SSL_CTX_set_cert_cb(3) OpenSSL SSL_CTX_set_cert_cb(3) NNAAMMEE SSL_CTX_set_cert_cb, SSL_set_cert_cb - handle certificate callback function SSYYNNOOPPSSIISS #include void SSL_CTX_set_cert_cb(SSL_CTX *c, int (*cert_cb)(SSL *ssl, void *arg), void *arg); void SSL_set_cert_cb(SSL *s, int (*cert_cb)(SSL *ssl, void *arg), void *arg); int (*cert_cb)(SSL *ssl, void *arg); DDEESSCCRRIIPPTTIIOONN _S_S_L___C_T_X___s_e_t___c_e_r_t___c_b_(_) and _S_S_L___s_e_t___c_e_r_t___c_b_(_) sets the _cc_ee_rr_tt____cc_bb_((_)) call- back, aarrgg value is pointer which is passed to the application callback. When _cc_ee_rr_tt____cc_bb_((_)) is NULL, no callback function is used. _c_e_r_t___c_b_(_) is the application defined callback. It is called before a certificate will be used by a client or server. The callback can then inspect the passed ssssll structure and set or clear any appropriate cer- tificates. If the callback is successful it MMUUSSTT return 1 even if no certificates have been set. A zero is returned on error which will abort the handshake with a fatal internal error alert. A negative return value will suspend the handshake and the handshake function will return immediately. _S_S_L___g_e_t___e_r_r_o_r(3) will return SSL_ERROR_WANT_X509_LOOKUP to indicate, that the handshake was sus- pended. The next call to the handshake function will again lead to the call of _c_e_r_t___c_b_(_). It is the job of the _c_e_r_t___c_b_(_) to store information about the state of the last call, if required to continue. NNOOTTEESS An application will typically call _S_S_L___u_s_e___c_e_r_t_i_f_i_c_a_t_e_(_) and _S_S_L___u_s_e___P_r_i_v_a_t_e_K_e_y_(_) to set the end entity certificate and private key. It can add intermediate and optionally the root CA certificates using _S_S_L___a_d_d_1___c_h_a_i_n___c_e_r_t_(_). It might also call _S_S_L___c_e_r_t_s___c_l_e_a_r_(_) to delete any certificates associ- ated with the SSSSLL object. The certificate callback functionality supercedes the (largely broken) functionality provided by the old client certificate callback inter- face. It is aallwwaayyss called even is a certificate is already set so the callback can modify or delete the existing certificate. A more advanced callback might examine the handshake parameters and set whatever chain is appropriate. For example a legacy client supporting only TLS v1.0 might receive a certificate chain signed using SHA1 whereas a TLS v1.2 client which advertises support for SHA256 could receive a chain using SHA256. Normal server sanity checks are performed on any certificates set by the callback. So if an EC chain is set for a curve the client does not support it will nnoott be used. SSEEEE AALLSSOO _s_s_l(3), _S_S_L___u_s_e___c_e_r_t_i_f_i_c_a_t_e(3), _S_S_L___a_d_d_1___c_h_a_i_n___c_e_r_t(3), _S_S_L___g_e_t___c_l_i_e_n_t___C_A___l_i_s_t(3), _S_S_L___c_l_e_a_r(3), _S_S_L___f_r_e_e(3) 1.0.2u 2019-12-20 SSL_CTX_set_cert_cb(3)