Re: [PATCH proxmox-websocket-tunnel v3 6/6] use proxmox-http's openssl callback

["Shannon Sterz" <s.sterz@proxmox.com>]

On Wed Jun 17, 2026 at 10:59 AM CEST, Dominik Csapak wrote:
> no functional change intended, since the callback there should implement
> the same behavior.
>
> With this, we can drop the dependency on itertools.
>
> Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>

-->8 snip 8<--

> @@ -142,48 +142,35 @@ impl CtrlTunnel {
>          }
>
>          let mut ssl_connector_builder = SslConnector::builder(SslMethod::tls())?;
> -        if let Some(expected) = fingerprint {
> +        if fingerprint.is_some() {
>              ssl_connector_builder.set_verify_callback(
>                  openssl::ssl::SslVerifyMode::PEER,
> -                move |_valid, ctx| {
> -                    let cert = match ctx.current_cert() {
> -                        Some(cert) => cert,
> -                        None => {
> -                            // should not happen
> -                            eprintln!("SSL context lacks current certificate.");
> -                            return false;
> -                        }
> -                    };
> -
> -                    // skip CA certificates, we only care about the peer cert
> -                    let depth = ctx.error_depth();
> -                    if depth != 0 {
> -                        return true;
> -                    }
> -
> -                    use itertools::Itertools;
> -                    let fp = match cert.digest(openssl::hash::MessageDigest::sha256()) {
> -                        Ok(fp) => fp,
> -                        Err(err) => {
> -                            // should not happen
> -                            eprintln!("failed to calculate certificate FP - {}", err);
> -                            return false;
> +                move |valid, ctx| match proxmox_http::openssl_verify_callback(
> +                    valid,
> +                    ctx,
> +                    fingerprint.as_deref(),
> +                ) {
> +                    Ok(()) => true,
> +                    Err(err) => {
> +                        match err {
> +                            SslVerifyError::NoCertificate => {
> +                                eprintln!("SSL context lacks current certificate");

same nit here as in 4/6

-->8 snip 8<--