Re: The correct way to verify a server certificate?

Thank you, that seems to be the function everyone wants.

I can go open a patch that adds cross refs from the other functions I looked at to make it findable.
________________________________
From: [email protected] <[email protected]> on behalf of Viktor Dukhovni <[email protected]>
Sent: Wednesday, May 14, 2025 6:19 PM
To: [email protected] <[email protected]>
Subject: Re: The correct way to verify a server certificate?

!-------------------------------------------------------------------|
  This Message Is From an External Sender
  This message came from outside your organization.
|-------------------------------------------------------------------!

On Wed, May 14, 2025 at 07:33:28PM +0000, 'Ladd, Watson' via openssl-users wrote:

> Tls.Dial("tcp", "https://urldefense.com/v3/__http://www.example.com__;!!GjvTz_vk!UQf0T1IcMw9CPoxBk__6Se7sdVmlr9vBJsJrAahqPnapDkOgVcHr8KfnWZBwOpu32_vQ8w72E5X4FdDGPUggCqGy$ :443", nil)
>
> In OpenSSL I know that SSL_CTX_set_verify(VERIFY_PEER) is required,
> but it doesn't seem from my reading the documentation that there is an
> easy way to verify hostnames: it seems that the expectation is doing a
> bunch of X509_ functions on the result of get_peer_certificate or make
> a callback function, but I'm not sure that I am not just failing to
> find the name of what I need.
>
> This has caused a few issues already. I'm sure we have all run into this. Does anyone have an ideomatic, easy to explain way to do this that I'm just not figuring out for some reason?

As of OpenSSL 1.1.0, prior, OpenSSL has: SSL_set1_host(3).

    SYNOPSIS
         #include <openssl/ssl.h>

         int SSL_set1_host(SSL *s, const char *host);
         int SSL_add1_host(SSL *s, const char *host);
         void SSL_set_hostflags(SSL *s, unsigned int flags);
         const char *SSL_get0_peername(SSL *s);

    ...
    HISTORY
        These functions were added in OpenSSL 1.1.0.

See the DESCRIPTION for further details.

--
    Viktor.

--
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://urldefense.com/v3/__https://groups.google.com/a/openssl.org/d/msgid/openssl-users/aCVBBGNKY_tyF_KJ*40chardros.imrryr.org__;JQ!!GjvTz_vk!UQf0T1IcMw9CPoxBk__6Se7sdVmlr9vBJsJrAahqPnapDkOgVcHr8KfnWZBwOpu32_vQ8w72E5X4FdDGPRZ0BNIP$ .

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/DM6PR17MB3979C0149408377F37CCE3BDC190A%40DM6PR17MB3979.namprd17.prod.outlook.com.