SSL_GET_VERIFY_RESULT(3ossl)

📦
version 3.5.9 · 8 versions
, in fedora 43, fedora 44

💖 SSL_GET_VERIFY_RESULT 💖

okay bestie, so this is the SSL_get_verify_result(3ossl) page from the OpenSSL manual, and it's literally the little function that tells you whether your peer's certificate passed the vibe check or flopped. it's short, it's iconic, let's go ✨

🌸 NAME 🌸

SSL_get_verify_result — get the result of peer certificate verification, i.e. the receipts on whether that cert was valid or not 🎀

🦋 SYNOPSIS 🦋

#include <openssl/ssl.h>

long SSL_get_verify_result(const SSL *ssl);

💅 DESCRIPTION 💅

So SSL_get_verify_result() returns the result of the verification of the X509 certificate that the peer presented, if there even was one. that's the whole job. she's simple, she's focused, she's doing one thing and doing it well 👑

⚠️ ssl MUST NOT be NULL. like, for real. don't do that. that's not a vibe.

✨ NOTES ✨

okay this is the part where it gets lowkey messy, so listen up:

  • SSL_get_verify_result() can only hand you back one error code at a time, but cert verification can fail for like a million reasons all at once. the way that it only gives you the last verification error that happened during processing?? yeah. that's it. that's all you get from this function 💀
  • sometimes there's a whole sequence of errors that stacked up and led to the verification failure that SSL_get_verify_result() reports. if you want to see all of them, you gotta set up a verify callback via SSL_CTX_set_verify(3) or SSL_set_verify(3) and pull the errors off the error stack from in there — because once SSL_connect(3) returns, those errors may no longer be available. grab them while you can, bestie, they do NOT wait around 🫶
  • the verification result is part of the established session, so it gets restored when a session is reused. cute, consistent, no notes 💖

🙈 BUGS 🙈

ngl there's a little trap here and it will catch you:

if no peer certificate was presented, the returned result code is X509_V_OK. and before you start celebrating — that's because no verification error occurred. it does not mean success. it does NOT. it is not giving success energy 😭

so SSL_get_verify_result() is only actually useful in connection with SSL_get_peer_certificate(3). use them together or don't use them at all, fr fr.

🌈 RETURN VALUES 🌈

here's what can currently come back at you:

  • X509_V_OK — the verification succeeded, or no peer certificate was presented. (see the BUGS section, bestie, this one's a jump scare 👻)
  • Any other value — these are documented over in openssl-verify(1). go read that for the full menu ✨

🎀 SEE ALSO 🎀

Copyright 2000-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, periodt 💜 this was OpenSSL 3.5.9, dated 2026-09-29, signing off from the SSL_GET_VERIFY_RESULT(3ossl) manual. go check your certs, bestie, and stay verified 🌸🦋✨

📦 where this page comes from