From c1f29f4263f77c9a990a0c7ef4ad5b7a1f00c795 Mon Sep 17 00:00:00 2001 From: Sunset Ash Date: Wed, 18 Mar 2026 23:13:06 -0600 Subject: [PATCH] SecureSocket: Fire callback as part of cert verification This was wrongly removed in hrev54730. Should fix #17928. Change-Id: I53986bfc32b04405cf3564a95d47b46132e50587 Reviewed-on: https://review.haiku-os.org/c/haiku/+/10549 Reviewed-by: Adrien Destugues Tested-by: Commit checker robot --- src/kits/network/libnetapi/SecureSocket.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/kits/network/libnetapi/SecureSocket.cpp b/src/kits/network/libnetapi/SecureSocket.cpp index ff429d83d5..ea7a71e0eb 100644 --- a/src/kits/network/libnetapi/SecureSocket.cpp +++ b/src/kits/network/libnetapi/SecureSocket.cpp @@ -321,6 +321,12 @@ BSecureSocket::Private::_CreateContext() // Setup certificate verification SSL_CTX_set_default_verify_file(sContext); + // Setup certificate callback + // OpenSSL defaults to SSL_VERIFY_NONE, which will trust any certificate + // regardless of the callback result. SSL_VERIFY_PEER respects the callback + // result. + SSL_CTX_set_verify(sContext, SSL_VERIFY_PEER, VerifyCallback); + // OpenSSL 1.0.2 and later: use the alternate "trusted first" algorithm to // validate certificate chains. This makes the validation stop as soon as a // recognized certificate is found in the chain, instead of validating the