Currently, an InvalidCertificateHandler can only be specified globally, via SSLManager.
For some applications, it's necessary to use different strategies when handling invalid certificates, depending on the connection.
There is a way in OpenSSL to obtain the related SSL and SSL_CTX
structures from the X509_STORE_CTX* argument passed to SSLManager::verifyCallback().
So a potential solution could be as follows:
-
Poco::Net::Context stores its this pointer in the underlying SSL_CTX object with
SSL_CTX_set_ex_data().
-
A Poco::Net::Context::Ptr member will be added to Poco::Net::VerificationErrorArgs.
-
In SSLManager::verifyCallback(), obtain the SSL*, from the SSL_CTX*, and
from that the Context::Ptr. Pass the Context::Ptr to the VerificationErrorArgs.
-
This way, the InvalidCertificateHandler has access to the underlying Context.
-
It’s now also possible to specify a custom InvalidCertificateHandler for each Context.
SSLManager::verifyCallback() would check whether there is a non-null InvalidCertificateHandler
specified for the Context. If it is, that InvalidCertificateHandler will be used, otherwise
the default one from the SSLManager.
Currently, an InvalidCertificateHandler can only be specified globally, via SSLManager.
For some applications, it's necessary to use different strategies when handling invalid certificates, depending on the connection.
There is a way in OpenSSL to obtain the related
SSLandSSL_CTXstructures from the
X509_STORE_CTX*argument passed toSSLManager::verifyCallback().So a potential solution could be as follows:
Poco::Net::Contextstores its this pointer in the underlyingSSL_CTXobject withSSL_CTX_set_ex_data().A
Poco::Net::Context::Ptrmember will be added toPoco::Net::VerificationErrorArgs.In
SSLManager::verifyCallback(), obtain theSSL*, from theSSL_CTX*, andfrom that the
Context::Ptr. Pass theContext::Ptrto the VerificationErrorArgs.This way, the
InvalidCertificateHandlerhas access to the underlyingContext.It’s now also possible to specify a custom
InvalidCertificateHandlerfor eachContext.SSLManager::verifyCallback()would check whether there is a non-nullInvalidCertificateHandlerspecified for the
Context. If it is, thatInvalidCertificateHandlerwill be used, otherwisethe default one from the
SSLManager.