SSL_SET_RETRY_VERIFY(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅 SSL_set_retry_verify — like, the OpenSSL one (that's the 3ossl manual, bestie)

Ok so real talk, this whole page is about one tiny function that lets your client say "hold up, let me check that certificate again" mid-handshake. Iconic behaviour, honestly. Let's get into it 🎀

✨ NAME ✨

SSL_set_retry_verify — the vibe is: indicate that certificate verification should be retried. That's it, that's the whole job 🦋

🌸 SYNOPSIS 🌸

#include <openssl/ssl.h>

int SSL_set_retry_verify(SSL *ssl);

One header, one call, one SSL *. Clean. We love a low-effort icon ✨

💖 DESCRIPTION 💖

So here's the situation, bestie. SSL_set_retry_verify() is the function you call from the certificate verification callback on a client when your app wants to say: "pause the handshake, hand the control back to me, I got stuff to do" 🙈

And because of that, SSL_want_retry_verify(3) will return 1 as a consequence — and it keeps returning 1 until the application resumes the handshake again, retrying the verification step. So like, it's not stuck forever, it's just vibing in a paused state till you come back for it 🫶

For the full lore, go read SSL_CTX_set_cert_verify_callback(3). That's where the details live, no cap.

💀 NOTES 💀

Okay so this is the important bit and I need you to actually read it: the effect of calling SSL_set_retry_verify() outside of the certificate verification callback on the client side is undefined. Undefined. Like, we don't know what happens. It's giving chaos. Don't do it 😭

⭐ RETURN VALUES ⭐

SSL_set_retry verify() returns 1 on success, 0 otherwise.

(Yes, the space in there is literally how it's printed on the page — I'm not out here editing the source, that's not my main character energy 💅)

🔥 EXAMPLES 🔥

This snippet shows you how to snag the SSL object that's associated with the X509_STORE_CTX, so you can actually call SSL_set_retry_verify() on it:

int idx = SSL_get_ex_data_X509_STORE_CTX_idx();
SSL *ssl;

/* this should not happen but check anyway */
if (idx < 0
    || (ssl = X509_STORE_CTX_get_ex_data(ctx, idx)) == NULL)
    return 0;

if (/* we need to retry verification callback */)
    return SSL_set_retry_verify(ssl);

/* do normal processing of the verification callback */

Look at that defensive little if too — "this should not happen but check anyway" is such a mood, honestly. Always check, bestie 🌈

👑 SEE ALSO 👑

Go read them, they're literally the context for this whole thing iykyk 📚

🦋 HISTORY 🦋

SSL_set_retry_verify() was added in OpenSSL 3.0.2, and it was added to replace backwards incompatible handling of a negative return value from the verification callback. So yeah, glow-up era: the old way was messy, this is the fix ✨

Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

And that's the whole page!! 🍓 This was brought to you by OpenSSL 3.5.0, dated 2026-09-25, page SSL_SET_RETRY_VERIFY(3ossl) — mwah, go retry that verification, you got this 💅🎀🧚

📦 where this page comes from