Skip to content

Conversation

@koarz
Copy link
Contributor

@koarz koarz commented Nov 6, 2025

What problem does this PR solve?

Issue Number: resolve
#297

Problem Summary:

Previously, after setting verify_depth, the default behavior was to use only the verification mode SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT. It was not possible to use SSL_VERIFY_PEER alone. Therefore, we needed to add additional configuration to control this behavior. For this reason, a VerifyMode field was added to VerifyOptions, corresponding to the content of sslverify. Since OpenSSL’s verify options are defined as macros, the SSL_ prefix was removed to distinguish them.

What is changed and the side effects?

Changed:
The verify mode set in sslctx when verify_depth > 0

Side effects:

  • Performance effects:

  • Breaking backward compatibility:


Check List:

@koarz koarz marked this pull request as ready for review December 3, 2025 02:51
Copy link
Contributor

@chenBright chenBright left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@wwbmmm wwbmmm merged commit 8b6a9c0 into apache:master Dec 8, 2025
29 of 30 checks passed
@koarz koarz deleted the verify_option branch December 8, 2025 02:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants