SSL_CTX_set_cert_verify_callback 与 SSL_CTX_set_verify
谁能告诉我 SSL_CTX_set_cert_verify_callback 和 SSL_CTX_set_verify 有什么区别？ 来自 OpenSSL 文档：
SSL_CTX_set_cert_verify_callback() 设置ctx的验证回调函数。从 ctx 创建的 SSL 对象继承调用 SSL_new(3) 时有效的设置。
和：
SSL_CTX_set_verify() 将 ctx 的验证标志设置为模式并指定要使用的 verify_callback 函数。如果不指定回调函数，verify_callback可以使用NULL指针。
所以我试图了解为每个回调发送哪个回调（从客户端）。
谢谢各位专家。
Can anyone tell me what is the difference between SSL_CTX_set_cert_verify_callback and SSL_CTX_set_verify?
From OpenSSL docs:
SSL_CTX_set_cert_verify_callback() sets the verification callback function for ctx. SSL objects that are created from ctx inherit the setting valid at the time when SSL_new(3) is called.
and:
SSL_CTX_set_verify() sets the verification flags for ctx to be mode and specifies the verify_callback function to be used. If no callback function shall be specified, the NULL pointer can be used for verify_callback.
So I'm trying to understand which callback to send for each one (from client side).
Thanks experts.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
SSL_CTX_set_cert_verify_callback() 更改默认的证书验证函数。您可能不应该这样做。它非常复杂，您需要检查每个证书的签名，验证链，可能还检查 CRL。这是 SSL 中最复杂的部分。
SSL_CTX_set_verify()用于设置SSL的模式。如果模式是 SSL_VERIFY_PEER（2 路 SSL），您还应该在此函数中设置回调以进一步验证客户端证书（根据白名单检查 CN 等）。对于其他模式，不使用该CB。既然你说你处于客户端模式，你可能不需要担心这个调用。
SSL_CTX_set_cert_verify_callback() changes the default certificate verification function. You probably should not do this. It's quite involved, you need to check the signature for each cert, verify the chain, possibly check CRL. It's the most complicated part of the SSL.
The SSL_CTX_set_verify() is used to set the mode of SSL. If the mode is SSL_VERIFY_PEER (2-way SSL), you should also set a callback in this function to further verify the client certificate (checking CN against a white-list etc). For other modes, this CB is not used. Since you said you are in client mode, you probably don't need to worry about this call.
SSL_CTX_set_cert_verify_callback() 意味着您正在指定一个函数来执行整个验证过程（遍历证书链依次验证每个证书）。 [根据下面的警告，您可能不想这样做]
另一方面，SSL_CTX_set_verify() 指定一个在默认验证器检查每个证书时调用的函数，并将 preverify_ok 设置为 0 或 1 以指示是否进行验证有关证书的有效。
来自 SSL_CTX_set_cert_verify_callback() 的文档
SSL_CTX_set_cert_verify_callback() means you're specifying a function to do the entire validation process (walking the certificate chain validating each cert in turn). [ you probably don't want to be doing this, per the warning below ]
SSL_CTX_set_verify(), on the other hand, specifies a function that's called when the default validator checks each certificate, with preverify_ok set to 0 or 1 to indicate if verification of the certificate in question worked.
From the doc for SSL_CTX_set_cert_verify_callback()