-
Notifications
You must be signed in to change notification settings - Fork 2.3k
Description
Currently, an InvalidCertificateHandler can only be specified globally, via SSLManager.
For some applications, it's necessary to use different strategies when handling invalid certificates, depending on the connection.
There is a way in OpenSSL to obtain the related SSL and SSL_CTX
structures from the X509_STORE_CTX* argument passed to SSLManager::verifyCallback().
So a potential solution could be as follows:
-
Poco::Net::Contextstores its this pointer in the underlyingSSL_CTXobject with
SSL_CTX_set_ex_data(). -
A
Poco::Net::Context::Ptrmember will be added toPoco::Net::VerificationErrorArgs. -
In
SSLManager::verifyCallback(), obtain theSSL*, from theSSL_CTX*, and
from that theContext::Ptr. Pass theContext::Ptrto the VerificationErrorArgs. -
This way, the
InvalidCertificateHandlerhas access to the underlyingContext. -
It’s now also possible to specify a custom
InvalidCertificateHandlerfor eachContext.
SSLManager::verifyCallback()would check whether there is a non-nullInvalidCertificateHandler
specified for theContext. If it is, thatInvalidCertificateHandlerwill be used, otherwise
the default one from theSSLManager.