static int interactive_check_cert (X509 *cert, int idx, int len, SSL *ssl, int allow_always)
{
  static const int part[] =
    { NID_commonName,             /* CN */
      NID_pkcs9_emailAddress,     /* Email */
      NID_organizationName,       /* O */
      NID_organizationalUnitName, /* OU */
      NID_localityName,           /* L */
      NID_stateOrProvinceName,    /* ST */
      NID_countryName             /* C */ };
  X509_NAME *x509_subject;
  X509_NAME *x509_issuer;
  char helpstr[LONG_STRING];
  char buf[STRING];
  char title[STRING];
  MUTTMENU *menu = mutt_new_menu (MENU_GENERIC);
  int done;
  BUFFER *drow = NULL;
  unsigned u;
  FILE *fp;
  int allow_skip = 0, reset_ignoremacro = 0;

  mutt_push_current_menu (menu);

  drow = mutt_buffer_pool_get ();

  mutt_menu_add_dialog_row (menu, _("This certificate belongs to:"));
  x509_subject = X509_get_subject_name (cert);
  for (u = 0; u < mutt_array_size (part); u++)
  {
    mutt_buffer_printf (drow, "   %s", x509_get_part (x509_subject, part[u]));
    mutt_menu_add_dialog_row (menu, mutt_b2s (drow));
  }

  mutt_menu_add_dialog_row (menu, "");
  mutt_menu_add_dialog_row (menu, _("This certificate was issued by:"));
  x509_issuer = X509_get_issuer_name (cert);
  for (u = 0; u < mutt_array_size (part); u++)
  {
    mutt_buffer_printf (drow, "   %s", x509_get_part (x509_issuer, part[u]));
    mutt_menu_add_dialog_row (menu, mutt_b2s (drow));
  }

  mutt_menu_add_dialog_row (menu, "");
  mutt_menu_add_dialog_row (menu, _("This certificate is valid"));
  mutt_buffer_printf (drow, _("   from %s"),
            asn1time_to_string (X509_getm_notBefore (cert)));
  mutt_menu_add_dialog_row (menu, mutt_b2s (drow));
  mutt_buffer_printf (drow, _("     to %s"),
            asn1time_to_string (X509_getm_notAfter (cert)));
  mutt_menu_add_dialog_row (menu, mutt_b2s (drow));

  mutt_menu_add_dialog_row (menu, "");
  buf[0] = '\0';
  x509_fingerprint (buf, sizeof (buf), cert, EVP_sha1);
  mutt_buffer_printf (drow, _("SHA1 Fingerprint: %s"), buf);
  mutt_menu_add_dialog_row (menu, mutt_b2s (drow));
  buf[0] = '\0';
  buf[40] = '\0';  /* Ensure the second printed line is null terminated */
  x509_fingerprint (buf, sizeof (buf), cert, EVP_sha256);
  buf[39] = '\0';  /* Divide into two lines of output */
  mutt_buffer_printf (drow, "%s%s", _("SHA256 Fingerprint: "), buf);
  mutt_menu_add_dialog_row (menu, mutt_b2s (drow));
  mutt_buffer_printf (drow, "%*s%s",
            (int)mutt_strlen (_("SHA256 Fingerprint: ")), "", buf + 40);
  mutt_menu_add_dialog_row (menu, mutt_b2s (drow));

  snprintf (title, sizeof (title),
	    _("SSL Certificate check (certificate %d of %d in chain)"),
	    len - idx, len);
  menu->title = title;

  /* The leaf/host certificate can't be skipped. */
#ifdef HAVE_SSL_PARTIAL_CHAIN
  if ((idx != 0) &&
      (option (OPTSSLVERIFYPARTIAL)))
    allow_skip = 1;
#endif

  /* Inside ssl_verify_callback(), this function is guarded by a call to
   * check_certificate_by_digest().  This means if check_certificate_expiration() is
   * true, then check_certificate_file() must be false.  Therefore we don't need
   * to also scan the certificate file here.
   */
  allow_always = allow_always &&
    SslCertFile &&
    check_certificate_expiration (cert, 1);

  /* L10N:
   * These four letters correspond to the choices in the next four strings:
   * (r)eject, accept (o)nce, (a)ccept always, (s)kip.
   * These prompts are the interactive certificate confirmation prompts for
   * an OpenSSL connection.
   */
  menu->keys = _("roas");
  if (allow_always)
  {
    if (allow_skip)
      menu->prompt = _("(r)eject, accept (o)nce, (a)ccept always, (s)kip");
    else
      menu->prompt = _("(r)eject, accept (o)nce, (a)ccept always");
  }
  else
  {
    if (allow_skip)
      menu->prompt = _("(r)eject, accept (o)nce, (s)kip");
    else
      menu->prompt = _("(r)eject, accept (o)nce");
  }

  helpstr[0] = '\0';
  mutt_make_help (buf, sizeof (buf), _("Exit  "), MENU_GENERIC, OP_EXIT);
  safe_strcat (helpstr, sizeof (helpstr), buf);
  mutt_make_help (buf, sizeof (buf), _("Help"), MENU_GENERIC, OP_HELP);
  safe_strcat (helpstr, sizeof (helpstr), buf);
  menu->help = helpstr;

  done = 0;

  if (!option (OPTIGNOREMACROEVENTS))
  {
    set_option (OPTIGNOREMACROEVENTS);
    reset_ignoremacro = 1;
  }
  while (!done)
  {
    switch (mutt_menuLoop (menu))
    {
      case -1:			/* abort */
      case OP_MAX + 1:		/* reject */
      case OP_EXIT:
        done = 1;
        break;
      case OP_MAX + 3:		/* accept always */
        if (!allow_always)
          break;
        done = 0;
        if ((fp = fopen (SslCertFile, "a")))
	{
	  if (PEM_write_X509 (fp, cert))
	    done = 1;
	  safe_fclose (&fp);
	}
	if (!done)
        {
	  mutt_error (_("Warning: Couldn't save certificate"));
	  mutt_sleep (2);
	}
	else
        {
	  mutt_message (_("Certificate saved"));
	  mutt_sleep (0);
	}
        /* fall through */
      case OP_MAX + 2:		/* accept once */
        done = 2;
        SSL_set_ex_data (ssl, SkipModeExDataIndex, NULL);
	ssl_cache_trusted_cert (cert);
        break;
      case OP_MAX + 4:          /* skip */
        if (!allow_skip)
          break;
        done = 2;
        SSL_set_ex_data (ssl, SkipModeExDataIndex, &SkipModeExDataIndex);
        break;
    }
  }
  if (reset_ignoremacro)
    unset_option (OPTIGNOREMACROEVENTS);

  mutt_buffer_pool_release (&drow);
  mutt_pop_current_menu (menu);
  mutt_menuDestroy (&menu);
  dprint (2, (debugfile, "ssl interactive_check_cert: done=%d\n", done));
  return (done == 2);
}