title: Listing the certificate chain provided by a server on SSL_connect
body: <p>I'm new to security so some of the terms might be used incorrectly:</p>
  
  <ul>
  <li>When I create a socket connection using <code>SSL_connect</code>, the server should send back the entire certificate chain so that the authenticity of the server can be verified.</li>
  <li>For this to happen, the server needs to be configured accordingly. </li>
  <li>If the server doesn't send back the entire certificate chain and the intermediate certificate isn't in the client certificate store, the authenticity can't be verified. This results in the behavior experienced <a href="https://superuser.com/questions/452063/the-certificate-is-not-trusted-because-no-issuer-chain-was-provided">here</a> in which FireFox regards a website as unsafe.</li>
  <li>I've also read that <a href="https://www.sslshopper.com/ssl-certificate-not-trusted-error.html" rel="nofollow noreferrer">some browsers are able to attain the intermediate certificate automatically</a>. However, OpenSSL doesn't behavior like this, at least by default.</li>
  <li>I've also been told that some (maybe all) intermediate certificates have been installed in Windows certificate stores since some Windows update was rolled out a few years ago.</li>
  </ul>
  
  <p>I would like to view the certificates returned by the server to verify that I'm getting back the entire certificate chain. Here's what I've tried:</p>
  
  <ul>
  <li>I'm using <code>SSLv3_method</code>.</li>
  <li><code>SSL_CTX_set_verify</code> is set using <code>SSL_VERIFY_NONE</code>.</li>
  <li>After <code>SSL_connect</code> I use <code>SSL_get_peer_cert_chain</code> to get access to the certificate chain. </li>
  </ul>
  
  <p>Consider:</p>
  
  <pre><code>STACK_OF(X509)* certificateChain = SSL_get_peer_cert_chain(ssl);
  while (char* stackCertificate = sk_pop(certificateChain))
  {
    X509* certificate = (X509*)stackCertificate;
  }
  </code></pre>
  
  <p>Is this the correct way to get the certificate chain? Is my understanding of the situation correct? Is there perhaps a better way to do this?</p>
  
  <p>Thank you for your time and contribution.</p>