title: Verifying self-signed/expired certificate with openssl library does not return error
body: <p>I am trying to write a certificate validation function in C using the openssl library. Since the certificate I am validating is self-signed and expired, I expect the X509_verify_cert() to return error (the return value is 1 and the store_ctx->error is set to X509_V_OK instead). '<strong>openssl verify my_pem_cert_file</strong>' outputs:</p>
  
  <pre><code>error 18 at 0 depth lookup:self signed certificate
  error 10 at 0 depth lookup:certificate has expired
  </code></pre>
  
  <p>What I am doing wrong? Here is my code:</p>
  
  <pre><code>static int cert_verify_callback(int ok, X509_STORE_CTX *ctx)
  {
      /* Tolerate self-signed certificate */
      if (X509_STORE_CTX_get_error(ctx) == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) {
          return 1;
      }
  
      /* Otherwise don't override */
      return ok;
  }
  
  int cert_validate(const char* certFileName) 
  {
      BIO *pBio = NULL;
      X509 *pX509 = NULL;
      X509 *CA = NULL;
      X509_STORE *cert_store = NULL;
      X509_STORE_CTX *store_ctx = NULL;
      STACK_OF(X509) *stack_of_x509 = NULL;
      time_t check_time;
      int store_ctx_error;
      int store_ctx_error_depth;
  
  
      pBio = BIO_new( BIO_s_file_internal() );
      if(pBio == NULL)
          /* error handling */
  
      if(BIO_read_filename(pBio, certFileName) &lt;= 0)
          /* error handling */
  
      pX509 = PEM_read_bio_X509(pBio, NULL, NULL, NULL);
      if (pX509 == NULL)
          /* error handling */
  
      if( (cert_store= X509_STORE_new()) == NULL)
          /* error handling */
  
      if( (store_ctx= X509_STORE_CTX_new()) == NULL)
          /* error handling */
  
      /* edit1: this was wrong: don't add the certificate being verified to the trusted cert list */
      /* if( !X509_STORE_add_cert(cert_store, pX509) ) */
          /* error handling */
  
      if( !X509_STORE_CTX_init(store_ctx, cert_store, CA, stack_of_x509) )
          /* error handling */
  
      X509_STORE_CTX_set_cert(store_ctx, pX509);
  
      /* edit1: this was missing: set the verify time in order to check the certificate for expiry */
      time(&amp;check_time);
      X509_STORE_CTX_set_time(store_ctx, 0, check_time);
      X509_STORE_CTX_set_flags(store_ctx, X509_V_FLAG_USE_CHECK_TIME);
  
      /* edit1: add callback function for ignoring self-signed error
       * now, I'd like the validation to fail because of the expiry */
      X509_STORE_set_verify_cb_func(store_ctx, cert_verify_callback);
  
      switch( X509_verify_cert(store_ctx) ) {
          /* the certificate is valid */
          case 1:
              printf("The certificate is valid\n");
  
              break;
  
          /* the certificate cannot be validated */
          case -1:
          case 0:
              printf("The certificate is not valid\n");
  
              store_ctx_error= X509_STORE_CTX_get_error(store_ctx);
              store_ctx_error_depth= X509_STORE_CTX_get_error_depth(store_ctx);
              printf("Error %d at %d depth: %s\n", store_ctx_error, store_ctx_error_depth, X509_verify_cert_error_string(store_ctx-&gt;error));
  
          default:
              break;
      }
  
      /* free data ... */
  }
  </code></pre>
  
  <p>When validating the self-signed and expired certificate, my function prints:
      Error 0 at 0 depth: ok</p>