Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I was going through the openssl server-client program given here---> http://simplestcodings.blogspot.com.br/2010/08/secure-server-client-using-openssl-in-c.html. I can see both the client and server get the certificates from peer. But i was wondering if i have to call a separate api to verify the certificates? In the above link, both client and server get the certificates and print them and start exchanging data. Where exactly is the certificate verification taking place here?
Thanks
The sample code you link to does not do any kind of verification.
It fails to verify the certificate chain because it does not use SSL_CTX_set_verify to enable verification (and the default is off). This way it accepts any certificate.
It also fails to verify the hostname against the certificate. Even if chain validation would be done this would mean that the attacker could use any certificate with a valid chain (which are easy to get) to man in the middle SSL connections to any host.
