From 696178edff89f8df0382af0edbd0f723790a86cc Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Sat, 6 Feb 2016 03:17:23 +0000 Subject: Add SSL_get0_verified_chain() to return verified chain of peer Reviewed-by: Viktor Dukhovni --- ssl/ssl_cert.c | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'ssl/ssl_cert.c') diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c index 2aaf99cc23..68c8924425 100644 --- a/ssl/ssl_cert.c +++ b/ssl/ssl_cert.c @@ -541,6 +541,15 @@ int ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk) } s->verify_result = ctx.error; + sk_X509_pop_free(s->verified_chain, X509_free); + s->verified_chain = NULL; + if (X509_STORE_CTX_get_chain(&ctx) != NULL) { + s->verified_chain = X509_STORE_CTX_get1_chain(&ctx); + if (s->verified_chain == NULL) { + SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN, ERR_R_MALLOC_FAILURE); + i = 0; + } + } /* Move peername from the store context params to the SSL handle's */ X509_VERIFY_PARAM_move_peername(s->param, param); -- cgit v1.2.3