Skip to content

Commit a1f93fc

Browse files
committed
Remove useless check for valid certificate
If certificate check fails, SSL_Connect will fail, thus the removed code will not run. It would only runs when successful. That function is meant to check the error code when there is a certificate validation issue. SSL_get_verify_result is being used incorrectly here; it is intended to get the validation error reason when SSL_Connect fails, and that failure is due to an invalid certificate.
1 parent 0f810df commit a1f93fc

File tree

1 file changed

+0
-13
lines changed

1 file changed

+0
-13
lines changed

platform/posix/transport/src/openssl_posix.c

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -285,19 +285,6 @@ static OpensslStatus_t tlsHandshake( const ServerInfo_t * pServerInfo,
285285
}
286286
}
287287

288-
/* Verify X509 certificate from peer. */
289-
if( returnStatus == OPENSSL_SUCCESS )
290-
{
291-
verifyPeerCertStatus = ( int32_t ) SSL_get_verify_result( pOpensslParams->pSsl );
292-
293-
if( verifyPeerCertStatus != X509_V_OK )
294-
{
295-
LogError( ( "SSL_get_verify_result failed to verify X509 "
296-
"certificate from peer." ) );
297-
returnStatus = OPENSSL_HANDSHAKE_FAILED;
298-
}
299-
}
300-
301288
return returnStatus;
302289
}
303290

0 commit comments

Comments
 (0)