[openssl/openssl] 95dcb1: Allow SSL_set_retry_verify() on server session

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 95dcb1b719a1c94ab0a8389c94c323fb2ec1d371
      https://github.com/openssl/openssl/commit/95dcb1b719a1c94ab0a8389c94c323fb2ec1d371
  Author: wfurt <[email protected]>
  Date:   2026-08-27 (Thu, 27 Aug 2026)

  Changed paths:
    M doc/man3/SSL_CTX_set_cert_verify_callback.pod
    M doc/man3/SSL_set_retry_verify.pod
    M ssl/statem/statem_local.h
    M ssl/statem/statem_srvr.c
    M test/sslapitest.c

  Log Message:
  -----------
  Allow SSL_set_retry_verify() on server session

Split server-side client-certificate processing into a parse phase
(tls_process_client_certificate) and a post-process verification phase
(tls_post_process_client_certificate), mirroring the existing
client-side tls_process_server_certificate /
tls_post_process_server_certificate split.

Split tls_process_client_rpk() into a parse phase and a new post-process
phase (tls_post_process_client_rpk), mirroring the client-side RPK split.
tls_post_process_client_certificate() now dispatches to the RPK helper
based on client_cert_type, so an application verify callback can call
SSL_set_retry_verify() during server-side RPK verification and
SSL_accept()/SSL_do_handshake() returns SSL_ERROR_WANT_RETRY_VERIFY.

This lets an application's verify callback call SSL_set_retry_verify()
during server-side client-cert verification: the post-process step now
returns WORK_MORE_A so SSL_accept()/SSL_do_handshake() returns
SSL_ERROR_WANT_RETRY_VERIFY, and re-entry resumes verification once the
application has supplied a verdict. Until now SSL_set_retry_verify was
documented as supported but only worked on the client.

A new regression test (test_server_cert_verify_cb in test/sslapitest.c)
exercises the server-side retry-verify path end-to-end.

Update SSL_set_retry_verify and SSL_CTX_set_cert_verify_callback
documentation to describe client and server retry-verify flow.

Fixes https://github.com/openssl/openssl/issues/30068

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Merge-date: Thu Aug 27 13:35:46 2026
Merged-from: https://github.com/openssl/openssl/pull/31485



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/dadf86-95dcb1%40github.com.