static int tls_verify_peers (gnutls_session_t tlsstate,
                             gnutls_certificate_status_t *certstat)
{
  int verify_ret;

  /* gnutls_certificate_verify_peers2() chains to
   * gnutls_x509_trust_list_verify_crt2().  That function's documentation says:
   *
   *   When a certificate chain of cert_list_size with more than one
   *   certificates is provided, the verification status will apply to
   *   the first certificate in the chain that failed
   *   verification. The verification process starts from the end of
   *   the chain (from CA to end certificate). The first certificate
   *   in the chain must be the end-certificate while the rest of the
   *   members may be sorted or not.
   *
   * This is why tls_check_certificate() loops from CA to host in that order,
   * calling the menu, and recalling tls_verify_peers() for each approved
   * cert in the chain.
   */
  verify_ret = gnutls_certificate_verify_peers2 (tlsstate, certstat);

  /* certstat was set */
  if (!verify_ret)
    return 0;

  if (verify_ret == GNUTLS_E_NO_CERTIFICATE_FOUND)
    mutt_error (_("Unable to get certificate from peer"));
  else
    mutt_error (_("Certificate verification error (%s)"),
                gnutls_strerror (verify_ret));

  mutt_sleep (2);
  return verify_ret;
}
static int tls_verify_peers (gnutls_session_t tlsstate,
                             gnutls_certificate_status_t *certstat)
{
  int verify_ret;

   
  verify_ret = gnutls_certificate_verify_peers2 (tlsstate, certstat);

   
  if (!verify_ret)
    return 0;

  if (verify_ret == GNUTLS_E_NO_CERTIFICATE_FOUND)
    mutt_error (_("Unable to get certificate from peer"));
  else
    mutt_error (_("Certificate verification error (%s)"),
                gnutls_strerror (verify_ret));

  mutt_sleep (2);
  return verify_ret;
}