Research other libraries

[vinniefalco]

It would be nice to have a few links to other similar libraries that are best-in-breed for interface, implementation, and testing ideas.

[djarek]

• Go std lib seems to be relying on OCSP stapling, no additional validation seems to be performed: https://golang.org/src/net/http/transport.go?s=20650:20692#L1258
• cURL: relies on the OpenSSL store and additional user-provided CRLs: https://github.com/curl/curl/blob/master/lib/vtls/openssl.c#L2637

[vinniefalco]

does the OpenSSL store check the platform-specific certificate store on Windows?

[djarek]

No, OpenSSL doesn't have code do that on either Windows or MacOS.
Botan has the code to use the Apple native cert store, but it loads the certificates via a (mostly) undocumented API into its own store.

[benstadin]

I'm about to try this library. Just thought to mention two I found:

There is Microsoft's restcpp which does also platform specific certificate checking:
https://github.com/microsoft/cpprestsdk/blob/57a7ff2c0720d38bd1384c2b0b09c17a549fcbe4/Release/src/http/client/x509_cert_utilities.cpp

Then there is Facebook's Folly library. It looks pretty decent, but I doesn't seem to load certificates from the system store:
https://github.com/facebook/folly/blob/b206a6bdf601b063fcf60a8f7f23d6793bb40209/folly/io/async/SSLContext.cpp