mirror of
https://github.com/yhirose/cpp-httplib.git
synced 2026-10-22 11:46:13 +00:00
yhirose
fd71c11e0e
The OpenSSL client finished the handshake with SSL_VERIFY_NONE and checked the server certificate only afterwards, so it presented its client certificate to a server that then failed verification. With a server certificate verifier that accepted, wolfSSL did the same. Verify the chain, and the host name, during the handshake on every backend, keeping the built-in verdict when a verifier runs alongside it. On OpenSSL a session verifier, which may accept a certificate the built-in check rejects, still decides after the handshake. A certificate that fails the built-in verification now reports CertVerifyFailed, or HostnameMismatch for its name, in ssl_error() on every backend, where OpenSSL left it 0.
