Consider using Botan for host certificate store access

[Tectu]

Currently, we're using certify for accessing the host's certificate store.
It might be worth considering using Botan instead (https://github.com/randombit/botan).

[reneme]

Perhaps, you could even consider using Botan as your (alternative) TLS provider, which then includes certificate validation with its system certificate store adapters, of course. I see you're using asio's ssl_stream that uses OpenSSL underneath. Botan provides a "more-or-less" drop in replacement for this. 🙂

[Tectu]

That's a good suggestion - Thanks for pointing that out!

Ideally we'd make this options so users can pick one or the other.

[Tectu]

@reneme Is there an example somewhere which demonstrates using Botan only for the certificate handling but still using the "standard boost asio TLS stream"?

I'd like to give the user the option of either using OpenSSL or Botan as the TLS provider eventually. But just replacing certify would be a good intermediary step.

[reneme]

There's unfortunately no ready-made example for the integration of ASIO's ssl::stream and Botan's certificate validation. But the basic idea is to disable OpenSSL's verification in your ASIO ssl::stream and then integrate Botan's certificate validation via a callback:

   ssl::context ctx{ssl::context::tlsv13_client};
   ctx.set_verify_mode(ssl::verify_none); // don't pre-verify using OpenSSL
   ctx.set_verify_callback([](bool /*preverified*/, ssl::verify_context& verify_ctx) {
      const X509_STORE_CTX* native_ctx = verify_ctx.native_handle();
      // Extract the certificate chain from the native OpenSSL store as serialized
      // PEM containers, load those into Botan::X509_Certificate structures and
      // validate them using Botan::x509_path_validate()...
   });

Here's an example for how to use certificate path validation in Botan. I don't know how to get the certificates from X509_STORE_CTX but maybe some trusted LLM can come up with a starting point for that.