X.509 certificate verification: user-defined method -- SSLeay 0.9.0b -- January 19 99

NAME

X509_STORE_set_verify_cb_func, X509_STORE_set_depth,
X509_STORE_set_verify_func -- X.509 certificate verification: user-defined method

SYNOPSIS

#include "x509.h"
#include "x509_vfy.h"

DESCRIPTION

First, read X509 certificate verification: default method to see what you are going to modify.

You can set a verify callback, change the maximum depth that is checked, or change the internal verify cuntion that is invoked by X509_verify_cert.

X509_STORE_set_verify_cb_func is actually a macro:

#define X509_STORE_set_verify_cb_func(ctx,func) ((ctx)->verify_cb=(func))

Your function should take arguments (int, X509_STORE_CTX *). The first is 0 for error and 1 if no error. Your callback might display a message to the user, and if 1 is the first argument it should retrieve the error type using the SSLeay error handling library. The ctx is supplied so that the function can display the bad certificate if it desires.

X509_STORE_set_depth is also a macro:

#define X509_STORE_set_depth(ctx,d)       ((ctx)->depth=(d))

X509_STORE_set_verify_func is also a macro:

#define X509_STORE_set_verify_func(ctx,func)    ((ctx)->verify=(func))

Your function should take the one argument (X509_STORE_CTX *). The function should do some sort of internal consistency check of the certificate stack ctx->chain, and it should also be prepared to call the verify callback ctx->ctx->verify_cb in case of error.