Move TLS cert verification callback from Credentials_Manager to TLS::Callbacks

It is the only function in C_M which is called on to process session-specific
(and adversarially provided) inputs, rather than passively returning some credential
which is typically not session specific.

1 files changed, 7 insertions, 1 deletions

diff --git a/src/lib/tls/tls_server.cpp b/src/lib/tls/tls_server.cpp
index 5e3b222f1..abe22df3c 100644
--- a/src/lib/tls/tls_server.cpp
+++ b/src/lib/tls/tls_server.cpp
@@ -523,7 +523,13 @@ void Server::process_certificate_verify_msg(Server_Handshake_State& pending_stat
 
     try
         {
-        m_creds.verify_certificate_chain ( "tls-server", "", client_certs );
+        const std::string sni_hostname = pending_state.client_hello()->sni_hostname();
+        auto trusted_CAs = m_creds.trusted_certificate_authorities("tls-server", sni_hostname);
+
+        callbacks().tls_verify_cert_chain(client_certs,
+                                          trusted_CAs,
+                                          Usage_Type::TLS_CLIENT_AUTH,
+                                          sni_hostname);
         }
     catch ( std::exception& e )
         {