Skip to content

[issue-3474] SSL context SSL_VERIFY_POST_HANDSHAKE #3479

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 15 commits into
base: main
Choose a base branch
from
+4 −2
Open

[issue-3474] SSL context SSL_VERIFY_POST_HANDSHAKE #3479

Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
4daeb13
lws_humanize_pad
lws-team Aug 28, 2025
f8b9f58
Fix deaddrop upload issues
lws-team Aug 28, 2025
3f64f64
Fix deaddrop uploads and Windows spawn build errors
google-labs-jules[bot] Aug 28, 2025
c57384a
ss: allow unreachable-unreachable
lws-team Aug 29, 2025
cb2ba8c
codeql: update to v3
lws-team Aug 31, 2025
c6618c8
ctest: allow larger range of SAI_INSTANCE_IDX
lws-team Aug 31, 2025
b173501
ws: introduce write sequence validation
lws-team Aug 31, 2025
310078d
buflist: lws_buflist_get_frag_start_or_NULL
lws-team Sep 1, 2025
91d4c95
boringssl: Undefine conflicting wincrypt.h symbols for MSVC
maddouri Sep 3, 2025
812c538
.sai.json update
lws-team Aug 29, 2025
c7ff6c6
cce: UDS: improve error fidelity
lws-team Sep 4, 2025
9ef5f5f
ss conn matrix extra
lws-team Sep 3, 2025
1faedc3
windows: spawn: fix res handling for cb
lws-team Sep 5, 2025
fcedda4
Merge remote-tracking branch 'upstream/main'
gennadiyvt Oct 13, 2025
96ed1e0
In `/lib/tls/mbedtls/wrapper/platform/ssl_pm.c` add `SSL_VERIFY_POST_…
gennadiyvt Oct 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions lib/tls/mbedtls/wrapper/platform/ssl_pm.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1061,14 +1061,16 @@ void SSL_set_SSL_CTX(SSL *ssl, SSL_CTX *ctx)

#if defined(LWS_HAVE_mbedtls_ssl_set_hs_authmode)

if ((ctx->verify_mode & SSL_VERIFY_PEER) > 0)
if ((ctx->verify_mode & SSL_VERIFY_POST_HANDSHAKE) > 0)
mode = MBEDTLS_SSL_VERIFY_OPTIONAL;
else if ((ctx->verify_mode & SSL_VERIFY_PEER) > 0)
mode = MBEDTLS_SSL_VERIFY_REQUIRED;
else if ((ctx->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) > 0)
mode = MBEDTLS_SSL_VERIFY_REQUIRED;
else if (ctx->verify_mode == SSL_VERIFY_CLIENT_ONCE)
mode = MBEDTLS_SSL_VERIFY_UNSET;
else
mode = MBEDTLS_SSL_VERIFY_NONE;
mode = MBEDTLS_SSL_VERIFY_NONE;
#endif

/* apply new ctx cert to ssl */
Expand Down