Yeah this is one of the big outstanding issues for this. OpenSSL handles tag verification errors during decryption by returning 0 from EVP_CipherFinal_ex, but this is what it returns for any error. To get more detail you would normally call ERR_get_error() to obtain the unsigned long error code and then ERR_reason_error_string to get the associated error string, but tag verification failures don't appear to provide additional error data.