Support custom certificate verification

[Demi-Marie]

This is needed for libp2p, among other uses.

[ghedo]

Can you please provide more details of what is needed? Can't promise it will be implemented, but knowing what's needed would help.

[Demi-Marie]

libp2p needs complete control of the certificate verification process. Certificates used in libp2p have a bespoke critical extension, which contains both the peer’s identity key and the a signature (of the certificate’s key) by the corresponding secret key. The data in the extension must be made available to the application. All libp2p certificates are self-signed.

Ideally, the only checks that quiche would make are that the certificate is syntactically valid, that its self-signature is valid (if needed for security), and that its public key matches the signature made during the handshake. libp2p will handle verifying that the certificate is correct for the peer.

[ghedo]

@demimarie-parity I made #332 to let applications see the peer's leaf certificate (as a DER blob). You can then disable certificate verification using config.verify_peer(false), and use the new API to get the certificate and do your own verification.

How does that sound?

[ghedo]

@demimarie-parity ping?

[Demi-Marie]

@ghedo That works, thanks!