Questions about the semantics of SSL_CTX_set_cert_verify_callback

[Andrew Lee-Thorp]

Hello openssl users

This is my first post and I am trying to work something out from the documentation.

I am looking at some code that does this:

SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
SSL_CTX_set_cert_verify_callback(ctx, callback, NULL);

Elsewhere:


int callback (X509_STORE_CTX *ctx, void *arg)
{
..
<elided code>

    returnValue = X509_STORE_CTX_get0_cert(ctx); <-- ??
    returnValue2 = X509_STORE_CTX_get0_chain(ctx); <-- ??

My question is about the callback and the semantics of get0_​cert and get0_chain in the context of the callback.

The documentation implies this callback is called once and get0_chain returns a constructed and validated chain but I would like to make sure.

So, firstly is callback invoked once or multiple times for each cert in the chain? I believe its' once but would like to make sure.

If multiple times, it is only called for certs that are part of the validated chain or could it be called for every cert offered by the server (including certs that aren't part of valid chain, that has a trust anchor)?

Could the callback also be invoked for an unvalidated chain? and if so would get0_cert and get0_chain return NULL in such a situation or does this not apply?

If it can be invoked for an unvalidated chain should the code also call X509_STORE_CTX_get_error() to get the validation status of the chain verification or does this not apply.

Does get0_​cert return the leaf cert (in the chain) or as the documentation suggest the current cert being processed by the ctx?

Thank you for your help,
Andrew

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mta.openssl.org/pipermail/openssl-users/attachments/20230707/bc62b54b/attachment-0001.htm>