SSL_SET_RETRY_VERIFY(3SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

💖 SSL_SET_RETRY_VERIFY(3SSL) 💖

okay bestie, welcome to SSL_SET_RETRY_VERIFY(3SSL) — the OpenSSL page about the lil function that lets a client say "hold up, let's run that cert check again" mid-handshake. it's giving "pause, not cancel" energy and honestly? iconic. 🎀

✨ NAME ✨

SSL_set_retry_verify — say that certificate verification should be retried 🔁

✨ SYNOPSIS ✨

#include <openssl/ssl.h>

int SSL_set_retry_verify(SSL *ssl);

✨ DESCRIPTION ✨

so here's the vibe: you're inside the certificate verification callback on a client, and your app is like "hmm actually I wanna pause this whole handshake and get the control back so I can go do my own thing real quick." that's when you call SSL_set_retry_verify(). 🫶

it's the official "brb" of TLS handshakes. you're suspending the handshake and handing control back to the application.

and as a direct consequence of calling it, SSL_want_retry_verify(3) will return 1 — and it keeps returning 1 until the application resumes the handshake again, retrying that verification step. no cap. ✨

want the full lore? go read SSL_CTX_set_cert_verify_callback(3) for further details. iykyk. 📚

✨ NOTES ✨

⚠️ calling SSL_set_retry_verify() anywhere outside of the certificate verification callback on the client side? the effect is undefined. literally undefined. not "undefined-ish", not "probably fine", UNDEFINED. please don't. 😭

✨ RETURN VALUES ✨

SSL_set_retry_verify() returns 1 on success, 0 otherwise. that's it, that's the whole vibe check. 💅

(narrator voice: the original page lowkey has a lil typo in this section — say it with me — but you and I both know exactly which function it means. moving on bestie.)

✨ EXAMPLES ✨

ok so you need to get the SSL object that's chillin' inside your X509_STORE_CTX so you can actually call SSL_set_retry_verify(). here's exactly how, babes:

    int idx = SSL_get_ex_data_X509_STORE_CTX_idx();
    SSL *ssl;

    /* this should not happen but check anyway */
    if (idx < 0
        || (ssl = X509_STORE_CTX_get_ex_data(ctx, idx)) == NULL)
        return 0;

    if (/* we need to retry verification callback */)
        return SSL_set_retry_verify(ssl);

    /* do normal processing of the verification callback */

see that comment up top — "this should not happen but check anyway"? yeah, we always check anyway. defensive coding is main character energy. 👑🦋

✨ SEE ALSO ✨

✨ HISTORY ✨

SSL_set_retry_verify() showed up in OpenSSL 3.0.2 ✨ — and it was added to replace the backwards incompatible handling of a negative return value from the verification callback. glow-up fr fr. 💅

Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole thing, bestie 🎀 — this lil masterpiece is from the OpenSSL 4.0.3 era, dated 2026-09-29, and it ate. now go retry that verification, you got this 💖✨🦋

📦 where this page comes from