From d179019ec22c4a29db9d9f15ad086d37b71e0bf7 Mon Sep 17 00:00:00 2001 From: David Horstmann Date: Tue, 17 Feb 2026 14:41:59 +0000 Subject: [PATCH] Set verify_result to 0 when not checking certs When we are using PSK or authmode is MBEDTLS_SSL_VERIFY_NONE, set verify_result to 0 rather than MBEDTLS_X509_BADCERT_SKIP_VERIFY. This is specific to the 3.6 LTS, to preserve the previous behaviour of the library in these cases, which was determined by the default value of verify_result being 0. Signed-off-by: David Horstmann --- library/ssl_tls.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 88c5b8a43c..ca3be8b50b 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -2288,8 +2288,8 @@ int mbedtls_ssl_set_hs_psk(mbedtls_ssl_context *ssl, return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED; } - /* Since we're not using a certificate, set verify_result to skipped */ - ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY; + /* Since we're not using a certificate, set verify_result to success */ + ssl->session_negotiate->verify_result = 0; /* Allow calling psa_destroy_key() on psk remove */ ssl->handshake->psk_opaque_is_internal = 1; @@ -7937,7 +7937,7 @@ static int ssl_parse_certificate_coordinate(mbedtls_ssl_context *ssl, ssl->handshake->ciphersuite_info; if (!mbedtls_ssl_ciphersuite_uses_srv_cert(ciphersuite_info)) { - ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY; + ssl->session_negotiate->verify_result = 0; return SSL_CERTIFICATE_SKIP; } @@ -9882,7 +9882,7 @@ int mbedtls_ssl_verify_certificate(mbedtls_ssl_context *ssl, void *rs_ctx) { if (authmode == MBEDTLS_SSL_VERIFY_NONE) { - ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY; + ssl->session_negotiate->verify_result = 0; return 0; }