SSL_GET_VERIFY_RESULT(3)

💅 SSL_GET_VERIFY_RESULT(3) — the manual page, but make it make sense

okay bestie, so this one's from the libssl / libcrypto corner of the world (yes, that libssl, the one you already have a complicated relationship with 🫶). It lives in SSL_GET_VERIFY_RESULT(3) land, and honestly it's a tiny little page that does one tiny little thing, but the way it does it is highkey a trap if you don't read the fine print. Let's get into it ✨

---

🎀 NAME 🎀

SSL_get_verify_result — get the result of peer certificate verification. that's it. that's the whole job. it tells you what went down when the other side's cert got checked 👑

---

🌸 SYNOPSIS 🌸

library “libssl” libcrypto
#include <openssl/ssl.h>

long
SSL_get_verify_result(const SSL *ssl);

like, you pull in the header, you hand it a pointer to your SSL (const, it's not gonna touch it, it's a good polite function 💖), and it hands you back a long. that long is the whole tea. read on 🍓

---

🦋 DESCRIPTION 🦋

So SSL_get_verify_result() returns the result of verifying the X509 certificate that the peer presented — if any. that "if any" is doing a LOT of heavy lifting, bestie, we'll get to that in BUGS. 💀

Here's the thing that gets people: SSL_get_verify_result() can only ever hand you back one error code, but certificate verification can fail for like, a million reasons at the same time 😭. So which one do you get? Only the last verification error that occurred during processing. that's the one that survives. the rest? gone. ghosts. 👻

And because the verification result is part of the established session, it gets restored when a session is reused — so it follows you around, it's loyal like that. ✨

---

🧚 RETURN VALUES 🧚

here's the whole menu of what you can get back:

• X509_V_OK — the verification succeeded, or no peer certificate was presented. yes, both. we'll talk. 🙈
• Any other value — those are documented over in openssl(1), go look there, I'm not your search engine (affectionate) 💅

---

🌈 SEE ALSO 🌈

the whole friend group, go say hi:

openssl(1), ssl(3), SSL_CTX_set_verify(3), SSL_get0_peername(3), SSL_get_peer_certificate(3), SSL_set_verify_result(3)

---

👑 HISTORY 👑

SSL_get_verify_result() first appeared way back in SSLeay 0.6.1, and it's been available since OpenBSD 2.4. like, this function is vintage. it's been serving looks since before you were born. iconic behavior, no cap. ⭐

---

💀 BUGS 💀

okay so here's the part where you need to be seated, bestie:

If no peer certificate was presented, the returned result code is X509_V_OK.

read that again. 😭 No cert = no verification error occurred = X509_V_OK. But — and this is the entire point — that does not indicate success. It's giving "everything's fine" energy while absolutely nothing is fine. 🫠

Which is why SSL_get_verify_result() is only useful in connection with SSL_get_peer_certificate(3). Check whether a peer cert even exists first, then trust this result. Do not skip that step. Do not pass go. Do not collect $200. 🙏

---

that's the page!! 💜 courtesy of the Debian build, dated June 8, 2025 — mwah, go verify some certs responsibly, and remember: X509_V_OK is not always the slay you think it is ✨🎀