grpc 1.9.1 → 1.10.0.pre1

data/third_party/boringssl/ssl/{ssl_buffer.c → ssl_buffer.cc}

@@ -22,37 +22,55 @@
 #include <openssl/bio.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
-#include <openssl/type_check.h>
 
 #include "../crypto/internal.h"
 #include "internal.h"
 
 
-OPENSSL_COMPILE_ASSERT(0xffff <= INT_MAX, uint16_fits_in_int);
+namespace bssl {
 
-OPENSSL_COMPILE_ASSERT((SSL3_ALIGN_PAYLOAD & (SSL3_ALIGN_PAYLOAD - 1)) == 0,
-                       align_to_a_power_of_two);
+// BIO uses int instead of size_t. No lengths will exceed uint16_t, so this will
+// not overflow.
+static_assert(0xffff <= INT_MAX, "uint16_t does not fit in int");
 
-/* setup_buffer initializes |buf| with capacity |cap|, aligned such that data
- * written after |header_len| is aligned to a |SSL3_ALIGN_PAYLOAD|-byte
- * boundary. It returns one on success and zero on error. */
-static int setup_buffer(SSL3_BUFFER *buf, size_t header_len, size_t cap) {
-  if (buf->buf != NULL || cap > 0xffff) {
+static_assert((SSL3_ALIGN_PAYLOAD & (SSL3_ALIGN_PAYLOAD - 1)) == 0,
+              "SSL3_ALIGN_PAYLOAD must be a power of 2");
+
+// ensure_buffer ensures |buf| has capacity at least |cap|, aligned such that
+// data written after |header_len| is aligned to a |SSL3_ALIGN_PAYLOAD|-byte
+// boundary. It returns one on success and zero on error.
+static int ensure_buffer(SSL3_BUFFER *buf, size_t header_len, size_t cap) {
+  if (cap > 0xffff) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
     return 0;
   }
 
-  /* Add up to |SSL3_ALIGN_PAYLOAD| - 1 bytes of slack for alignment. */
-  buf->buf = OPENSSL_malloc(cap + SSL3_ALIGN_PAYLOAD - 1);
-  if (buf->buf == NULL) {
+  if (buf->cap >= cap) {
+    return 1;
+  }
+
+  // Add up to |SSL3_ALIGN_PAYLOAD| - 1 bytes of slack for alignment.
+  //
+  // Since this buffer gets allocated quite frequently and doesn't contain any
+  // sensitive data, we allocate with malloc rather than |OPENSSL_malloc| and
+  // avoid zeroing on free.
+  uint8_t *new_buf = (uint8_t *)malloc(cap + SSL3_ALIGN_PAYLOAD - 1);
+  if (new_buf == NULL) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
     return 0;
   }
 
-  /* Arrange the buffer such that the record body is aligned. */
-  buf->offset = (0 - header_len - (uintptr_t)buf->buf) &
-                (SSL3_ALIGN_PAYLOAD - 1);
-  buf->len = 0;
+  // Offset the buffer such that the record body is aligned.
+  size_t new_offset =
+      (0 - header_len - (uintptr_t)new_buf) & (SSL3_ALIGN_PAYLOAD - 1);
+
+  if (buf->buf != NULL) {
+    OPENSSL_memcpy(new_buf + new_offset, buf->buf + buf->offset, buf->len);
+    free(buf->buf);  // Allocated with malloc().
+  }
+
+  buf->buf = new_buf;
+  buf->offset = new_offset;
   buf->cap = cap;
   return 1;
 }
@@ -67,59 +85,32 @@ static void consume_buffer(SSL3_BUFFER *buf, size_t len) {
 }
 
 static void clear_buffer(SSL3_BUFFER *buf) {
-  OPENSSL_free(buf->buf);
+  free(buf->buf);  // Allocated with malloc().
   OPENSSL_memset(buf, 0, sizeof(SSL3_BUFFER));
 }
 
-OPENSSL_COMPILE_ASSERT(DTLS1_RT_HEADER_LENGTH + SSL3_RT_MAX_ENCRYPTED_LENGTH <=
-                           0xffff,
-                       maximum_read_buffer_too_large);
-
-/* setup_read_buffer initializes the read buffer if not already initialized. It
- * returns one on success and zero on failure. */
-static int setup_read_buffer(SSL *ssl) {
-  SSL3_BUFFER *buf = &ssl->s3->read_buffer;
-
-  if (buf->buf != NULL) {
-    return 1;
-  }
-
-  size_t header_len = ssl_record_prefix_len(ssl);
-  size_t cap = SSL3_RT_MAX_ENCRYPTED_LENGTH;
-  if (SSL_is_dtls(ssl)) {
-    cap += DTLS1_RT_HEADER_LENGTH;
-  } else {
-    cap += SSL3_RT_HEADER_LENGTH;
-  }
-
-  return setup_buffer(buf, header_len, cap);
-}
-
-uint8_t *ssl_read_buffer(SSL *ssl) {
-  return ssl->s3->read_buffer.buf + ssl->s3->read_buffer.offset;
-}
-
-size_t ssl_read_buffer_len(const SSL *ssl) {
-  return ssl->s3->read_buffer.len;
+Span<uint8_t> ssl_read_buffer(SSL *ssl) {
+  return MakeSpan(ssl->s3->read_buffer.buf + ssl->s3->read_buffer.offset,
+                  ssl->s3->read_buffer.len);
 }
 
 static int dtls_read_buffer_next_packet(SSL *ssl) {
   SSL3_BUFFER *buf = &ssl->s3->read_buffer;
 
   if (buf->len > 0) {
-    /* It is an error to call |dtls_read_buffer_extend| when the read buffer is
-     * not empty. */
+    // It is an error to call |dtls_read_buffer_extend| when the read buffer is
+    // not empty.
     OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
     return -1;
   }
 
-  /* Read a single packet from |ssl->rbio|. |buf->cap| must fit in an int. */
+  // Read a single packet from |ssl->rbio|. |buf->cap| must fit in an int.
   int ret = BIO_read(ssl->rbio, buf->buf + buf->offset, (int)buf->cap);
   if (ret <= 0) {
     ssl->rwstate = SSL_READING;
     return ret;
   }
-  /* |BIO_read| was bound by |buf->cap|, so this cannot overflow. */
+  // |BIO_read| was bound by |buf->cap|, so this cannot overflow.
   buf->len = (uint16_t)ret;
   return 1;
 }
@@ -132,18 +123,18 @@ static int tls_read_buffer_extend_to(SSL *ssl, size_t len) {
     return -1;
   }
 
-  /* Read until the target length is reached. */
+  // Read until the target length is reached.
   while (buf->len < len) {
-    /* The amount of data to read is bounded by |buf->cap|, which must fit in an
-     * int. */
+    // The amount of data to read is bounded by |buf->cap|, which must fit in an
+    // int.
     int ret = BIO_read(ssl->rbio, buf->buf + buf->offset + buf->len,
                        (int)(len - buf->len));
     if (ret <= 0) {
       ssl->rwstate = SSL_READING;
       return ret;
     }
-    /* |BIO_read| was bound by |buf->cap - buf->len|, so this cannot
-     * overflow. */
+    // |BIO_read| was bound by |buf->cap - buf->len|, so this cannot
+    // overflow.
     buf->len += (uint16_t)ret;
   }
 
