== How to fix it in OpenSSL

=== Code examples

include::../../common/fix/code-rationale.adoc[]

:cert_method_name: verify_callback

include::../../common/fix/code-rationale-override.adoc[]

==== Noncompliant code example

[source,cpp,diff-id=31,diff-type=noncompliant]
----
#include <openssl/ssl.h>

static int verify_callback(int preverify_ok, X509_STORE_CTX *ctx) { return 1; }

void connect() {
    const SSL_METHOD *method = TLS_method();
    SSL_CTX *ctx = SSL_CTX_new(method);
    SSL_CTX_set_verify(ctx, CURLOPT_SSL_VERIFYPEER, verify_callback); // Noncompliant
    SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL); // Noncompliant
    SSL *ssl = SSL_new(ctx);
    SSL_connect(ssl);
}
----

==== Compliant solution

[source,cpp,diff-id=31,diff-type=compliant]
----
#include <openssl/ssl.h>

void connect() {
    const SSL_METHOD *method = TLS_method();
    SSL_CTX *ctx = SSL_CTX_new(method);
    SSL *ssl = SSL_new(ctx);
    SSL_connect(ssl);
}
----

=== How does this work?

include::../../common/fix/validation.adoc[]
