The
inline SSLServer::SSLServer(const char *cert_path, const char *private_key_path,
const char *client_ca_cert_file_path,
const char *client_ca_cert_dir_path,
const char *private_key_password);
should include a call to SSL_CTX_set_client_CA_list when client_ca_cert_file_path is provided so that the server will send the client the list of issuer distinguished names that the server will accept for TSL client/certificate authentication.
Something like
if (client_ca_cert_file_path)
{
SSL_CTX_set_client_CA_list(ctx_, SSL_load_client_CA_file(client_ca_cert_file_path));
}
after the call to SSL_CTX_load_verify_locations().
It should also do it for the client_ca_cert_dir_path option, but that's more complicated and annoying.