@@ -151,10 +142,19 @@ static int tls_read_buffer_extend_to(SSL *ssl, size_t len) {
 }
 
 int ssl_read_buffer_extend_to(SSL *ssl, size_t len) {
-  /* |ssl_read_buffer_extend_to| implicitly discards any consumed data. */
+  // |ssl_read_buffer_extend_to| implicitly discards any consumed data.
   ssl_read_buffer_discard(ssl);
 
-  if (!setup_read_buffer(ssl)) {
+  if (SSL_is_dtls(ssl)) {
+    static_assert(
+        DTLS1_RT_HEADER_LENGTH + SSL3_RT_MAX_ENCRYPTED_LENGTH <= 0xffff,
+        "DTLS read buffer is too large");
+
+    // The |len| parameter is ignored in DTLS.
+    len = DTLS1_RT_HEADER_LENGTH + SSL3_RT_MAX_ENCRYPTED_LENGTH;
+  }
+
+  if (!ensure_buffer(&ssl->s3->read_buffer, ssl_record_prefix_len(ssl), len)) {
     return -1;
   }
 
@@ -165,15 +165,15 @@ int ssl_read_buffer_extend_to(SSL *ssl, size_t len) {
 
   int ret;
   if (SSL_is_dtls(ssl)) {
-    /* |len| is ignored for a datagram transport. */
+    // |len| is ignored for a datagram transport.
     ret = dtls_read_buffer_next_packet(ssl);
   } else {
     ret = tls_read_buffer_extend_to(ssl, len);
   }
 
   if (ret <= 0) {
-    /* If the buffer was empty originally and remained empty after attempting to
-     * extend it, release the buffer until the next attempt. */
+    // If the buffer was empty originally and remained empty after attempting to
+    // extend it, release the buffer until the next attempt.
     ssl_read_buffer_discard(ssl);
   }
   return ret;
@@ -184,11 +184,11 @@ void ssl_read_buffer_consume(SSL *ssl, size_t len) {
 
   consume_buffer(buf, len);
 
-  /* The TLS stack never reads beyond the current record, so there will never be
-   * unconsumed data. If read-ahead is ever reimplemented,
-   * |ssl_read_buffer_discard| will require a |memcpy| to shift the excess back
-   * to the front of the buffer, to ensure there is enough space for the next
-   * record. */
+  // The TLS stack never reads beyond the current record, so there will never be
+  // unconsumed data. If read-ahead is ever reimplemented,
+  // |ssl_read_buffer_discard| will require a |memcpy| to shift the excess back
+  // to the front of the buffer, to ensure there is enough space for the next
+  // record.
   assert(SSL_is_dtls(ssl) || len == 0 || buf->len == 0);
 }
 
@@ -207,15 +207,16 @@ int ssl_write_buffer_is_pending(const SSL *ssl) {
   return ssl->s3->write_buffer.len > 0;
 }
 
-OPENSSL_COMPILE_ASSERT(SSL3_RT_HEADER_LENGTH * 2 +
-                           SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD * 2 +
-                           SSL3_RT_MAX_PLAIN_LENGTH <= 0xffff,
-                       maximum_tls_write_buffer_too_large);
+static_assert(SSL3_RT_HEADER_LENGTH * 2 +
+                      SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD * 2 +
+                      SSL3_RT_MAX_PLAIN_LENGTH <=
+                  0xffff,
+              "maximum TLS write buffer is too large");
 
-OPENSSL_COMPILE_ASSERT(DTLS1_RT_HEADER_LENGTH +
-                           SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD +
-                           SSL3_RT_MAX_PLAIN_LENGTH <= 0xffff,
-                       maximum_dtls_write_buffer_too_large);
+static_assert(DTLS1_RT_HEADER_LENGTH + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD +
+                      SSL3_RT_MAX_PLAIN_LENGTH <=
+                  0xffff,
+              "maximum DTLS write buffer is too large");
 
 int ssl_write_buffer_init(SSL *ssl, uint8_t **out_ptr, size_t max_len) {
   SSL3_BUFFER *buf = &ssl->s3->write_buffer;
@@ -225,26 +226,7 @@ int ssl_write_buffer_init(SSL *ssl, uint8_t **out_ptr, size_t max_len) {
     return 0;
   }
 
-  size_t header_len = ssl_seal_align_prefix_len(ssl);
-
-  /* TODO(davidben): This matches the original behavior in keeping the malloc
-   * size consistent. Does this matter? |cap| could just be |max_len|. */
-  size_t cap = SSL3_RT_MAX_PLAIN_LENGTH + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD;
-  if (SSL_is_dtls(ssl)) {
-    cap += DTLS1_RT_HEADER_LENGTH;
-  } else {
-    cap += SSL3_RT_HEADER_LENGTH;
-    if (ssl->mode & SSL_MODE_CBC_RECORD_SPLITTING) {
-      cap += SSL3_RT_HEADER_LENGTH + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD;
-    }
-  }
-
-  if (max_len > cap) {
-    OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL);
-    return 0;
-  }
-
-  if (!setup_buffer(buf, header_len, cap)) {
+  if (!ensure_buffer(buf, ssl_seal_align_prefix_len(ssl), max_len)) {
     return 0;
   }
   *out_ptr = buf->buf + buf->offset;
@@ -284,9 +266,9 @@ static int dtls_write_buffer_flush(SSL *ssl) {
   int ret = BIO_write(ssl->wbio, buf->buf + buf->offset, buf->len);
   if (ret <= 0) {
     ssl->rwstate = SSL_WRITING;
-    /* If the write failed, drop the write buffer anyway. Datagram transports
-     * can't write half a packet, so the caller is expected to retry from the
-     * top. */
+    // If the write failed, drop the write buffer anyway. Datagram transports
+    // can't write half a packet, so the caller is expected to retry from the
+    // top.
     ssl_write_buffer_clear(ssl);
     return ret;
   }
@@ -310,3 +292,5 @@ int ssl_write_buffer_flush(SSL *ssl) {
 void ssl_write_buffer_clear(SSL *ssl) {
   clear_buffer(&ssl->s3->write_buffer);
 }
+
+}  // namespace bssl

data/third_party/boringssl/ssl/{ssl_cert.c → ssl_cert.cc}

@@ -118,31 +118,25 @@
 #include <limits.h>
 #include <string.h>
 
+#include <utility>
+
 #include <openssl/bn.h>
 #include <openssl/buf.h>
 #include <openssl/bytestring.h>
-#include <openssl/dh.h>
 #include <openssl/ec_key.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
 #include <openssl/sha.h>
 #include <openssl/x509.h>
-#include <openssl/x509v3.h>
 
 #include "../crypto/internal.h"
 #include "internal.h"
 
 
-int SSL_get_ex_data_X509_STORE_CTX_idx(void) {
-  /* The ex_data index to go from |X509_STORE_CTX| to |SSL| always uses the
-   * reserved app_data slot. Before ex_data was introduced, app_data was used.
-   * Avoid breaking any software which assumes |X509_STORE_CTX_get_app_data|
-   * works. */
-  return 0;
-}
+namespace bssl {
 
 CERT *ssl_cert_new(const SSL_X509_METHOD *x509_method) {
-  CERT *ret = OPENSSL_malloc(sizeof(CERT));
+  CERT *ret = (CERT *)OPENSSL_malloc(sizeof(CERT));
   if (ret == NULL) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
     return NULL;
@@ -159,7 +153,7 @@ static CRYPTO_BUFFER *buffer_up_ref(CRYPTO_BUFFER *buffer) {
 }
 
 CERT *ssl_cert_dup(CERT *cert) {
-  CERT *ret = OPENSSL_malloc(sizeof(CERT));
+  CERT *ret = (CERT *)OPENSSL_malloc(sizeof(CERT));
   if (ret == NULL) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
     return NULL;
@@ -177,18 +171,9 @@ CERT *ssl_cert_dup(CERT *cert) {
   ret->key_method = cert->key_method;
   ret->x509_method = cert->x509_method;
 
-  if (cert->dh_tmp != NULL) {
-    ret->dh_tmp = DHparams_dup(cert->dh_tmp);
-    if (ret->dh_tmp == NULL) {
-      OPENSSL_PUT_ERROR(SSL, ERR_R_DH_LIB);
-      goto err;
-    }
-  }
-  ret->dh_tmp_cb = cert->dh_tmp_cb;
-
   if (cert->sigalgs != NULL) {
-    ret->sigalgs =
-        BUF_memdup(cert->sigalgs, cert->num_sigalgs * sizeof(cert->sigalgs[0]));
+    ret->sigalgs = (uint16_t *)BUF_memdup(
+        cert->sigalgs, cert->num_sigalgs * sizeof(cert->sigalgs[0]));
     if (ret->sigalgs == NULL) {
       goto err;
     }
@@ -198,10 +183,7 @@ CERT *ssl_cert_dup(CERT *cert) {
   ret->cert_cb = cert->cert_cb;
   ret->cert_cb_arg = cert->cert_cb_arg;
 
-  if (cert->verify_store != NULL) {
-    X509_STORE_up_ref(cert->verify_store);
-    ret->verify_store = cert->verify_store;
-  }
+  ret->x509_method->cert_dup(ret, cert);
 
   if (cert->signed_cert_timestamp_list != NULL) {
     CRYPTO_BUFFER_up_ref(cert->signed_cert_timestamp_list);
@@ -216,6 +198,8 @@ CERT *ssl_cert_dup(CERT *cert) {
   ret->sid_ctx_length = cert->sid_ctx_length;
   OPENSSL_memcpy(ret->sid_ctx, cert->sid_ctx, sizeof(ret->sid_ctx));
 
+  ret->enable_early_data = cert->enable_early_data;
+
   return ret;
 
 err:
@@ -223,7 +207,7 @@ err:
   return NULL;
 }
 
-/* Free up and clear all certificates and chains */
+// Free up and clear all certificates and chains
 void ssl_cert_clear_certs(CERT *cert) {
   if (cert == NULL) {
     return;
@@ -238,335 +222,226 @@ void ssl_cert_clear_certs(CERT *cert) {
   cert->key_method = NULL;
 }
 
-void ssl_cert_free(CERT *c) {
-  if (c == NULL) {
+void ssl_cert_free(CERT *cert) {
+  if (cert == NULL) {
     return;
   }
 
-  DH_free(c->dh_tmp);
-
-  ssl_cert_clear_certs(c);
-  OPENSSL_free(c->sigalgs);
-  X509_STORE_free(c->verify_store);
-  CRYPTO_BUFFER_free(c->signed_cert_timestamp_list);
-  CRYPTO_BUFFER_free(c->ocsp_response);
+  ssl_cert_clear_certs(cert);
+  cert->x509_method->cert_free(cert);
+  OPENSSL_free(cert->sigalgs);
+  CRYPTO_BUFFER_free(cert->signed_cert_timestamp_list);
+  CRYPTO_BUFFER_free(cert->ocsp_response);
 
-  OPENSSL_free(c);
+  OPENSSL_free(cert);
 }
 
-static void ssl_cert_set_cert_cb(CERT *c, int (*cb)(SSL *ssl, void *arg),
+static void ssl_cert_set_cert_cb(CERT *cert, int (*cb)(SSL *ssl, void *arg),
                                  void *arg) {
-  c->cert_cb = cb;
-  c->cert_cb_arg = arg;
-}
-
-int ssl_set_cert(CERT *cert, CRYPTO_BUFFER *buffer) {
+  cert->cert_cb = cb;
+  cert->cert_cb_arg = arg;
+}
+
+enum leaf_cert_and_privkey_result_t {
+  leaf_cert_and_privkey_error,
+  leaf_cert_and_privkey_ok,
+  leaf_cert_and_privkey_mismatch,
+};
+
+// check_leaf_cert_and_privkey checks whether the certificate in |leaf_buffer|
+// and the private key in |privkey| are suitable and coherent. It returns
+// |leaf_cert_and_privkey_error| and pushes to the error queue if a problem is
+// found. If the certificate and private key are valid, but incoherent, it
+// returns |leaf_cert_and_privkey_mismatch|. Otherwise it returns
+// |leaf_cert_and_privkey_ok|.
+static enum leaf_cert_and_privkey_result_t check_leaf_cert_and_privkey(
+    CRYPTO_BUFFER *leaf_buffer, EVP_PKEY *privkey) {
   CBS cert_cbs;
-  CRYPTO_BUFFER_init_CBS(buffer, &cert_cbs);
-  EVP_PKEY *pubkey = ssl_cert_parse_pubkey(&cert_cbs);
-  if (pubkey == NULL) {
-    return 0;
+  CRYPTO_BUFFER_init_CBS(leaf_buffer, &cert_cbs);
+  UniquePtr<EVP_PKEY> pubkey = ssl_cert_parse_pubkey(&cert_cbs);
+  if (!pubkey) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
+    return leaf_cert_and_privkey_error;
   }
 
   if (!ssl_is_key_type_supported(pubkey->type)) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
-    EVP_PKEY_free(pubkey);
-    return 0;
+    return leaf_cert_and_privkey_error;
   }
 
-  /* An ECC certificate may be usable for ECDH or ECDSA. We only support ECDSA
-   * certificates, so sanity-check the key usage extension. */
+  // An ECC certificate may be usable for ECDH or ECDSA. We only support ECDSA
+  // certificates, so sanity-check the key usage extension.
   if (pubkey->type == EVP_PKEY_EC &&
       !ssl_cert_check_digital_signature_key_usage(&cert_cbs)) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
-    EVP_PKEY_free(pubkey);
-    return 0;
-  }
-
-  if (cert->privatekey != NULL) {
-    /* Sanity-check that the private key and the certificate match, unless the
-     * key is opaque (in case of, say, a smartcard). */
-    if (!EVP_PKEY_is_opaque(cert->privatekey) &&
-        !ssl_compare_public_and_private_key(pubkey, cert->privatekey)) {
-      /* don't fail for a cert/key mismatch, just free current private key
-       * (when switching to a different cert & key, first this function should
-       * be used, then ssl_set_pkey */
-      EVP_PKEY_free(cert->privatekey);
-      cert->privatekey = NULL;
-      /* clear error queue */
-      ERR_clear_error();
-    }
-  }
-
-  EVP_PKEY_free(pubkey);
-
-  cert->x509_method->cert_flush_cached_leaf(cert);
-
-  if (cert->chain != NULL) {
-    CRYPTO_BUFFER_free(sk_CRYPTO_BUFFER_value(cert->chain, 0));
-    sk_CRYPTO_BUFFER_set(cert->chain, 0, buffer);
-    CRYPTO_BUFFER_up_ref(buffer);
-    return 1;
-  }
-
-  cert->chain = sk_CRYPTO_BUFFER_new_null();
-  if (cert->chain == NULL) {
-    return 0;
+    return leaf_cert_and_privkey_error;
   }
 
