Osiris,
I can confirm that the call to wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, 0); is the correct solution for turning on mutual auth. The call to wolfSSL_CTX_load_verify_locations is what you use to load certs with which to authenticate but does not enable mutual auth by invocation.
See section "4.8 CLIENT AUTHENTICATION" of our manual here for more info: https://www.wolfssl.com/docs/wolfssl-manual/ch4/
What is the behavior if wolfSSL_CTX_set_verify fails? Does it disconnect automatically?
The connection will not proceed and whichever side failed to authenticate will send either a reset (RST) or close notify alert.
Is wolfSSL_CTX_set_verify required on the client side for mutual authentication? (My guess is no, since it is done automatically with the one way)
No it is not required on the client side.
5)How can I use the VerifyCallback function from the wolfSSL_CTX_set_verify to see if it succeeds or fails?
// just reports the error and returns
static int myVerifyCheck(int preverify, WOLFSSL_X509_STORE_CTX* store)
{
(void) preverify; // unused
printf("In verification callback, error = %d, %s\n", store->error, wolfSSL_ERR_error_string(store->error, buffer));
return WOLFSSL_SUCCESS; // or whatever you wish to return if error is valid
}
...
// then in your application call
wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, myVerifyCheck);6) Is there a way to output/log where the TLS handshake might fail, for example if the client trying to connect has an unknown cert? Can the VerifyCallback be possibly used for that?
Yes you can use the verify callback for that or you can turn on wolfSSL debug messages by defining DEBUG_WOLFSSL in your settings and then calling wolfSSL_Debugging_ON(); in your application.
7) How can I verify that mutual TLS authentication took place? (I think that might be taken care of by wolfSSL_CTX_set_verify if it works the way I think I does)
Again see section 4.8 of our manual, that section details how to tell the server to fail if client does not present cert for mutual auth.
Warm Regards,
Kaleb