title: How can I validate hostnames with OpenSSL 1.1.0?
body: <p>I'm trying to implement a sample <a href="https://www.openssl.org/docs/man1.0.2/ssl/SSL_get0_param.html" rel="nofollow noreferrer">hostname validation</a> with <a href="https://www.openssl.org/" rel="nofollow noreferrer">OpenSSL</a>.
  The sample C/C++ code I have put together is:</p>
  
  <pre><code>// please note I'm connecting to https://openssl.org itself
  // enable SNI
  if(!SSL_set_tlsext_host_name(ssl, "www.openssl.org")) throw;
  if(!SSL_connect(ssl)) throw;
  // connection is fine, I can get the homepage via HTTP
  X509 *cert = SSL_get_peer_certificate(ssl);
  if(cert) {
      if(!X509_VERIFY_PARAM_set1_host(SSL_get0_param(ssl), "google.com", 0)) throw;
      SSL_set_verify(ssl, SSL_VERIFY_PEER, 0);
      const long cert_res = SSL_get_verify_result(ssl);
      if(cert_res == X509_V_OK) {
          printf("Certificate verified!\n");
      }
      X509_free(cert);
  }
  </code></pre>
  
  <p>As per code above I'm successfully connecting to the <em>openssl.org</em> domain; then I'm setting the name to verify as <em>google.com</em> to test failures, but the code still <em>succeeds</em>.</p>
  
  <p>What am I doing wrong?
  How can I implement a <strong>thorough</strong> verification of hostnames using <a href="https://www.openssl.org/" rel="nofollow noreferrer">OpenSSL</a> APIs? I wouldn't want to re-implement (most likely with bugs/wrongly) what is already implemented in the library...</p>
  
  <p>I'm using Ubuntu 16.04 and this <em>libssl</em> version: <code>/lib/x86_64-linux-gnu/libssl.so.1.0.0</code>.</p>