SSL_SET_RETRY_VERIFY(3ossl)

💖 SSL_SET_RETRY_VERIFY(3ossl) 💖

okay bestie, sit DOWN, because we're talking about SSL_set_retry_verify from the OpenSSL manual, section 3ossl. it's giving "tiny function, big main character energy" and honestly? we're obsessed. 🎀

---

✨ NAME ✨

SSL_set_retry_verify — the lil guy that says "hold up, certificate verification should be retried" 🦋

---

✨ SYNOPSIS ✨

#include <openssl/ssl.h>

int SSL_set_retry_verify(SSL *ssl);

---

✨ DESCRIPTION ✨

so here's the tea ☕ — you call SSL_set_retry_verify() from the certificate verification callback on a client, and you call it when the application wants to say "actually no, pause the handshake, give control back to me please." 💅

and then, as a direct consequence of that, SSL_want_retry_verify(3) returns 1 — and it keeps returning 1 until the application resumes the handshake again, retrying the verification step. periodt. ✨

for the full lore, please refer to SSL_CTX_set_cert_verify_callback(3) for further details. iykyk 🫶

---

✨ NOTES ✨

💀 the effect of calling SSL_set_retry_verify() outside of the certificate verification callback on the client side is undefined. not "probably fine", not "sorta vibes", undefined. do not do it. no cap.

---

✨ RETURN VALUES ✨

SSL_set_retry verify() returns 1 on success, 0 otherwise. that's it, that's the whole vibe check. 😌

---

✨ EXAMPLES ✨

here's a code snippet showing how to grab the SSL object associated with the X509_STORE_CTX so you can actually call SSL_set_retry_verify() — literally the whole point of this function, slay:

int idx = SSL_get_ex_data_X509_STORE_CTX_idx();
SSL *ssl;

/* this should not happen but check anyway */
if (idx < 0
    || (ssl = X509_STORE_CTX_get_ex_data(ctx, idx)) == NULL)
    return 0;

if (/* we need to retry verification callback */)
    return SSL_set_retry_verify(ssl);

/* do normal processing of the verification callback */

see how the comment even says "this should not happen but check anyway"? that's the energy. defensive coding bestie 💜

---

✨ SEE ALSO ✨

• ssl(7)
• SSL_connect(3)
• SSL_CTX_set_cert_verify_callback(3)
• SSL_want_retry_verify(3)

---

✨ HISTORY ✨

SSL_set_retry_verify() was added in OpenSSL 3.0.2 to replace backwards incompatible handling of a negative return value from the verification callback. glow-up fr fr 🌸

---

✨ COPYRIGHT ✨

Copyright 2022 The OpenSSL Project Authors. All Rights Reserved. 👑

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, babe 💖 this iconic lil manpage lives in version 3.5.9, dated 2026-09-29 — stan SSL_set_retry_verify(3ossl), protect her at all costs. 🎀✨🦋