Seems that it's a matter of using SSL_CTX_set_verify on the tls context, with SSL_VERIFY_PEER.
See https://wiki.openssl.org/index.php/Manual:SSL_CTX_set_verify(3)

-- vyzo

On Wed, Nov 15, 2017 at 2:33 PM, Marc Feeley <feeley@iro.umontreal.ca> wrote:
Clearly something has to be done! I didn’t write that code, so perhaps someone with more experience with OpenSSL should take a look at it.

Marc



> On Nov 15, 2017, at 4:17 AM, Dimitris Vyzovitis <vyzo@hackzen.org> wrote:
>
> Marc,
>
> It seems that the TLS stack is completely lacking client-side server
> certificate validation. There are now two open issues on github (#200
> and #312 which I just opened).
>
> This is a real security problem, as not having certificate validation
> defeats the whole purpose of TLS.
>
> Can we do something about it?
>
> -- vyzo
>