Don't drop X509_V_ERR_HOSTNAME_MISMATCH when verify callback returns 1

While not the advised way of using the verify callback (either by OpenSSL
or by us) in production, sometimes folks like to return 1 from everything
in the callback and then check the error return and make decicions about
things.

This fix ensures that such callbacks will see the hostname mismatch and
be able to act upon them.

Reported by Alexander Aleksandrovic Klimov
ok tb@

1 files changed, 5 insertions, 2 deletions

diff --git a/src/lib/libcrypto/x509/x509_verify.c b/src/lib/libcrypto/x509/x509_verify.c
index e0efa9ffc5..a8fd5a37d3 100644
--- a/src/lib/libcrypto/x509/x509_verify.c
+++ b/src/lib/libcrypto/x509/x509_verify.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_verify.c,v 1.78 2026/07/31 03:59:50 kenjiro Exp $ */
+/* $OpenBSD: x509_verify.c,v 1.79 2026/08/26 16:25:12 beck Exp $ */
 /*
  * Copyright (c) 2020-2021 Bob Beck <beck@openbsd.org>
  *
@@ -760,8 +760,11 @@ x509_verify_cert_hostname(struct x509_verify_ctx *ctx, X509 *cert, char *name)
                 if (ctx->xsc != NULL) {
                         int ret;
 
-                        if ((ret = x509_vfy_check_id(ctx->xsc)) == 0)
+                        ret = x509_vfy_check_id(ctx->xsc);
+                        if (ctx->xsc->error != X509_V_OK) {
                                 ctx->error = ctx->xsc->error;
+                                ctx->error_depth = ctx->xsc->error_depth;
+                        }
                         return ret;
                 }
                 return 1;