Using TLS certificate pinning
To learn how to use TLS certificate pinning in C code, we are going to write a small tls-cert-pinning program. We are going to use a simple variant of TLS certificate pinning: we will pin just one server certificate and will use TLS certificate pinning instead of the default PKI model, not in addition to it.
We are going to use the “big” certificate verification callback set with the SSL_CTX_set_cert_verify_callback() function, as opposed to the “small” callback set with the SSL_CTX_set_verify() function, in order to learn another type of callback.
The SSL_CTX_set_cert_verify_callback() function sets a callback function that is supposed to perform the whole certificate verification procedure. The default OpenSSL implementation of that function builds the certificate verification chain, verifies certificate signatures, and the validity dates, and, among other things, calls the callback function set by the SSL_CTX_set_verify...