Retrieve CA for client cert from SSL*

Fen Fox Fen.Fox at
Fri Oct 25 16:03:53 UTC 2019

SSL_get0_verified_chain was exactly what I needed, thanks!

-----Original Message-----
From: openssl-users <openssl-users-bounces at> On Behalf Of Viktor Dukhovni
Sent: Friday, October 25, 2019 11:55 AM
To: openssl-users at
Subject: Re: Retrieve CA for client cert from SSL*

> On Oct 25, 2019, at 5:38 PM, Jan Just Keijser <janjust at> wrote:
>> Is there a way to figure out which CA the server used to validate the client certificate?
> on the server side?  you would have to write your own verify callback to intercept the certificate stack as it is processed. That way, you can monitor which CA openssl selected for verification.

No, that's not necessary.  After the completion of the handshake one can call SSL_get0_verified_chain(3).

This chain is only available on full handshakes, when validation is successful (SSL_get_verify_result(3) returns X509_V_OK).  On resumption, only the leaf certificate is available from the resumed session, via SSL_get_peer_certificate(3).

Of course there might not be a client certificate at all.


More information about the openssl-users mailing list