SSL_GET_VERIFY_RESULT(3ossl)

💅 SSL_GET_VERIFY_RESULT 💅

okay bestie, quick context: this is an OpenSSL manpage, section 3ossl — so like, the library-function part of the manual, not some random command you type. and this one? it's a little one-function wonder that answers the question "so… did the peer's certificate actually check out or not??" 🎀

---

🌸 NAME 🌸

SSL_get_verify_result — get the result of the peer certificate verification 🦋

---

✨ SYNOPSIS ✨

#include <openssl/ssl.h>

long SSL_get_verify_result(const SSL *ssl);

that's it. one include, one function, one long coming back atcha. iconic behavior honestly. 💅

---

🔥 DESCRIPTION 🔥

SSL_get_verify_result() returns the result of the verification of the X509 certificate that the peer presented — if, like, any was presented at all. 💁‍♀️

⚠️ ok crucial thing, do not skip this: ssl MUST NOT be NULL. literally must not. no cap. if you pass NULL you're on your own and it's giving chaos. 😭

---

🌈 NOTES 🌈

so here's the tea, and it's a little bit of a bummer: SSL_get_verify_result() can only ever return one error code — but certificate verification can fail for many reasons all at the same time. 💀 only the last verification error that occurred during processing is the one you can actually get out of SSL_get_verify_result().

sometimes there's a whole sequence of errors that led up to the verification failure that SSL_get_verify_result() reports. so if you want the full lore 🕵️‍♀️, you gotta set up a verify callback via SSL_CTX_set_verify(3) or SSL_set_verify(3) and pull the errors off the error stack in there — because once SSL_connect(3) returns, those errors may no longer be available. gone. poof. bestie where did they go. 🙈

and good news for the reuse girlies: ✨ the verification result is part of the established session, and it gets restored when a session is reused. slay, consistency.

---

💀 BUGS 💀

ok this is the trap and it is a real one:

if no peer certificate was presented, the returned result code is X509_V_OK — and that's lowkey the opposite of reassuring, because it's X509_V_OK simply because no verification error ever occurred. it does NOT indicate success. fr fr, read that again. 😳

so bottom line: SSL_get_verify_result() is only actually useful in connection with SSL_get_peer_certificate(3). use them together or the answer you get is basically a vibe, not a fact. 🫶

---

🎀 RETURN VALUES 🎀

the following return values can currently occur:

• X509_V_OK — the verification succeeded or no peer certificate was presented. (yes, both. see BUGS above. we been knew. 😭)
• Any other value — documented in openssl-verify(1). go check there for the full alphabet of problems. 📖

---

🦋 SEE ALSO 🦋

ssl(7), SSL_set_verify_result(3), SSL_get_peer_certificate(3), openssl-verify(1) — the whole friend group, go say hi 💖

---

👑 COPYRIGHT 👑

Copyright 2000-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie! 🌟 this one's from version 3.5.0, dated 2026-09-25 — go forth and always check SSL_get_peer_certificate(3) alongside your result, mwah 💋🌸✨