Print SSL errors during handshake
Also if they are about certificate verification failure which might already have been reported before,
because otherwise some certificate verification failures may go unreported (like missing CA).
@@ -722,8 +722,12 @@ xfrd_tcp_open(struct xfrd_tcp_set* set, struct xfrd_tcp_pipeline* tp,
strerror(errno));
} else if(tp->handshake_want == SSL_ERROR_SSL) {
- if(SSL_get_verify_result(tp->ssl) == X509_V_OK)
- log_crypto_err("xfrd: TLS handshake failed");
+ char errmsg[1024];
+ snprintf(errmsg, sizeof(errmsg), "xfrd: "
+ "TLS handshake failed for %s to %s",
+ zone->apex_str,
+ zone->master->ip_address_spec);
+ log_crypto_err(errmsg);
} else {
log_msg(LOG_ERR, "xfrd: TLS handshake failed "
"for %s to %s with %d", zone->apex_str,
@@ -1003,7 +1007,6 @@ xfrd_tcp_write(struct xfrd_tcp_pipeline* tp, xfrd_zone_type* zone)
strerror(errno));
} else if(tp->handshake_want == SSL_ERROR_SSL) {
- if (SSL_get_verify_result(tp->ssl) == X509_V_OK)
log_crypto_err("xfrd: TLS handshake failed");
} else {
log_msg(LOG_ERR, "xfrd: TLS handshake failed "
@@ -1259,7 +1262,6 @@ xfrd_tcp_read(struct xfrd_tcp_pipeline* tp)
strerror(errno));
} else if(tp->handshake_want == SSL_ERROR_SSL) {
- if (SSL_get_verify_result(tp->ssl) == X509_V_OK)
log_crypto_err("xfrd: TLS handshake failed");
} else {
log_msg(LOG_ERR, "xfrd: TLS handshake failed "
