<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p></p>
<div>I am using the following link ssl to my container structure, so is it possible to get ssl from
<span>x509_ctx</span> in <span>verify_callback</span>?</div>
<div> SSL_set_app_data(ssl, this);</div>
<div><br>
</div>
<div><span> int verify_callback(int preverify_ok, X509_STORE_CTX *x509_ctx);</span><br>
</div>
<br>
<p></p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Lei Kong <leikong@msn.com><br>
<b>Sent:</b> Thursday, October 27, 2016 1:24:05 AM<br>
<b>To:</b> openssl-users@openssl.org<br>
<b>Subject:</b> SSL_set_verify with a context?</font>
<div> </div>
</div>
<div>
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p><span>What I am trying to achieve is to allow some minor certificate chain validation errors, e.g. "CRL unavailable", based on my per-session configuration. I am think of using my verify callback to record the errors.</span></p>
<div style="color: rgb(0, 0, 0);">
<div>
<div id="divtagdefaultwrapper" style="color: rgb(0, 0, 0); font-family: Calibri,Arial,Helvetica,sans-serif; font-size: 12pt;">
<div><br>
</div>
<div>void SSL_set_verify(SSL *s, int mode, int (*verify_callback)(int, X509_STORE_CTX *));<br>
</div>
<p><span>int verify_callback(int preverify_ok, X509_STORE_CTX *x509_ctx);</span></p>
<p><br>
</p>
<p>Given the above interfaces, it seems I cannot set the callback with a context, which is needed to link a callback instance to my SSL session for error tracking. Yes, I can use
<span>SSL_get_verify_result</span> to get the error afterwards, but is it guaranteed that the most severe error is always returned by
<span>SSL_get_verify_result? </span><span>For example, I don't want "unable to get CRL" to mask other more important errors.</span></p>
<p><span><br>
</span></p>
<p><span></span>I would rather avoid repeating validating the whole chain manually after default validation is completed, is it possible to achieve my goal without repeating chain validation manually?</p>
<p><br>
</p>
<p>Any comment will be appreciated.<br>
</p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>