Re: [PATCH v3 2/3] imap-send: let OpenSSL do the hostname verification

[Patrick Steinhardt <ps@pks.im>]

On Sat, Oct 17, 2026 at 12:09:55PM +0200, Beat Bolli wrote:
> imap-send performs its own TLS hostname verification. This is not ideal
> because it does not support all certificate features.
> 
> Let's use OpenSSL built-in verification, which is supported in its
> current form since OpenSSL 1.1.0. This gets us all present and future
> improvements done by OpenSSL for free. E.g., the old code did not handle
> IP addresses in the subject alternative names, while the new code does.
> 
> If the verification fails, print the error message as returned by
> OpenSSL.
> 
> [1]: https://wiki.openssl.org/index.php/Hostname_validation
> 
> Suggested-by: brian m. carlson <sandals@crustytoothpaste.net>
> Signed-off-by: Beat Bolli <dev+git@drbeat.li>
> ---
> We cannot easily print the certificate's hostname in case of a mismatch,
> but the cURL branch does not, either.
> 
> Unfortuately, the diff looks bad because two functions are replaced by
> the new verify_peer() function that is completely unrelated.

Would it have been possible to make the diff a bit easier to read, for
example by having a preparatory patch that simply moves code around into
this new `verify_peer()` function without yet changing semantics, and
then changing semantics in a second patch?

> diff --git a/imap-send.c b/imap-send.c
> index 9f21705d77..ec4e28e423 100644
> --- a/imap-send.c
> +++ b/imap-send.c
> @@ -348,20 +320,13 @@ static int ssl_socket_connect(struct imap_socket *sock,
>  	ret = SSL_connect(sock->ssl);
>  	if (ret <= 0) {
>  		socket_perror("SSL_connect", sock, ret);
> +		if (cfg->ssl_verify)
> +			verify_peer(sock->ssl, 0);

Why do we need to verify the certificate when we failed connecting to
the peer? We didn't do that before, either, did we?

Patrick