Код:
int ClientSecure::ssl_begin(const char *host, uint32_t port, int vrf)
{
int rc;
if (_connected) // allready
return -1;
if (ssl_connect_socket(&client, host, port) < 0)
return -1;
client.ctx = SSL_CTX_new(SSLv23_method()); // TLSv1_2_method
client.ssl = SSL_new(client.ctx);
#if 0 // SSL_trace
static BIO *outbio = BIO_new_fp(stdout, BIO_NOCLOSE);
SSL_set_msg_callback(client.ssl, msg_cb);
SSL_set_msg_callback_arg(client.ssl, outbio);
#endif
//CA_LIST
if (client.ca_cert)
{
rc = SSL_CTX_load_verify_locations(client.ctx, client.ca_cert, 0);
if (0 == rc)
{
DEBUG_SSL("[ERROR] CA_LIST: %d\n", rc);
return -1;
}
DEBUG_SSL("[SSL] USE CA_LIST\n");
}
//CLENT CERTIFICATE
if (client.certificate)
{
if (SSL_CTX_use_certificate_file(client.ctx, client.certificate, SSL_FILETYPE_PEM) <= 0)
{
ERR_print_errors_fp(stderr);
return -1;
}
DEBUG_SSL("[SSL] USE CERTIFICATE\n");
}
//CLENT PRIVATE KEY
if (client.private_key)
{
if (SSL_CTX_use_PrivateKey_file(client.ctx, client.private_key, SSL_FILETYPE_PEM) <= 0)
{
ERR_print_errors_fp(stderr);
return -1;
}
DEBUG_SSL("[SSL] USE PRIVATE KEY\n");
}
if (client.private_key)
{
if (!SSL_CTX_check_private_key(client.ctx))
{
ERR_print_errors_fp(stderr);
return -1;
}
DEBUG_SSL("[SSL] PRIVATE KEY IS OK\n");
}
//CIPHERS
if (client.ciphers)
SSL_set_cipher_list(client.ssl, client.ciphers);
//SNI
if (client.sni_host_name)
SSL_set_tlsext_host_name(client.ssl, client.sni_host_name);
//SSL_set_verify(client.ssl, SSL_VERIFY_PEER, NULL);
//SSL_CTX_set_verify_depth(client.ssl, 1);
//ATTACH SOCKET
if (SSL_set_fd(client.ssl, client.sock) <= 0)
{
DEBUG_SSL("[ERROR] SSL_set_fd()\n");
return -1;
}
//HANDSHAKE
if (SSL_connect(client.ssl) <= 0)
{
DEBUG_SSL("[ERROR] SSL_connect()\n");
ERR_print_errors_fp(stderr);
return -1;
}
if (vrf && SSL_get_verify_result(client.ssl) != X509_V_OK)
{
ERR_print_errors_fp(stderr);
return -1;
}
//DEBUG_SSL("[SSL] Started\n");
return 0;
}
| 
