SSL_CTX_set_verify() callback and current depth

Question

I'm writing my own callback function in C for SSL_CTX_set_verify() to perform additional certificate checks (when the preverify_ok parameter is 1). However, I want to perform the checks only for the leaf certificate (depth = 0).

There is the function X509_STORE_CTX_get_error_depth() that gets the depth of the error; but I want the current depth even when there is no error so I can perform my additional checks only when depth=0. (Note that the function SSL_CTX_get_verify_depth() returns the depth limit and not the current depth.)

Is there any way to do what I want?

Answer 1

In spite of the name, during the verify process error_depth is indeed the current certificate being checked. See the while loop in internal_verify in crypto/x509/x509_vfy.c. If either the callback or any builtin check -- here signature or expired, in other places in X509_verify_cert revocation, policy, etc. -- decides a cert is bad, verify logic returns with error_depth left at the cert that caused verify to return, and a subsequent call from 'above' finds that value which identifies the 'error' cert.