-  if (!sk_CRYPTO_BUFFER_push(cert->chain, buffer)) {
-    sk_CRYPTO_BUFFER_free(cert->chain);
-    cert->chain = NULL;
-    return 0;
+  if (privkey != NULL &&
+      // Sanity-check that the private key and the certificate match.
+      !ssl_compare_public_and_private_key(pubkey.get(), privkey)) {
+    ERR_clear_error();
+    return leaf_cert_and_privkey_mismatch;
   }
-  CRYPTO_BUFFER_up_ref(buffer);
 
-  return 1;
+  return leaf_cert_and_privkey_ok;
 }
 
-int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, size_t der_len,
-                                 const uint8_t *der) {
-  CRYPTO_BUFFER *buffer = CRYPTO_BUFFER_new(der, der_len, NULL);
-  if (buffer == NULL) {
+static int cert_set_chain_and_key(
+    CERT *cert, CRYPTO_BUFFER *const *certs, size_t num_certs,
+    EVP_PKEY *privkey, const SSL_PRIVATE_KEY_METHOD *privkey_method) {
+  if (num_certs == 0 ||
+      (privkey == NULL && privkey_method == NULL)) {
+    OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
 
-  const int ok = ssl_set_cert(ctx->cert, buffer);
-  CRYPTO_BUFFER_free(buffer);
-  return ok;
-}
-
-int SSL_use_certificate_ASN1(SSL *ssl, const uint8_t *der, size_t der_len) {
-  CRYPTO_BUFFER *buffer = CRYPTO_BUFFER_new(der, der_len, NULL);
-  if (buffer == NULL) {
+  if (privkey != NULL && privkey_method != NULL) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_CANNOT_HAVE_BOTH_PRIVKEY_AND_METHOD);
     return 0;
   }
 
-  const int ok = ssl_set_cert(ssl->cert, buffer);
-  CRYPTO_BUFFER_free(buffer);
-  return ok;
-}
-
-int ssl_verify_cert_chain(SSL *ssl, long *out_verify_result,
-                          STACK_OF(X509) *cert_chain) {
-  if (cert_chain == NULL || sk_X509_num(cert_chain) == 0) {
-    return 0;
-  }
-
-  X509_STORE *verify_store = ssl->ctx->cert_store;
-  if (ssl->cert->verify_store != NULL) {
-    verify_store = ssl->cert->verify_store;
+  switch (check_leaf_cert_and_privkey(certs[0], privkey)) {
+    case leaf_cert_and_privkey_error:
+      return 0;
+    case leaf_cert_and_privkey_mismatch:
+      OPENSSL_PUT_ERROR(SSL, SSL_R_CERTIFICATE_AND_PRIVATE_KEY_MISMATCH);
+      return 0;
+    case leaf_cert_and_privkey_ok:
+      break;
   }
 
-  X509 *leaf = sk_X509_value(cert_chain, 0);
-  int ret = 0;
-  X509_STORE_CTX ctx;
-  if (!X509_STORE_CTX_init(&ctx, verify_store, leaf, cert_chain)) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_X509_LIB);
+  STACK_OF(CRYPTO_BUFFER) *certs_sk = sk_CRYPTO_BUFFER_new_null();
+  if (certs_sk == NULL) {
     return 0;
   }
-  if (!X509_STORE_CTX_set_ex_data(&ctx, SSL_get_ex_data_X509_STORE_CTX_idx(),
-                                  ssl)) {
-    goto err;
-  }
-
-  /* We need to inherit the verify parameters. These can be determined by the
-   * context: if its a server it will verify SSL client certificates or vice
-   * versa. */
-  X509_STORE_CTX_set_default(&ctx, ssl->server ? "ssl_client" : "ssl_server");
-
-  /* Anything non-default in "param" should overwrite anything in the ctx. */
-  X509_VERIFY_PARAM_set1(X509_STORE_CTX_get0_param(&ctx), ssl->param);
 
-  if (ssl->verify_callback) {
-    X509_STORE_CTX_set_verify_cb(&ctx, ssl->verify_callback);
-  }
-
-  int verify_ret;
-  if (ssl->ctx->app_verify_callback != NULL) {
-    verify_ret = ssl->ctx->app_verify_callback(&ctx, ssl->ctx->app_verify_arg);
-  } else {
-    verify_ret = X509_verify_cert(&ctx);
-  }
-
-  *out_verify_result = ctx.error;
-
-  /* If |SSL_VERIFY_NONE|, the error is non-fatal, but we keep the result. */
-  if (verify_ret <= 0 && ssl->verify_mode != SSL_VERIFY_NONE) {
-    ssl3_send_alert(ssl, SSL3_AL_FATAL, ssl_verify_alarm_type(ctx.error));
-    OPENSSL_PUT_ERROR(SSL, SSL_R_CERTIFICATE_VERIFY_FAILED);
-    goto err;
-  }
-
-  ERR_clear_error();
-  ret = 1;
-
-err:
-  X509_STORE_CTX_cleanup(&ctx);
-  return ret;
-}
-
-static void set_client_CA_list(STACK_OF(X509_NAME) **ca_list,
-                               STACK_OF(X509_NAME) *name_list) {
-  sk_X509_NAME_pop_free(*ca_list, X509_NAME_free);
-  *ca_list = name_list;
-}
-
-STACK_OF(X509_NAME) *SSL_dup_CA_list(STACK_OF(X509_NAME) *list) {
-  STACK_OF(X509_NAME) *ret = sk_X509_NAME_new_null();
-  if (ret == NULL) {
-    return NULL;
-  }
-
-  for (size_t i = 0; i < sk_X509_NAME_num(list); i++) {
-      X509_NAME *name = X509_NAME_dup(sk_X509_NAME_value(list, i));
-    if (name == NULL || !sk_X509_NAME_push(ret, name)) {
-      X509_NAME_free(name);
-      sk_X509_NAME_pop_free(ret, X509_NAME_free);
-      return NULL;
+  for (size_t i = 0; i < num_certs; i++) {
+    if (!sk_CRYPTO_BUFFER_push(certs_sk, certs[i])) {
+      sk_CRYPTO_BUFFER_pop_free(certs_sk, CRYPTO_BUFFER_free);
+      return 0;
     }
+    CRYPTO_BUFFER_up_ref(certs[i]);
   }
 
-  return ret;
-}
-
-void SSL_set_client_CA_list(SSL *ssl, STACK_OF(X509_NAME) *name_list) {
-  set_client_CA_list(&ssl->client_CA, name_list);
-}
+  EVP_PKEY_free(cert->privatekey);
+  cert->privatekey = privkey;
+  if (privkey != NULL) {
+    EVP_PKEY_up_ref(privkey);
+  }
+  cert->key_method = privkey_method;
 
-void SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *name_list) {
-  set_client_CA_list(&ctx->client_CA, name_list);
-}
+  sk_CRYPTO_BUFFER_pop_free(cert->chain, CRYPTO_BUFFER_free);
+  cert->chain = certs_sk;
 
-STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(const SSL_CTX *ctx) {
-  return ctx->client_CA;
+  return 1;
 }
 
