src/lib/tls.c
static int openssl_verify_peer(int ok, X509_STORE_CTX *store)
{
   if (!ok) {
      X509 *cert = X509_STORE_CTX_get_current_cert(store);
      int depth = X509_STORE_CTX_get_error_depth(store);
      int err = X509_STORE_CTX_get_error(store);
      char issuer[256];
      char subject[256];

      if (err == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT ||
          err == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN)
      {
         /* It seems that the error can be also
          * 24 X509_V_ERR_INVALID_CA: invalid CA certificate
          * But it's not very specific...
          */
         Jmsg0(NULL, M_ERROR, 0, _("CA certificate is self signed. With OpenSSL 1.1, enforce basicConstraints = CA:true in the certificate creation to avoid this issue\n"));
      }
      X509_NAME_oneline(X509_get_issuer_name(cert), issuer, 256);
      X509_NAME_oneline(X509_get_subject_name(cert), subject, 256);

      Jmsg5(NULL, M_ERROR, 0, _("Error with certificate at depth: %d, issuer = %s,"
            " subject = %s, ERR=%d:%s\n"), depth, issuer,
              subject, err, X509_verify_cert_error_string(err));

   }

   return ok;
}
/*
 * OpenSSL certificate verification callback.
 * OpenSSL has already performed internal certificate verification.
 * We just report any errors that occured.
 */
OpenSSL certificate verification callback.
OpenSSL has already performed internal certificate verification.
We just report any errors that occured.
OpenSSL certificate verification callback . OpenSSL has already performed internal certificate verification . We just report any errors that occured .
static int openssl_verify_peer(int ok, X509_STORE_CTX *store)
{
   if (!ok) {
      X509 *cert = X509_STORE_CTX_get_current_cert(store);
      int depth = X509_STORE_CTX_get_error_depth(store);
      int err = X509_STORE_CTX_get_error(store);
      char issuer[256];
      char subject[256];
      if (err == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT ||
          err == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN)
      {
         Jmsg0(NULL, M_ERROR, 0, _("CA certificate is self signed. With OpenSSL 1.1, enforce basicConstraints = CA:true in the certificate creation to avoid this issue\n"));
      }
      X509_NAME_oneline(X509_get_issuer_name(cert), issuer, 256);
      X509_NAME_oneline(X509_get_subject_name(cert), subject, 256);
      Jmsg5(NULL, M_ERROR, 0, _("Error with certificate at depth: %d, issuer = %s,"
            " subject = %s, ERR=%d:%s\n"), depth, issuer,
              subject, err, X509_verify_cert_error_string(err));
   }
   return ok;
}
static int openssl_verify_peer ( int ok , X509_STORE_CTX * store ) { if ( ! ok ) { X509 * cert = X509_STORE_CTX_get_current_cert ( store ) ; int depth = X509_STORE_CTX_get_error_depth ( store ) ; int err = X509_STORE_CTX_get_error ( store ) ; char issuer [ 256 ] ; char subject [ 256 ] ; if ( err == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT || err == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN ) { Jmsg0 ( NULL , M_ERROR , 0 , _ ( " \n " ) ) ; } X509_NAME_oneline ( X509_get_issuer_name ( cert ) , issuer , 256 ) ; X509_NAME_oneline ( X509_get_subject_name ( cert ) , subject , 256 ) ; Jmsg5 ( NULL , M_ERROR , 0 , _ ( " " " \n " ) , depth , issuer , subject , err , X509_verify_cert_error_string ( err ) ) ; } return ok ; }
OpenSSL certificate verification callback.
OpenSSL certificate verification callback .
/* It seems that the error can be also
          * 24 X509_V_ERR_INVALID_CA: invalid CA certificate
          * But it's not very specific...
          */