| Current Path : /usr/opt/openssl11/share/doc/openssl/html/man3/ |
FreeBSD hs32.drive.ne.jp 9.1-RELEASE FreeBSD 9.1-RELEASE #1: Wed Jan 14 12:18:08 JST 2015 root@hs32.drive.ne.jp:/sys/amd64/compile/hs32 amd64 |
| Current File : //usr/opt/openssl11/share/doc/openssl/html/man3/SSL_CTX_set_cert_verify_callback.html |
<?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>SSL_CTX_set_cert_verify_callback</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@hsxx.drive.ne.jp" />
</head>
<body style="background-color: white">
<!-- INDEX BEGIN -->
<div name="index">
<p><a name="__index__"></a></p>
<ul>
<li><a href="#name">NAME</a></li>
<li><a href="#synopsis">SYNOPSIS</a></li>
<li><a href="#description">DESCRIPTION</a></li>
<li><a href="#notes">NOTES</a></li>
<li><a href="#return_values">RETURN VALUES</a></li>
<li><a href="#warnings">WARNINGS</a></li>
<li><a href="#bugs">BUGS</a></li>
<li><a href="#see_also">SEE ALSO</a></li>
<li><a href="#copyright">COPYRIGHT</a></li>
</ul>
<hr name="index" />
</div>
<!-- INDEX END -->
<p>
</p>
<hr />
<h1><a name="name">NAME</a></h1>
<p>SSL_CTX_set_cert_verify_callback - set peer certificate verification procedure</p>
<p>
</p>
<hr />
<h1><a name="synopsis">SYNOPSIS</a></h1>
<pre>
#include <openssl/ssl.h></pre>
<pre>
void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx,
int (*callback)(X509_STORE_CTX *, void *),
void *arg);</pre>
<p>
</p>
<hr />
<h1><a name="description">DESCRIPTION</a></h1>
<p><code>SSL_CTX_set_cert_verify_callback()</code> sets the verification callback function for
<em>ctx</em>. SSL objects that are created from <em>ctx</em> inherit the setting valid at
the time when <em>SSL_new(3)</em> is called.</p>
<p>
</p>
<hr />
<h1><a name="notes">NOTES</a></h1>
<p>Whenever a certificate is verified during a SSL/TLS handshake, a verification
function is called. If the application does not explicitly specify a
verification callback function, the built-in verification function is used.
If a verification callback <em>callback</em> is specified via
<code>SSL_CTX_set_cert_verify_callback()</code>, the supplied callback function is called
instead. By setting <em>callback</em> to NULL, the default behaviour is restored.</p>
<p>When the verification must be performed, <em>callback</em> will be called with
the arguments callback(X509_STORE_CTX *x509_store_ctx, void *arg). The
argument <em>arg</em> is specified by the application when setting <em>callback</em>.</p>
<p><em>callback</em> should return 1 to indicate verification success and 0 to
indicate verification failure. If SSL_VERIFY_PEER is set and <em>callback</em>
returns 0, the handshake will fail. As the verification procedure may
allow the connection to continue in the case of failure (by always
returning 1) the verification result must be set in any case using the
<strong>error</strong> member of <em>x509_store_ctx</em> so that the calling application
will be informed about the detailed result of the verification procedure!</p>
<p>Within <em>x509_store_ctx</em>, <em>callback</em> has access to the <em>verify_callback</em>
function set using <em>SSL_CTX_set_verify(3)</em>.</p>
<p>
</p>
<hr />
<h1><a name="return_values">RETURN VALUES</a></h1>
<p><code>SSL_CTX_set_cert_verify_callback()</code> does not return a value.</p>
<p>
</p>
<hr />
<h1><a name="warnings">WARNINGS</a></h1>
<p>Do not mix the verification callback described in this function with the
<strong>verify_callback</strong> function called during the verification process. The
latter is set using the <em>SSL_CTX_set_verify(3)</em>
family of functions.</p>
<p>Providing a complete verification procedure including certificate purpose
settings etc is a complex task. The built-in procedure is quite powerful
and in most cases it should be sufficient to modify its behaviour using
the <strong>verify_callback</strong> function.</p>
<p>
</p>
<hr />
<h1><a name="bugs">BUGS</a></h1>
<p><code>SSL_CTX_set_cert_verify_callback()</code> does not provide diagnostic information.</p>
<p>
</p>
<hr />
<h1><a name="see_also">SEE ALSO</a></h1>
<p><em>ssl(7)</em>, <em>SSL_CTX_set_verify(3)</em>,
<em>SSL_get_verify_result(3)</em>,
<em>SSL_CTX_load_verify_locations(3)</em></p>
<p>
</p>
<hr />
<h1><a name="copyright">COPYRIGHT</a></h1>
<p>Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.</p>
<p>Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
<a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
</body>
</html>