[Date Prev][Date Next] [Chronological] [Thread] [Top]

error reporting in tls_get_cert()


I've been trying to track down the reason for SSL/TLS not working on my system from current CVS.

In the function tls_get_cert() verifies certs, but lumps all errors returned from SSL_get_verify_result() as "bad certificate".

The test in tls_get_cert() looks like...

tls_get_cert( SSL *s )
        /* If peer cert was bad, treat as if no cert was given */
        if (SSL_get_verify_result(s)) {
                /* If we can send an alert, do so */

The value returned from SSL_get_verify_result() is thrown away. But this value is important for debugging and should be reported to the user. The error messages for the return value can be found in the "openssl verify" manpage or http://www.openssl.org/docs/apps/verify.html

I know logging is in flux right now. But can this be reported to the user at some debug level? I am willing to do the patch if advised.