RE: The correct way to verify a server certificate?

> From: 'Ladd, Watson' via openssl-users <[email protected]>
> Sent: Wednesday, 14 May, 2025 13:33

> In OpenSSL I know that SSL_CTX_set_verify(VERIFY_PEER) is required, but it
> doesn't seem from my reading the documentation that there is an easy way to
> verify hostname

Some OpenSSL material, including the "Client" page on the OpenSSL wiki, predate the implementation of certificate identity checking in 1.1.

With any non-ancient OpenSSL release, you use X509_VERIFY_PARAM_set1_host to specify the hostname to check the entity certificate against (and related functions to control other verification options). There's a short example at the end of the man page:

https://docs.openssl.org/3.1/man3/X509_VERIFY_PARAM_set_flags/

which is just:

X509_VERIFY_PARAM *param;

param = X509_VERIFY_PARAM_new();
X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CRL_CHECK);
SSL_CTX_set1_param(ctx, param);
X509_VERIFY_PARAM_free(param);

You'd use X509_VERIFY_PARAM_set1_host rather than (or in addition to) X509_VERIFY_PARAM_set_flags there. As usual, the "set1" means OpenSSL will make a copy of the hostname. There's also an add1_host if you need to set multiple possible hostnames.

Some OpenSSL consumers still implement their own identity-checking code, but that's usually a holdover from pre-1.1 days. Sometimes it's because they need even more flexibility than what's provided by the VERIFY_PARAM functions (e.g. "bypass this check iff the certificate chains back to this particular root"), but I think that's unusual.

You should also probably call SSL_CTX_set_tlsext_host_name or SSL_set_tlsext_host_name before making the connection, to enable SNI.

(I think those are the current recommendations. It's possible there's a newer API I missed.)

--
Michael Wojcik
================================
Rocket Software, Inc. and subsidiaries ■ 77 Fourth Avenue, Waltham MA 02451 ■ Main Office Toll Free Number: +1 855.577.4323
Contact Customer Support: https://my.rocketsoftware.com/RocketCommunity/RCEmailSupport
Unsubscribe from Marketing Messages/Manage Your Subscription Preferences - http://www.rocketsoftware.com/manage-your-email-preferences
Privacy Policy - http://www.rocketsoftware.com/company/legal/privacy-policy
================================

This communication and any attachments may contain confidential information of Rocket Software, Inc. All unauthorized use, disclosure or distribution is prohibited. If you are not the intended recipient, please notify Rocket Software immediately and destroy all copies of this communication. Thank you.

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/SA1PR07MB9764DF2BEB397CEF57D3D2EFC091A%40SA1PR07MB9764.namprd07.prod.outlook.com.