X-Git-Url: https://arthur.barton.de/cgi-bin/gitweb.cgi?p=ngircd-alex.git;a=blobdiff_plain;f=src%2Fngircd%2Fconn-ssl.c;fp=src%2Fngircd%2Fconn-ssl.c;h=22b5d07ec3683aca4170901851382375922ffe10;hp=d89c11fe1baa1d2252c856f9e9308e0b756b61d6;hb=3db3b47fc7172a69b7d99d66eddb07a323dc6e74;hpb=679505aab9fea21b27a3d4bbf99cf2a16cf3d3d5

diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c
index d89c11fe..22b5d07e 100644
--- a/src/ngircd/conn-ssl.c
+++ b/src/ngircd/conn-ssl.c
@@ -211,14 +211,23 @@ pem_passwd_cb(char *buf, int size, int rwflag, void *password)
 static int
 Verify_openssl(int preverify_ok, X509_STORE_CTX * ctx)
 {
-	int err;
-
+#ifdef DEBUG
 	if (!preverify_ok) {
-		err = X509_STORE_CTX_get_error(ctx);
-		Log(LOG_ERR, "Certificate validation failed: %s",
-		    X509_verify_cert_error_string(err));
+		int err = X509_STORE_CTX_get_error(ctx);
+		LogDebug("Certificate validation failed: %s",
+			 X509_verify_cert_error_string(err));
 	}
-	return preverify_ok;
+#else
+	(void)preverify_ok;
+	(void)ctx;
+#endif
+
+	/* Always(!) return success as we have to deal with invalid
+	 * (self-signed, expired, ...) client certificates and with invalid
+	 * server certificates when "SSLVerify" is disabled, which we don't
+	 * know at this stage. Therefore we postpone this check, it will be
+	 * (and has to be!) handled in cb_connserver_login_ssl(). */
+	return 1;
 }
 #endif