cherokee/webserver — pull request #1033 by smunaut (2013-11-20 12:57:09+00:00)
Title: ssl: Add a 'tolerate' option for client certificate verification

This option is very similar to accept with the exception that if the
certificate that's sent by the client can't be validated, the SSL
handshake will not be abruptly terminate but it will continue.

The application that use the client certificate should in any case call
the SSL_get_verify_status and this will still return that the validation
failed and the cert be ignored.

This is mainly useful because Apple, in it's great wisdom, decided to
make Safari send just about any client cert, even those not matching at
all the CA list sent by the server ... The only way to use client cert
with Safari is then to just accept any client cert and just ignore it
if it's invalid rather than preventing the SSL negotiation.

Signed-off-by: Sylvain Munaut