summaryrefslogtreecommitdiff
path: root/src/lib/libssl/doc/SSL_CTX_set_cert_verify_callback.3
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/libssl/doc/SSL_CTX_set_cert_verify_callback.3')
-rw-r--r--src/lib/libssl/doc/SSL_CTX_set_cert_verify_callback.3112
1 files changed, 0 insertions, 112 deletions
diff --git a/src/lib/libssl/doc/SSL_CTX_set_cert_verify_callback.3 b/src/lib/libssl/doc/SSL_CTX_set_cert_verify_callback.3
deleted file mode 100644
index bb242d6929..0000000000
--- a/src/lib/libssl/doc/SSL_CTX_set_cert_verify_callback.3
+++ /dev/null
@@ -1,112 +0,0 @@
1.\"
2.\" $OpenBSD: SSL_CTX_set_cert_verify_callback.3,v 1.2 2014/12/02 14:11:01 jmc Exp $
3.\"
4.Dd $Mdocdate: December 2 2014 $
5.Dt SSL_CTX_SET_CERT_VERIFY_CALLBACK 3
6.Os
7.Sh NAME
8.Nm SSL_CTX_set_cert_verify_callback
9.Nd set peer certificate verification procedure
10.Sh SYNOPSIS
11.In openssl/ssl.h
12.Ft void
13.Fo SSL_CTX_set_cert_verify_callback
14.Fa "SSL_CTX *ctx"
15.Fa "int (*callback)(X509_STORE_CTX *, void *)"
16.Fa "void *arg"
17.Fc
18.Sh DESCRIPTION
19.Fn SSL_CTX_set_cert_verify_callback
20sets the verification callback function for
21.Fa ctx .
22.Vt SSL
23objects that are created from
24.Fa ctx
25inherit the setting valid at the time when
26.Xr SSL_new 3
27is called.
28.Sh NOTES
29Whenever a certificate is verified during a SSL/TLS handshake,
30a verification function is called.
31If the application does not explicitly specify a verification callback
32function, the built-in verification function is used.
33If a verification callback
34.Fa callback
35is specified via
36.Fn SSL_CTX_set_cert_verify_callback ,
37the supplied callback function is called instead.
38By setting
39.Fa callback
40to
41.Dv NULL ,
42the default behaviour is restored.
43.Pp
44When the verification must be performed,
45.Fa callback
46will be called with the arguments
47.Fn callback "X509_STORE_CTX *x509_store_ctx" "void *arg" .
48The argument
49.Fa arg
50is specified by the application when setting
51.Fa callback .
52.Pp
53.Fa callback
54should return 1 to indicate verification success and 0 to indicate verification
55failure.
56If
57.Dv SSL_VERIFY_PEER
58is set and
59.Fa callback
60returns 0, the handshake will fail.
61As the verification procedure may allow the connection to continue in case of
62failure (by always returning 1) the verification result must be set in any case
63using the
64.Fa error
65member of
66.Fa x509_store_ctx
67so that the calling application will be informed about the detailed result of
68the verification procedure!
69.Pp
70Within
71.Fa x509_store_ctx ,
72.Fa callback
73has access to the
74.Fa verify_callback
75function set using
76.Xr SSL_CTX_set_verify 3 .
77.Sh WARNINGS
78Do not mix the verification callback described in this function with the
79.Fa verify_callback
80function called during the verification process.
81The latter is set using the
82.Xr SSL_CTX_set_verify 3
83family of functions.
84.Pp
85Providing a complete verification procedure including certificate purpose
86settings, etc., is a complex task.
87The built-in procedure is quite powerful and in most cases it should be
88sufficient to modify its behaviour using the
89.Fa verify_callback
90function.
91.Sh RETURN VALUES
92.Fn SSL_CTX_set_cert_verify_callback
93does not provide diagnostic information.
94.Sh SEE ALSO
95.Xr ssl 3 ,
96.Xr SSL_CTX_load_verify_locations 3 ,
97.Xr SSL_CTX_set_verify 3 ,
98.Xr SSL_get_verify_result 3
99.Sh HISTORY
100Previous to OpenSSL 0.9.7, the
101.Fa arg
102argument to
103.Fn SSL_CTX_set_cert_verify_callback
104was ignored, and
105.Fa callback
106was called
107simply as
108.Ft int
109.Fn (*callback) "X509_STORE_CTX *" .
110To compile software written for previous versions of OpenSSL,
111a dummy argument will have to be added to
112.Fa callback .