-.\" $OpenBSD: X509_STORE_CTX_set_verify_cb.3,v 1.11 2023/05/29 11:57:23 beck Exp $
+.\" $OpenBSD: X509_STORE_CTX_set_verify_cb.3,v 1.12 2023/05/30 07:37:34 op Exp $
.\" full merge up to: OpenSSL aebb9aac Jul 19 09:27:53 2016 -0400
.\" selective merge up to: OpenSSL 24a535ea Sep 22 13:14:20 2020 +0100
.\"
.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
.\" OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd $Mdocdate: May 29 2023 $
+.Dd $Mdocdate: May 30 2023 $
.Dt X509_STORE_CTX_SET_VERIFY_CB 3
.Os
.Sh NAME
{
return ok;
}
-This is likely the only safe callback to use.
.Ed
.Pp
-Simple and terrible example that you should not use:
+This is likely the only safe callback to use.
+.Pp
+Simple and terrible example that should not be used.
Suppose a certificate in the chain is expired and we
wish to continue after this error:
.Bd -literal
return ok;
}
.Ed
+.Pp
While this example is presented for historical purposes,
this is not the correct way to accomplish this.
-You should set verification options on the STORE_CTX to use
-.Vt X509_V_FLAG_NO_CHECK_TIME
+The verification flag
+.Dv X509_V_FLAG_NO_CHECK_TIME
+should be set on the
+.Vt STORE_CTX
using
.Xr X509_VERIFY_PARAM_set_flags 3
instead.