SecureSocket: Fire callback as part of cert verification

This was wrongly removed in hrev54730. Should fix #17928. Change-Id: I53986bfc32b04405cf3564a95d47b46132e50587 Reviewed-on: https://review.haiku-os.org/c/haiku/+/10549 Reviewed-by: Adrien Destugues <[email protected]> Tested-by: Commit checker robot <[email protected]>
2026-03-19 18:26:55 +00:00
parent f833d107c6
commit c1f29f4263
1 changed files with 6 additions and 0 deletions
@@ -321,6 +321,12 @@ BSecureSocket::Private::_CreateContext()
 	// Setup certificate verification
 	SSL_CTX_set_default_verify_file(sContext);

+	// Setup certificate callback
+	// OpenSSL defaults to SSL_VERIFY_NONE, which will trust any certificate
+	// regardless of the callback result. SSL_VERIFY_PEER respects the callback
+	// result.
+	SSL_CTX_set_verify(sContext, SSL_VERIFY_PEER, VerifyCallback);
+
 	// OpenSSL 1.0.2 and later: use the alternate "trusted first" algorithm to
 	// validate certificate chains. This makes the validation stop as soon as a
 	// recognized certificate is found in the chain, instead of validating the