-STACK_OF(X509_NAME) *SSL_get_client_CA_list(const SSL *ssl) {
-  /* For historical reasons, this function is used both to query configuration
-   * state on a server as well as handshake state on a client. However, whether
-   * |ssl| is a client or server is not known until explicitly configured with
-   * |SSL_set_connect_state|. If |handshake_func| is NULL, |ssl| is in an
-   * indeterminate mode and |ssl->server| is unset. */
-  if (ssl->handshake_func != NULL && !ssl->server) {
-    if (ssl->s3->hs != NULL) {
-      return ssl->s3->hs->ca_names;
-    }
-
-    return NULL;
-  }
-
-  if (ssl->client_CA != NULL) {
-    return ssl->client_CA;
+int ssl_set_cert(CERT *cert, UniquePtr<CRYPTO_BUFFER> buffer) {
+  switch (check_leaf_cert_and_privkey(buffer.get(), cert->privatekey)) {
+    case leaf_cert_and_privkey_error:
+      return 0;
+    case leaf_cert_and_privkey_mismatch:
+      // don't fail for a cert/key mismatch, just free current private key
+      // (when switching to a different cert & key, first this function should
+      // be used, then |ssl_set_pkey|.
+      EVP_PKEY_free(cert->privatekey);
+      cert->privatekey = NULL;
+      break;
+    case leaf_cert_and_privkey_ok:
+      break;
   }
-  return ssl->ctx->client_CA;
-}
 
-static int add_client_CA(STACK_OF(X509_NAME) **sk, X509 *x509) {
-  X509_NAME *name;
+  cert->x509_method->cert_flush_cached_leaf(cert);
 
-  if (x509 == NULL) {
-    return 0;
-  }
-  if (*sk == NULL) {
-    *sk = sk_X509_NAME_new_null();
-    if (*sk == NULL) {
-      return 0;
-    }
+  if (cert->chain != NULL) {
+    CRYPTO_BUFFER_free(sk_CRYPTO_BUFFER_value(cert->chain, 0));
+    sk_CRYPTO_BUFFER_set(cert->chain, 0, buffer.release());
+    return 1;
   }
 
-  name = X509_NAME_dup(X509_get_subject_name(x509));
-  if (name == NULL) {
+  cert->chain = sk_CRYPTO_BUFFER_new_null();
+  if (cert->chain == NULL) {
     return 0;
   }
 
-  if (!sk_X509_NAME_push(*sk, name)) {
-    X509_NAME_free(name);
+  if (!PushToStack(cert->chain, std::move(buffer))) {
+    sk_CRYPTO_BUFFER_free(cert->chain);
+    cert->chain = NULL;
     return 0;
   }
 
   return 1;
 }
 
-int SSL_add_client_CA(SSL *ssl, X509 *x509) {
-  return add_client_CA(&ssl->client_CA, x509);
-}
-
-int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *x509) {
-  return add_client_CA(&ctx->client_CA, x509);
-}
-
 int ssl_has_certificate(const SSL *ssl) {
   return ssl->cert->chain != NULL &&
          sk_CRYPTO_BUFFER_value(ssl->cert->chain, 0) != NULL &&
          ssl_has_private_key(ssl);
 }
 
-STACK_OF(CRYPTO_BUFFER) *ssl_parse_cert_chain(uint8_t *out_alert,
-                                              EVP_PKEY **out_pubkey,
-                                              uint8_t *out_leaf_sha256,
-                                              CBS *cbs,
-                                              CRYPTO_BUFFER_POOL *pool) {
-  *out_pubkey = NULL;
-
-  STACK_OF(CRYPTO_BUFFER) *ret = sk_CRYPTO_BUFFER_new_null();
-  if (ret == NULL) {
-    *out_alert = SSL_AD_INTERNAL_ERROR;
-    OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
-    return NULL;
-  }
+bool ssl_parse_cert_chain(uint8_t *out_alert,
+                          UniquePtr<STACK_OF(CRYPTO_BUFFER)> *out_chain,
+                          UniquePtr<EVP_PKEY> *out_pubkey,
+                          uint8_t *out_leaf_sha256, CBS *cbs,
+                          CRYPTO_BUFFER_POOL *pool) {
+  out_chain->reset();
+  out_pubkey->reset();
 
   CBS certificate_list;
   if (!CBS_get_u24_length_prefixed(cbs, &certificate_list)) {
     *out_alert = SSL_AD_DECODE_ERROR;
     OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
-    goto err;
+    return false;
   }
 
+  if (CBS_len(&certificate_list) == 0) {
+    return true;
+  }
+
+  UniquePtr<STACK_OF(CRYPTO_BUFFER)> chain(sk_CRYPTO_BUFFER_new_null());
+  if (!chain) {
+    *out_alert = SSL_AD_INTERNAL_ERROR;
+    OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
+    return false;
+  }
+
+  UniquePtr<EVP_PKEY> pubkey;
   while (CBS_len(&certificate_list) > 0) {
     CBS certificate;
     if (!CBS_get_u24_length_prefixed(&certificate_list, &certificate) ||
         CBS_len(&certificate) == 0) {
       *out_alert = SSL_AD_DECODE_ERROR;
       OPENSSL_PUT_ERROR(SSL, SSL_R_CERT_LENGTH_MISMATCH);
-      goto err;
+      return false;
     }
 
-    if (sk_CRYPTO_BUFFER_num(ret) == 0) {
-      *out_pubkey = ssl_cert_parse_pubkey(&certificate);
-      if (*out_pubkey == NULL) {
+    if (sk_CRYPTO_BUFFER_num(chain.get()) == 0) {
+      pubkey = ssl_cert_parse_pubkey(&certificate);
+      if (!pubkey) {
         *out_alert = SSL_AD_DECODE_ERROR;
-        goto err;
+        return false;
       }
 
-      /* Retain the hash of the leaf certificate if requested. */
+      // Retain the hash of the leaf certificate if requested.
       if (out_leaf_sha256 != NULL) {
         SHA256(CBS_data(&certificate), CBS_len(&certificate), out_leaf_sha256);
       }
     }
 
-    CRYPTO_BUFFER *buf =
-        CRYPTO_BUFFER_new_from_CBS(&certificate, pool);
-    if (buf == NULL) {
-      *out_alert = SSL_AD_DECODE_ERROR;
-      goto err;
-    }
-
-    if (!sk_CRYPTO_BUFFER_push(ret, buf)) {
+    UniquePtr<CRYPTO_BUFFER> buf(
+        CRYPTO_BUFFER_new_from_CBS(&certificate, pool));
+    if (!buf ||
+        !PushToStack(chain.get(), std::move(buf))) {
       *out_alert = SSL_AD_INTERNAL_ERROR;
-      CRYPTO_BUFFER_free(buf);
       OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
-      goto err;
+      return false;
     }
   }
 
-  return ret;
-
-err:
-  EVP_PKEY_free(*out_pubkey);
-  *out_pubkey = NULL;
-  sk_CRYPTO_BUFFER_pop_free(ret, CRYPTO_BUFFER_free);
-  return NULL;
+  *out_chain = std::move(chain);
+  *out_pubkey = std::move(pubkey);
+  return true;
 }
 
 int ssl_add_cert_chain(SSL *ssl, CBB *cbb) {
@@ -576,7 +451,8 @@ int ssl_add_cert_chain(SSL *ssl, CBB *cbb) {
 
   CBB certs;
   if (!CBB_add_u24_length_prefixed(cbb, &certs)) {
-    goto err;
+    OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+    return 0;
   }
 
   STACK_OF(CRYPTO_BUFFER) *chain = ssl->cert->chain;
@@ -587,20 +463,17 @@ int ssl_add_cert_chain(SSL *ssl, CBB *cbb) {
         !CBB_add_bytes(&child, CRYPTO_BUFFER_data(buffer),
                        CRYPTO_BUFFER_len(buffer)) ||
         !CBB_flush(&certs)) {
-      goto err;
+      OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+      return 0;
     }
   }
 
   return CBB_flush(cbb);
-
-err:
-  OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
-  return 0;
 }
 
