@@ -435,6 +435,15 @@ struct scope_exit {
435
435
436
436
} // namespace detail
437
437
438
+ enum SSLVerifierResponse {
439
+ // no decision has been made, use the built-in certificate verifier
440
+ NoDecisionMade,
441
+ // connection certificate is verified and accepted
442
+ CertificateAccepted,
443
+ // connection certificate was processed but is rejected
444
+ CertificateRejected
445
+ };
446
+
438
447
enum StatusCode {
439
448
// Information responses
440
449
Continue_100 = 100 ,
@@ -1483,7 +1492,8 @@ class ClientImpl {
1483
1492
#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
1484
1493
void enable_server_certificate_verification (bool enabled);
1485
1494
void enable_server_hostname_verification (bool enabled);
1486
- void set_server_certificate_verifier (std::function<bool (SSL *ssl)> verifier);
1495
+ void set_server_certificate_verifier (
1496
+ std::function<SSLVerifierResponse(SSL *ssl)> verifier);
1487
1497
#endif
1488
1498
1489
1499
void set_logger (Logger logger);
@@ -1600,7 +1610,7 @@ class ClientImpl {
1600
1610
#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
1601
1611
bool server_certificate_verification_ = true ;
1602
1612
bool server_hostname_verification_ = true ;
1603
- std::function<bool (SSL *ssl)> server_certificate_verifier_;
1613
+ std::function<SSLVerifierResponse (SSL *ssl)> server_certificate_verifier_;
1604
1614
#endif
1605
1615
1606
1616
Logger logger_;
@@ -1913,7 +1923,8 @@ class Client {
1913
1923
#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
1914
1924
void enable_server_certificate_verification (bool enabled);
1915
1925
void enable_server_hostname_verification (bool enabled);
1916
- void set_server_certificate_verifier (std::function<bool (SSL *ssl)> verifier);
1926
+ void set_server_certificate_verifier (
1927
+ std::function<SSLVerifierResponse(SSL *ssl)> verifier);
1917
1928
#endif
1918
1929
1919
1930
void set_logger (Logger logger);
@@ -9008,7 +9019,7 @@ inline void ClientImpl::enable_server_hostname_verification(bool enabled) {
9008
9019
}
9009
9020
9010
9021
inline void ClientImpl::set_server_certificate_verifier (
9011
- std::function<bool (SSL *ssl)> verifier) {
9022
+ std::function<SSLVerifierResponse (SSL *ssl)> verifier) {
9012
9023
server_certificate_verifier_ = verifier;
9013
9024
}
9014
9025
#endif
@@ -9617,12 +9628,18 @@ inline bool SSLClient::initialize_ssl(Socket &socket, Error &error) {
9617
9628
}
9618
9629
9619
9630
if (server_certificate_verification_) {
9631
+ auto verification_status = SSLVerifierResponse::NoDecisionMade;
9632
+
9620
9633
if (server_certificate_verifier_) {
9621
- if (!server_certificate_verifier_ (ssl2)) {
9622
- error = Error::SSLServerVerification;
9623
- return false ;
9624
- }
9625
- } else {
9634
+ verification_status = server_certificate_verifier_ (ssl2);
9635
+ }
9636
+
9637
+ if (verification_status == SSLVerifierResponse::CertificateRejected) {
9638
+ error = Error::SSLServerVerification;
9639
+ return false ;
9640
+ }
9641
+
9642
+ if (verification_status == SSLVerifierResponse::NoDecisionMade) {
9626
9643
verify_result_ = SSL_get_verify_result (ssl2);
9627
9644
9628
9645
if (verify_result_ != X509_V_OK) {
@@ -10383,7 +10400,7 @@ inline void Client::enable_server_hostname_verification(bool enabled) {
10383
10400
}
10384
10401
10385
10402
inline void Client::set_server_certificate_verifier (
10386
- std::function<bool (SSL *ssl)> verifier) {
10403
+ std::function<SSLVerifierResponse (SSL *ssl)> verifier) {
10387
10404
cli_->set_server_certificate_verifier (verifier);
10388
10405
}
10389
10406
#endif
0 commit comments