vtls/openssl: Support async certificate verification by user callback #11499
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Shouldn't this then also be documented somewhere? |
Added a section on custom certificate verification with OpenSSL. Please take a look. |
|
This is highly advanced and too niche to document in SSLCERTS. Instead, I suggest add a concise paragraph above the WARNING paragraphs in CURLOPT_SSL_CTX_FUNCTION: "For OpenSSL, error code SSL_ERROR_WANT_RETRY_VERIFY is supported for custom certificate verification. (Added in 8.3.0)". Anyone who is using a custom CTX function it's up to them to investigate all of the details. There's such a thing as too much documentation. |
bagder
reviewed
Jul 31, 2023
|
Thanks |
ptitSeb
pushed a commit
to wasix-org/curl
that referenced
this pull request
Sep 25, 2023
- Update the OpenSSL connect state machine to handle SSL_ERROR_WANT_RETRY_VERIFY. This allows libcurl users that are using custom certificate validation to suspend processing while waiting for external I/O during certificate validation. Closes curl#11499
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Overview
Update the OpenSSL connect state machine to handle
SSL_ERROR_WANT_RETRY_VERIFY. This allows libcurl users to suspend processing while waiting for external I/O during certificate validation.Intended usage
Clients perform asynchronous certificate verification by installing a X.509 certificate verification function with
SSL_CTX_set_cert_verify_callbackfrom the SSL context callback (seeCURLOPT_SSL_CTX_FUNCTION).The verification function calls
SSL_set_retry_verifybefore returning0to indicate that the outcome is still pending. Once verification completes, the client callscurl_multi_wakeupto re-enter theSSL_connectstate machine and return the final verification outcome from the next call to the verification function.This mechanism is useful for applications that use OpenSSL for TLS protocol handling and crypto while delegating certificate verification to the platform's native trust store.