-/* ssl_cert_skip_to_spki parses a DER-encoded, X.509 certificate from |in| and
- * positions |*out_tbs_cert| to cover the TBSCertificate, starting at the
- * subjectPublicKeyInfo. */
+// ssl_cert_skip_to_spki parses a DER-encoded, X.509 certificate from |in| and
+// positions |*out_tbs_cert| to cover the TBSCertificate, starting at the
+// subjectPublicKeyInfo.
 static int ssl_cert_skip_to_spki(const CBS *in, CBS *out_tbs_cert) {
   /* From RFC 5280, section 4.1
    *    Certificate  ::=  SEQUENCE  {
@@ -623,19 +496,19 @@ static int ssl_cert_skip_to_spki(const CBS *in, CBS *out_tbs_cert) {
   if (!CBS_get_asn1(&buf, &toplevel, CBS_ASN1_SEQUENCE) ||
       CBS_len(&buf) != 0 ||
       !CBS_get_asn1(&toplevel, out_tbs_cert, CBS_ASN1_SEQUENCE) ||
-      /* version */
+      // version
       !CBS_get_optional_asn1(
           out_tbs_cert, NULL, NULL,
           CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 0) ||
-      /* serialNumber */
+      // serialNumber
       !CBS_get_asn1(out_tbs_cert, NULL, CBS_ASN1_INTEGER) ||
-      /* signature algorithm */
+      // signature algorithm
       !CBS_get_asn1(out_tbs_cert, NULL, CBS_ASN1_SEQUENCE) ||
-      /* issuer */
+      // issuer
       !CBS_get_asn1(out_tbs_cert, NULL, CBS_ASN1_SEQUENCE) ||
-      /* validity */
+      // validity
       !CBS_get_asn1(out_tbs_cert, NULL, CBS_ASN1_SEQUENCE) ||
-      /* subject */
+      // subject
       !CBS_get_asn1(out_tbs_cert, NULL, CBS_ASN1_SEQUENCE)) {
     return 0;
   }
@@ -643,18 +516,24 @@ static int ssl_cert_skip_to_spki(const CBS *in, CBS *out_tbs_cert) {
   return 1;
 }
 
-EVP_PKEY *ssl_cert_parse_pubkey(const CBS *in) {
+UniquePtr<EVP_PKEY> ssl_cert_parse_pubkey(const CBS *in) {
   CBS buf = *in, tbs_cert;
   if (!ssl_cert_skip_to_spki(&buf, &tbs_cert)) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_CANNOT_PARSE_LEAF_CERT);
-    return NULL;
+    return nullptr;
   }
 
-  return EVP_parse_public_key(&tbs_cert);
+  return UniquePtr<EVP_PKEY>(EVP_parse_public_key(&tbs_cert));
 }
 
 int ssl_compare_public_and_private_key(const EVP_PKEY *pubkey,
                                        const EVP_PKEY *privkey) {
+  if (EVP_PKEY_is_opaque(privkey)) {
+    // We cannot check an opaque private key and have to trust that it
+    // matches.
+    return 1;
+  }
+
   int ret = 0;
 
   switch (EVP_PKEY_cmp(pubkey, privkey)) {
@@ -669,6 +548,7 @@ int ssl_compare_public_and_private_key(const EVP_PKEY *pubkey,
       break;
     case -2:
       OPENSSL_PUT_ERROR(X509, X509_R_UNKNOWN_KEY_TYPE);
+      break;
     default:
       assert(0);
       break;
@@ -691,15 +571,13 @@ int ssl_cert_check_private_key(const CERT *cert, const EVP_PKEY *privkey) {
 
   CBS cert_cbs;
   CRYPTO_BUFFER_init_CBS(sk_CRYPTO_BUFFER_value(cert->chain, 0), &cert_cbs);
-  EVP_PKEY *pubkey = ssl_cert_parse_pubkey(&cert_cbs);
+  UniquePtr<EVP_PKEY> pubkey = ssl_cert_parse_pubkey(&cert_cbs);
   if (!pubkey) {
     OPENSSL_PUT_ERROR(X509, X509_R_UNKNOWN_KEY_TYPE);
     return 0;
   }
 
-  const int ok = ssl_compare_public_and_private_key(pubkey, privkey);
-  EVP_PKEY_free(pubkey);
-  return ok;
+  return ssl_compare_public_and_private_key(pubkey.get(), privkey);
 }
 
 int ssl_cert_check_digital_signature_key_usage(const CBS *in) {
@@ -708,20 +586,21 @@ int ssl_cert_check_digital_signature_key_usage(const CBS *in) {
   CBS tbs_cert, outer_extensions;
   int has_extensions;
   if (!ssl_cert_skip_to_spki(&buf, &tbs_cert) ||
-      /* subjectPublicKeyInfo */
+      // subjectPublicKeyInfo
       !CBS_get_asn1(&tbs_cert, NULL, CBS_ASN1_SEQUENCE) ||
-      /* issuerUniqueID */
+      // issuerUniqueID
       !CBS_get_optional_asn1(
           &tbs_cert, NULL, NULL,
           CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 1) ||
-      /* subjectUniqueID */
+      // subjectUniqueID
       !CBS_get_optional_asn1(
           &tbs_cert, NULL, NULL,
           CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 2) ||
       !CBS_get_optional_asn1(
           &tbs_cert, &outer_extensions, &has_extensions,
           CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 3)) {
-    goto parse_err;
+    OPENSSL_PUT_ERROR(SSL, SSL_R_CANNOT_PARSE_LEAF_CERT);
+    return 0;
   }
 
   if (!has_extensions) {
@@ -730,7 +609,8 @@ int ssl_cert_check_digital_signature_key_usage(const CBS *in) {
 
   CBS extensions;
   if (!CBS_get_asn1(&outer_extensions, &extensions, CBS_ASN1_SEQUENCE)) {
-    goto parse_err;
+    OPENSSL_PUT_ERROR(SSL, SSL_R_CANNOT_PARSE_LEAF_CERT);
+    return 0;
   }
 
   while (CBS_len(&extensions) > 0) {
@@ -741,7 +621,8 @@ int ssl_cert_check_digital_signature_key_usage(const CBS *in) {
          !CBS_get_asn1(&extension, NULL, CBS_ASN1_BOOLEAN)) ||
         !CBS_get_asn1(&extension, &contents, CBS_ASN1_OCTETSTRING) ||
         CBS_len(&extension) != 0) {
-      goto parse_err;
+      OPENSSL_PUT_ERROR(SSL, SSL_R_CANNOT_PARSE_LEAF_CERT);
+      return 0;
     }
 
     static const uint8_t kKeyUsageOID[3] = {0x55, 0x1d, 0x0f};
@@ -754,13 +635,15 @@ int ssl_cert_check_digital_signature_key_usage(const CBS *in) {
     CBS bit_string;
     if (!CBS_get_asn1(&contents, &bit_string, CBS_ASN1_BITSTRING) ||
         CBS_len(&contents) != 0) {
-      goto parse_err;
+      OPENSSL_PUT_ERROR(SSL, SSL_R_CANNOT_PARSE_LEAF_CERT);
+      return 0;
     }
 
