SSLClient get connection server certificate without redoing lib work

[urosg80]

As I understand to get the server certificate for a SSLClient request I can use set_server_certificate_verifier and use my own function but I must then redo all the server certificate validation that is normally done inside the lib.

Is there another way?

[yhirose]

@urosg80 As you mentioned, once we use set_server_certificate_verifier, then it skips the normal verification in cpp-httplib and we are totally responsible for the verification... Here is the code.

cpp-httplib/httplib.h

Lines 9626 to 9653 in 748f47b

	if (server_certificate_verifier_) {
	if (!server_certificate_verifier_(ssl2)) {
	error = Error::SSLServerVerification;
	return false;
	}
	} else {
	verify_result_ = SSL_get_verify_result(ssl2);
	if (verify_result_ != X509_V_OK) {
	error = Error::SSLServerVerification;
	return false;
	}
	auto server_cert = SSL_get1_peer_certificate(ssl2);
	auto se = detail::scope_exit([&] { X509_free(server_cert); });
	if (server_cert == nullptr) {
	error = Error::SSLServerVerification;
	return false;
	}
	if (server_hostname_verification_) {
	if (!verify_host(server_cert)) {
	error = Error::SSLServerHostnameVerification;
	return false;
	}
	}
	}

If we want to do both our manual check and the built-in check, this code needs to be adjusted.

You can find the background of this method at #1431.

[urosg80]

Yes I found the reference and the code responsible inside the library to do the verification but to avoid code duplication I implemented a simple change to the "server_certificate_verifier" signature and built-in verification code part.

#urosg80@c27d1fd

if you think this could be useful for others I can publish a pull request

[yhirose]

@urosg80 yes, it's useful to others! Could you please send a pull request for the change?

[urosg80]

pull request published #2064

[yhirose]

#2064 has been merged.