The following snippet in Curl_ossl_connect_step3 causes
aborted connection attempts even when curl is rather clearly
instructed to not bother checking the peer's certificate:

ssluse.c: (lines 1638-1641 in 7.6.14, 1624-1628 in today's snapshot)
//-----------------------------------------------------
  connssl->server_cert = SSL_get_peer_certificate(connssl->handle);
  if(!connssl->server_cert) {
    failf(data, "SSL: couldn't get peer certificate!");
    return CURLE_SSL_PEER_CERTIFICATE;
  }
//-----------------------------------------------------

This code is executed _no_matter_what_ even when
CURLOPT_SSL_VERIFYPEER, CURLOPT_SSL_VERIFYHOST,
and CURLOPT_CAINFO are *all* set to 0.

WHY?!??
Received on 2007-11-27