-    /* This is the KeyUsage extension. See
-     * https://tools.ietf.org/html/rfc5280#section-4.2.1.3 */
+    // This is the KeyUsage extension. See
+    // https://tools.ietf.org/html/rfc5280#section-4.2.1.3
     if (!CBS_is_valid_asn1_bitstring(&bit_string)) {
-      goto parse_err;
+      OPENSSL_PUT_ERROR(SSL, SSL_R_CANNOT_PARSE_LEAF_CERT);
+      return 0;
     }
 
     if (!CBS_asn1_bitstring_has_bit(&bit_string, 0)) {
@@ -771,33 +654,27 @@ int ssl_cert_check_digital_signature_key_usage(const CBS *in) {
     return 1;
   }
 
-  /* No KeyUsage extension found. */
+  // No KeyUsage extension found.
   return 1;
-
-parse_err:
-  OPENSSL_PUT_ERROR(SSL, SSL_R_CANNOT_PARSE_LEAF_CERT);
-  return 0;
 }
 
-static int ca_dn_cmp(const X509_NAME **a, const X509_NAME **b) {
-  return X509_NAME_cmp(*a, *b);
-}
+UniquePtr<STACK_OF(CRYPTO_BUFFER)> ssl_parse_client_CA_list(SSL *ssl,
+                                                            uint8_t *out_alert,
+                                                            CBS *cbs) {
+  CRYPTO_BUFFER_POOL *const pool = ssl->ctx->pool;
 
-STACK_OF(X509_NAME) *
-    ssl_parse_client_CA_list(SSL *ssl, uint8_t *out_alert, CBS *cbs) {
-  STACK_OF(X509_NAME) *ret = sk_X509_NAME_new(ca_dn_cmp);
-  X509_NAME *name = NULL;
-  if (ret == NULL) {
+  UniquePtr<STACK_OF(CRYPTO_BUFFER)> ret(sk_CRYPTO_BUFFER_new_null());
+  if (!ret) {
     *out_alert = SSL_AD_INTERNAL_ERROR;
     OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
-    return NULL;
+    return nullptr;
   }
 
   CBS child;
   if (!CBS_get_u16_length_prefixed(cbs, &child)) {
     *out_alert = SSL_AD_DECODE_ERROR;
     OPENSSL_PUT_ERROR(SSL, SSL_R_LENGTH_MISMATCH);
-    goto err;
+    return nullptr;
   }
 
   while (CBS_len(&child) > 0) {
@@ -805,33 +682,26 @@ STACK_OF(X509_NAME) *
     if (!CBS_get_u16_length_prefixed(&child, &distinguished_name)) {
       *out_alert = SSL_AD_DECODE_ERROR;
       OPENSSL_PUT_ERROR(SSL, SSL_R_CA_DN_TOO_LONG);
-      goto err;
-    }
-
-    const uint8_t *ptr = CBS_data(&distinguished_name);
-    /* A u16 length cannot overflow a long. */
-    name = d2i_X509_NAME(NULL, &ptr, (long)CBS_len(&distinguished_name));
-    if (name == NULL ||
-        ptr != CBS_data(&distinguished_name) + CBS_len(&distinguished_name)) {
-      *out_alert = SSL_AD_DECODE_ERROR;
-      OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
-      goto err;
+      return nullptr;
     }
 
-    if (!sk_X509_NAME_push(ret, name)) {
+    UniquePtr<CRYPTO_BUFFER> buffer(
+        CRYPTO_BUFFER_new_from_CBS(&distinguished_name, pool));
+    if (!buffer ||
+        !PushToStack(ret.get(), std::move(buffer))) {
       *out_alert = SSL_AD_INTERNAL_ERROR;
       OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
-      goto err;
+      return nullptr;
     }
-    name = NULL;
   }
 
-  return ret;
+  if (!ssl->ctx->x509_method->check_client_CA_list(ret.get())) {
+    *out_alert = SSL_AD_INTERNAL_ERROR;
+    OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
+    return nullptr;
+  }
 
-err:
-  X509_NAME_free(name);
-  sk_X509_NAME_pop_free(ret, X509_NAME_free);
-  return NULL;
+  return ret;
 }
 
 int ssl_add_client_CA_list(SSL *ssl, CBB *cbb) {
@@ -840,21 +710,18 @@ int ssl_add_client_CA_list(SSL *ssl, CBB *cbb) {
     return 0;
   }
 
-  STACK_OF(X509_NAME) *sk = SSL_get_client_CA_list(ssl);
-  if (sk == NULL) {
+  STACK_OF(CRYPTO_BUFFER) *names = ssl->client_CA;
+  if (names == NULL) {
+    names = ssl->ctx->client_CA;
+  }
+  if (names == NULL) {
     return CBB_flush(cbb);
   }
 
-  for (size_t i = 0; i < sk_X509_NAME_num(sk); i++) {
-    X509_NAME *name = sk_X509_NAME_value(sk, i);
-    int len = i2d_X509_NAME(name, NULL);
-    if (len < 0) {
-      return 0;
-    }
-    uint8_t *ptr;
+  for (const CRYPTO_BUFFER *name : names) {
     if (!CBB_add_u16_length_prefixed(&child, &name_cbb) ||
-        !CBB_add_space(&name_cbb, &ptr, (size_t)len) ||
-        (len > 0 && i2d_X509_NAME(name, &ptr) < 0)) {
+        !CBB_add_bytes(&name_cbb, CRYPTO_BUFFER_data(name),
+                       CRYPTO_BUFFER_len(name))) {
       return 0;
     }
   }
@@ -862,71 +729,34 @@ int ssl_add_client_CA_list(SSL *ssl, CBB *cbb) {
   return CBB_flush(cbb);
 }
 
-static int set_cert_store(X509_STORE **store_ptr, X509_STORE *new_store, int take_ref) {
-  X509_STORE_free(*store_ptr);
-  *store_ptr = new_store;
-
-  if (new_store != NULL && take_ref) {
-    X509_STORE_up_ref(new_store);
-  }
-
-  return 1;
-}
-
-int SSL_CTX_set0_verify_cert_store(SSL_CTX *ctx, X509_STORE *store) {
-  return set_cert_store(&ctx->cert->verify_store, store, 0);
-}
-
-int SSL_CTX_set1_verify_cert_store(SSL_CTX *ctx, X509_STORE *store) {
-  return set_cert_store(&ctx->cert->verify_store, store, 1);
-}
-
-int SSL_set0_verify_cert_store(SSL *ssl, X509_STORE *store) {
-  return set_cert_store(&ssl->cert->verify_store, store, 0);
-}
-
-int SSL_set1_verify_cert_store(SSL *ssl, X509_STORE *store) {
-  return set_cert_store(&ssl->cert->verify_store, store, 1);
-}
-
-void SSL_CTX_set_cert_cb(SSL_CTX *ctx, int (*cb)(SSL *ssl, void *arg),
-                         void *arg) {
-  ssl_cert_set_cert_cb(ctx->cert, cb, arg);
-}
-
-void SSL_set_cert_cb(SSL *ssl, int (*cb)(SSL *ssl, void *arg), void *arg) {
-  ssl_cert_set_cert_cb(ssl->cert, cb, arg);
-}
-
 int ssl_check_leaf_certificate(SSL_HANDSHAKE *hs, EVP_PKEY *pkey,
                                const CRYPTO_BUFFER *leaf) {
   SSL *const ssl = hs->ssl;
   assert(ssl3_protocol_version(ssl) < TLS1_3_VERSION);
 
