From nobody Sun Mar 03 08:24:21 2024 X-Original-To: questions@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4TnZcl5bn9z5CHkd for ; Sun, 3 Mar 2024 08:24:39 +0000 (UTC) (envelope-from bc979@lafn.org) Received: from mail.sermon-archive.info (sermon-archive.info [47.181.130.121]) by mx1.freebsd.org (Postfix) with ESMTP id 4TnZck6DDtz4Q7n for ; Sun, 3 Mar 2024 08:24:38 +0000 (UTC) (envelope-from bc979@lafn.org) Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=pass (mx1.freebsd.org: domain of bc979@lafn.org designates 47.181.130.121 as permitted sender) smtp.mailfrom=bc979@lafn.org Received: from smtpclient.apple (unknown [10.0.1.251]) by mail.sermon-archive.info (Postfix) with ESMTPSA id 4TnZcb729Dz2fjSs for ; Sun, 3 Mar 2024 00:24:31 -0800 (PST) From: Doug Hardie Content-Type: multipart/alternative; boundary="Apple-Mail=_A562BC18-FC50-46AF-BEDD-5559F5726F4A" List-Id: User questions List-Archive: https://lists.freebsd.org/archives/freebsd-questions List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-questions@freebsd.org X-BeenThere: freebsd-questions@freebsd.org Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.700.6\)) Subject: Certificate Verification Message-Id: <33BCB1A1-A1DC-4747-87B0-4E93EFE565FE@sermon-archive.info> Date: Sun, 3 Mar 2024 00:24:21 -0800 To: FreeBSD Questions List X-Mailer: Apple Mail (2.3731.700.6) X-Virus-Scanned: clamav-milter 1.2.1 at mail X-Virus-Status: Clean X-Spamd-Bar: --- X-Spamd-Result: default: False [-3.06 / 15.00]; NEURAL_HAM_SHORT(-1.00)[-0.999]; NEURAL_HAM_MEDIUM(-0.98)[-0.983]; NEURAL_HAM_LONG(-0.98)[-0.978]; R_SPF_ALLOW(-0.20)[+mx]; MIME_GOOD(-0.10)[multipart/alternative,text/plain]; ONCE_RECEIVED(0.10)[]; RCVD_NO_TLS_LAST(0.10)[]; MIME_TRACE(0.00)[0:+,1:+,2:~]; RCVD_VIA_SMTP_AUTH(0.00)[]; ASN(0.00)[asn:5650, ipnet:47.181.128.0/18, country:US]; RCPT_COUNT_ONE(0.00)[1]; RCVD_COUNT_ONE(0.00)[1]; APPLE_MAILER_COMMON(0.00)[]; DMARC_NA(0.00)[lafn.org: no valid DMARC record]; TO_MATCH_ENVRCPT_ALL(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; ARC_NA(0.00)[]; PREVIOUSLY_DELIVERED(0.00)[questions@freebsd.org]; MLMMJ_DEST(0.00)[questions@freebsd.org]; TO_DN_ALL(0.00)[]; R_DKIM_NA(0.00)[]; FROM_HAS_DN(0.00)[] X-Rspamd-Queue-Id: 4TnZck6DDtz4Q7n --Apple-Mail=_A562BC18-FC50-46AF-BEDD-5559F5726F4A Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Does SSL_accept actually verify client certificates if they are = presented and if there is a verify_callback function. The man page = seems to indicate it is not verified, and that needs to be done in the = callback. I tried using an expred certificate and openssl correctly = determined it was expired, but the preverify_ok value was still 1 and = the certificate was accepted. The documentation gives the values for = preverify_ok but says nothing about what is checked to determine that = value. I tried to chase down the openssl code, but it is very complex. It = reminds me of the old saying: I can write Fortran in any language. ;-) -- Doug --Apple-Mail=_A562BC18-FC50-46AF-BEDD-5559F5726F4A Content-Transfer-Encoding: 7bit Content-Type: text/html; charset=us-ascii Does SSL_accept actually verify client certificates if they are presented and if there is a verify_callback function.  The man page seems to indicate it is not verified, and that needs to be done in the callback.  I tried using an expred certificate and openssl correctly determined it was expired, but the preverify_ok value was still 1 and the certificate was accepted.  The documentation gives the values for preverify_ok but says nothing about what is checked to determine that value.

I tried to chase down the openssl code, but it is very complex.  It reminds me of the old saying: I can write Fortran in any language. ;-)

-- Doug

--Apple-Mail=_A562BC18-FC50-46AF-BEDD-5559F5726F4A--