
> headers) alert?

This is not currently possible.

OpenSSL has an internal table which maps verify errors to TLS alerts:

https://github.com/openssl/openssl/blob/9f3626f2473bdce53e85eba96e502e950e29e16f/ssl/statem/statem_lib.c#L1350-L1394

Unfortunately there are no entries in this table that map to the 
access_denied alert.

Matt