On 11/14/2012 08:19 AM, Kurt Seiifried wrote:
So do we consider this to be an OpenSSL issue of gajim? I'm sure
gajim is not the only program that does something like this.
As far as I understand things, it is not necessarily at all to set
a verification callback in OpenSSL. If you load the root
certificate store and examine SSL_get_verify_result, that should be
sufficient. You can even look at the peer certificate and continue
anyway if the user has overridden the certificate validity. So
far, I haven't found a good reason to use a verify callback at all.
You need it to implement a custom PKIX validation policy, but that
should be pretty rare. (I still have to check older OpenSSL
versions, though, perhaps there, the behavior was different.)
Anyway, if application developers set a verification callback, it
is their responsibility to implement it correctly. Therefore, I
don't think this is an OpenSSL issue.