add API support for verify certificate manually

[h20282]

Thanks for this great library! 👍

Would it be possible to extend the API like SSLClient::set_server_certificate_verification(std::function<bool (SSL_CTX *ctx)>) to allow verify certificate manually? just like asio::ssl::context::set_verify_callback.

I think it would be very useful when verify static self-signed certificate.

[yhirose]

@h20282, thanks for the feedback. I think it's possible and label this issue 'enhancement'. I currently don't have time to work on it. So I would really appreciate it if you can implement the method and send me a pull request. :)

[RainerSchielke]

Hi there, my code verifies the certificate manually.

Here is the simple solution:
When initializing the server we install a verify callback function which always returns 1 (OK)

        SSL_CTX_set_verify (m_pSSLServer->ssl_context (), SSL_VERIFY_PEER, [](int preverify_ok, X509_STORE_CTX *ctx)
        {
            // Return always OK, because we check the cert in request

            return (1);
        });

When handling the request, we take the certificate with

X509 *pCert = SSL_get_peer_certificate (req.ssl);

and verify the certificate manually.

[yhirose]

I just implemented this feature at #1926. To be honest, I don't think it's very useful... I'll keep it for a while to see if it's worth merging.

[solarispika]

I’d like to demonstrate a valuable use case for this feature and offer an implementation if you find it helpful.

Windows maintains a base set of trusted root certificates and can automatically update these roots when verifying a certificate from an unfamiliar authority. This mechanism, known as Automatic Root Certificates Update, is enabled by default and helps ensure the system has the latest trusted roots without manual updates.

Currently, the library loads Windows root certificates when constructing client objects, which may prevent connections to sites whose root certificates aren’t yet present locally.

With this verifier feature, clients can leverage the Windows API for server certificate validation and take full advantage of Automatic Root Certificates Update. This means that clients connecting to servers with unfamiliar certificate chains can benefit from Windows’ ability to retrieve missing root certificates on demand, improving compatibility and reducing connection errors due to missing certificates.

I’ve implemented a function that achieves this by using the Windows API to validate certificates. If it would be useful to you, I’d be happy to share the code.

[yhirose]

@solarispika thanks for the feedback! Could you send a pull request showing your example? If it's convenient, you can put your code in the 'example' directory or put it as a uni test case in 'test/test.cc'. Thanks!

[solarispika]

I don't know how to put the code correctly in the example diretory, and don't know how to test it automatically. You can test it by delete(after backing up) a root certificate and connect to a site using that root and see if it comes back.
I've uploaded some codes here FYI: https://gist.github.com/solarispika/68ecf0acdd3225e4293ad747d4b35850

The traditional.cpp is generated by AI which requires less dependencies, while the modern.cpp is revised based on previous one by me and it requires more dependencies.