-  /* Check the certificate's type matches the cipher. */
-  int expected_type = ssl_cipher_get_key_type(hs->new_cipher);
-  assert(expected_type != EVP_PKEY_NONE);
-  if (pkey->type != expected_type) {
+  // Check the certificate's type matches the cipher.
+  if (!(hs->new_cipher->algorithm_auth & ssl_cipher_auth_mask_for_key(pkey))) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_CERTIFICATE_TYPE);
     return 0;
   }
 
-  if (hs->new_cipher->algorithm_auth & SSL_aECDSA) {
+  // Check key usages for all key types but RSA. This is needed to distinguish
+  // ECDH certificates, which we do not support, from ECDSA certificates. In
+  // principle, we should check RSA key usages based on cipher, but this breaks
+  // buggy antivirus deployments. Other key types are always used for signing.
+  //
+  // TODO(davidben): Get more recent data on RSA key usages.
+  if (EVP_PKEY_id(pkey) != EVP_PKEY_RSA) {
     CBS leaf_cbs;
     CBS_init(&leaf_cbs, CRYPTO_BUFFER_data(leaf), CRYPTO_BUFFER_len(leaf));
-    /* ECDSA and ECDH certificates use the same public key format. Instead,
-     * they are distinguished by the key usage extension in the certificate. */
     if (!ssl_cert_check_digital_signature_key_usage(&leaf_cbs)) {
       return 0;
     }
+  }
 
+  if (EVP_PKEY_id(pkey) == EVP_PKEY_EC) {
+    // Check the key's group and point format are acceptable.
     EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(pkey);
-    if (ec_key == NULL) {
-      OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECC_CERT);
-      return 0;
-    }
-
-    /* Check the key's group and point format are acceptable. */
     uint16_t group_id;
     if (!ssl_nid_to_group_id(
             &group_id, EC_GROUP_get_curve_name(EC_KEY_get0_group(ec_key))) ||
@@ -940,36 +770,84 @@ int ssl_check_leaf_certificate(SSL_HANDSHAKE *hs, EVP_PKEY *pkey,
   return 1;
 }
 
-static int do_client_cert_cb(SSL *ssl, void *arg) {
-  if (ssl_has_certificate(ssl) || ssl->ctx->client_cert_cb == NULL) {
+int ssl_on_certificate_selected(SSL_HANDSHAKE *hs) {
+  SSL *const ssl = hs->ssl;
+  if (!ssl_has_certificate(ssl)) {
+    // Nothing to do.
     return 1;
   }
 
-  X509 *x509 = NULL;
-  EVP_PKEY *pkey = NULL;
-  int ret = ssl->ctx->client_cert_cb(ssl, &x509, &pkey);
-  if (ret < 0) {
-    return -1;
+  if (!ssl->ctx->x509_method->ssl_auto_chain_if_needed(ssl)) {
+    return 0;
   }
 
-  if (ret != 0) {
-    if (!SSL_use_certificate(ssl, x509) ||
-        !SSL_use_PrivateKey(ssl, pkey)) {
-      return 0;
-    }
+  CBS leaf;
+  CRYPTO_BUFFER_init_CBS(sk_CRYPTO_BUFFER_value(ssl->cert->chain, 0), &leaf);
+
+  hs->local_pubkey = ssl_cert_parse_pubkey(&leaf);
+  return hs->local_pubkey != NULL;
+}
+
+}  // namespace bssl
+
+using namespace bssl;
+
+int SSL_set_chain_and_key(SSL *ssl, CRYPTO_BUFFER *const *certs,
+                          size_t num_certs, EVP_PKEY *privkey,
+                          const SSL_PRIVATE_KEY_METHOD *privkey_method) {
+  return cert_set_chain_and_key(ssl->cert, certs, num_certs, privkey,
+                                privkey_method);
+}
+
+int SSL_CTX_set_chain_and_key(SSL_CTX *ctx, CRYPTO_BUFFER *const *certs,
+                              size_t num_certs, EVP_PKEY *privkey,
+                              const SSL_PRIVATE_KEY_METHOD *privkey_method) {
+  return cert_set_chain_and_key(ctx->cert, certs, num_certs, privkey,
+                                privkey_method);
+}
+
+int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, size_t der_len,
+                                 const uint8_t *der) {
+  UniquePtr<CRYPTO_BUFFER> buffer(CRYPTO_BUFFER_new(der, der_len, NULL));
+  if (!buffer) {
+    return 0;
   }
 
-  X509_free(x509);
-  EVP_PKEY_free(pkey);
-  return 1;
+  return ssl_set_cert(ctx->cert, std::move(buffer));
+}
+
+int SSL_use_certificate_ASN1(SSL *ssl, const uint8_t *der, size_t der_len) {
+  UniquePtr<CRYPTO_BUFFER> buffer(CRYPTO_BUFFER_new(der, der_len, NULL));
+  if (!buffer) {
+    return 0;
+  }
+
+  return ssl_set_cert(ssl->cert, std::move(buffer));
+}
+
+void SSL_CTX_set_cert_cb(SSL_CTX *ctx, int (*cb)(SSL *ssl, void *arg),
+                         void *arg) {
+  ssl_cert_set_cert_cb(ctx->cert, cb, arg);
 }
 
-void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx, int (*cb)(SSL *ssl,
-                                                        X509 **out_x509,
-                                                        EVP_PKEY **out_pkey)) {
-  /* Emulate the old client certificate callback with the new one. */
-  SSL_CTX_set_cert_cb(ctx, do_client_cert_cb, NULL);
-  ctx->client_cert_cb = cb;
+void SSL_set_cert_cb(SSL *ssl, int (*cb)(SSL *ssl, void *arg), void *arg) {
+  ssl_cert_set_cert_cb(ssl->cert, cb, arg);
+}
+
+STACK_OF(CRYPTO_BUFFER) *SSL_get0_peer_certificates(const SSL *ssl) {
+  SSL_SESSION *session = SSL_get_session(ssl);
+  if (session == NULL) {
+    return NULL;
+  }
+
+  return session->certs;
+}
+
+STACK_OF(CRYPTO_BUFFER) *SSL_get0_server_requested_CAs(const SSL *ssl) {
+  if (ssl->s3->hs == NULL) {
+    return NULL;
+  }
+  return ssl->s3->hs->ca_names.get();
 }
 
 static int set_signed_cert_timestamp_list(CERT *cert, const uint8_t *list,
@@ -1010,3 +888,15 @@ int SSL_set_ocsp_response(SSL *ssl, const uint8_t *response,
   ssl->cert->ocsp_response = CRYPTO_BUFFER_new(response, response_len, NULL);
   return ssl->cert->ocsp_response != NULL;
 }
+
+void SSL_CTX_set0_client_CAs(SSL_CTX *ctx, STACK_OF(CRYPTO_BUFFER) *name_list) {
+  ctx->x509_method->ssl_ctx_flush_cached_client_CA(ctx);
+  sk_CRYPTO_BUFFER_pop_free(ctx->client_CA, CRYPTO_BUFFER_free);
+  ctx->client_CA = name_list;
+}
+
+void SSL_set0_client_CAs(SSL *ssl, STACK_OF(CRYPTO_BUFFER) *name_list) {
+  ssl->ctx->x509_method->ssl_flush_cached_client_CA(ssl);
+  sk_CRYPTO_BUFFER_pop_free(ssl->client_CA, CRYPTO_BUFFER_free);
+  ssl->client_CA = name_list;
+}