NOEXPORT int cert_check(CLI *c, X509_STORE_CTX *callback_ctx,
        int preverify_ok) {
    int err=X509_STORE_CTX_get_error(callback_ctx);
    int depth=X509_STORE_CTX_get_error_depth(callback_ctx);

    if(preverify_ok) {
        s_log(LOG_DEBUG, "CERT: Pre-verification succeeded");
    } else { /* remote site sent an invalid certificate */
        if(c->opt->option.verify_chain || (depth==0 &&
                err!=X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY &&
                err!=X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE &&
                err!=X509_V_ERR_CERT_UNTRUSTED)) {
            s_log(LOG_WARNING, "CERT: Pre-verification error: %s",
                X509_verify_cert_error_string(err));
            /* retain the STORE_CTX error produced by pre-verification */
            return 0; /* reject */
        }
        s_log(LOG_INFO, "CERT: Pre-verification error ignored: %s",
            X509_verify_cert_error_string(err));
    }

    if(depth==0) { /* additional peer certificate checks */
#if OPENSSL_VERSION_NUMBER>=0x10002000L
        if(!cert_check_subject(c, callback_ctx))
            return 0; /* reject */
#endif /* OPENSSL_VERSION_NUMBER>=0x10002000L */
        if(c->opt->option.verify_peer && !cert_check_local(callback_ctx))
            return 0; /* reject */
    }

    return 1; /* accept */
}
NOEXPORT int cert_check(CLI *c, X509_STORE_CTX *callback_ctx,
        int preverify_ok) {
    int err=X509_STORE_CTX_get_error(callback_ctx);
    int depth=X509_STORE_CTX_get_error_depth(callback_ctx);

    if(preverify_ok) {
        s_log(LOG_DEBUG, "CERT: Pre-verification succeeded");
    } else {  
        if(c->opt->option.verify_chain || (depth==0 &&
                err!=X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY &&
                err!=X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE &&
                err!=X509_V_ERR_CERT_UNTRUSTED)) {
            s_log(LOG_WARNING, "CERT: Pre-verification error: %s",
                X509_verify_cert_error_string(err));
             
            return 0;  
        }
        s_log(LOG_INFO, "CERT: Pre-verification error ignored: %s",
            X509_verify_cert_error_string(err));
    }

    if(depth==0) {  
#if OPENSSL_VERSION_NUMBER>=0x10002000L
        if(!cert_check_subject(c, callback_ctx))
            return 0;  
#endif  
        if(c->opt->option.verify_peer && !cert_check_local(callback_ctx))
            return 0;  
    }

    return 1;  
}