SSL_SET_RETRY_VERIFY(3ossl)

💅 SSL_set_retry_verify(3ossl) 💅

okay bestie, this is the OpenSSL manual page for SSL_SET_RETRY_VERIFY(3ossl) — yes, the manual name is right there — and it's all about telling certificate verification to take another pass. ✨

🌸 NAME 🌸

SSL_set_retry_verify — indicate that certificate verification should be retried. 🎀

🦋 SYNOPSIS 🦋

#include <openssl/ssl.h>

int SSL_set_retry_verify(SSL *ssl);

✨ DESCRIPTION ✨

SSL_set_retry_verify() should be called from the certificate verification callback on a client when the application wants to indicate that the handshake should be suspended and the control should be returned to the application. Like, the callback is saying “pause bestie, give control back” and the app gets it. 🫶

As a consequence, SSL_want_retry_verify(3) will return 1 until the handshake is resumed again by the application, retrying the verification step. So it stays 1 in the meantime. 🔁

For further details, please refer to SSL_CTX_set_cert_verify_callback(3). iykyk 💜

🌈 NOTES 🌈

The effect of calling SSL_set_retry_verify() outside of the certificate verification callback on the client side is undefined. No cap — undefined is not the vibe, do not do it. 💀

🍓 RETURN VALUES 🍓

SSL_set_retry verify() returns 1 on success, 0 otherwise. (Yep, exactly like that in the manual page — space and all.) ✨

🧚 EXAMPLES 🧚

This snippet is the exact move for getting the SSL object associated with the X509_STORE_CTX, so you can call the SSL_set_retry_verify() function:

int idx = SSL_get_ex_data_X509_STORE_CTX_idx();
SSL *ssl;

/* this should not happen but check anyway */
if (idx < 0
    || (ssl = X509_STORE_CTX_get_ex_data(ctx, idx)) == NULL)
    return 0;

if (/* we need to retry verification callback */)
    return SSL_set_retry_verify(ssl);

/* do normal processing of the verification callback */

👑 SEE ALSO 👑

ssl(7), SSL_connect(3), SSL_CTX_set_cert_verify_callback(3), SSL_want_retry_verify(3) — go read those too, bestie. 📚💅

🎀 HISTORY 🎀

SSL_set_retry_verify() was added in OpenSSL 3.0.2 to replace backwards incompatible handling of a negative return value from the verification callback. Iconic upgrade behavior. ⭐

💖 COPYRIGHT 💖

Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

---

okay that's the whole page, bestie — this lil gem is from OpenSSL 3.5.6, dated 2026-04-07, and the manual name is SSL_SET_RETRY_VERIFY(3ossl). periodt 💅✨