Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
In OpenSSL the following function is used to verify certs.
SSL_get_verify_result
I looked at the manual here. But it does not detail what is being verified. Can you clarify to me what does this function verify? (e.g. expiration date, trust chain, etc.). It is important to me to know how the result is generated exactly and what are the factors that the verification is built on?
The answer is at the bottom of the man page you linked to in the RETURN VALUES section, where it says "Any other value: Documented in verify(1).
In the VERIFY OPERATION section of the verify page, it answers your question:
The verify program uses the same functions as the internal SSL and S/MIME verification, therefore this description applies to these verify operations too
All the details you have asked about are then documented in the VERIFY OPERATION section.
Mods, I know that link answers are normally frowned upon, but the querent asked how to find a specific link.
EDIT:
Please check out Dave Thompson's answer below, as it is important to understand that this call only returns the result of the most recent validation run; it does not actually execute a certificate validation on its own.
SSL_get_verify_result() doesn't actually do any verification; it returns (part of) the result of the cert verification (if any) done during the most recent full handshake (if any) on the given SSL object. Assuming you really want to know what that verification did, it depends a good bit on the application code.
If the code sets a callback with SSL_CTX_set_cert_verify_callback before creating the SSL object, then the verification during handshake consists entirely of calling that callback -- whatever the callback does is what it does. If this callback is not set, as the man page says, a 'built-in verification function' is used, which is actually X509_verify_cert() (which has its own not very helpful man page) and what that does is roughly what is described on the verify(1) man page as referenced by John, plus some things that have been added over time but didn't always make it into the doc (e.g. NameConstraints and DANE, not to mention some revocation checking), but this checking can be altered and 'tweaked' by numerous options and parameters, not all of which are usable for verify(1), and most settable at either the SSL_CTX or SSL level, including an optional 'verify_callback' which is separate and quite different from the 'cert_verify_callback' mentioned above. See the man pages for SSL_[CTX_]set_verify[_depth], SSL_[CTX_]load_verify_locations et rel,
the X509_STORE_* and X509_STORE_CTX_* functions including X509_STORE_CTX_set0_param and related X509_VERIFY_PARAM* functions especially X509_VERIFY_PARAM_set_flags.
And if that's not exact enough, and it may well not be, check the source -- for the version you are (or will be) running, since there have been some changes in this (quite complex) area over time. Explaining exactly everything it does, even in a particular version, would (almost certainly) exceed the Stack answer limit and would take me about a week, as well as likely becoming obsolete soon, so I won't do that. If you have one or a very few specific issues, that could be answerable in a practical amount of time.
