How to verify server's certificate

[goforit22123-netizen]

I have questions about connecting using TLS:

1. What happens if the remote server's TLS certificate is invalid?
2. Is there a way to configure the client to continue working if the certificate is invalid or, conversely, to refuse the connection to such a server?

[biljazovic]

All TLS/SSL configuration is delegated to the boost::asio::ssl::context object that you pass to the client at construction time (see example).

In ssl::context certificate validation is disabled by default. The connection will succeed regardless of the server's certificate validity.

When you enable it:

boost::asio::ssl::context ctx(boost::asio::ssl::context::tls_client);
ctx.set_verify_mode(boost::asio::ssl::verify_peer);

// Load a specific CA certificate file:
ctx.load_verify_file("/path/to/ca-certificate.pem");

and the server's certificate is invalid, the client will keep retrying the connection with exponential backoff (see auto-reconnect). You can observe handshake errors through the logger's at_tls_handshake method.

[goforit22123-netizen]

@biljazovic Thank you!