Checking server certificate without DNS

[Grummel7]

I am currently implementing an application that uses an HTTPS client with Mutual SSL with Poco (12.4, since it should run on EL8). So far it works fine, I could even build a server simulator for the same using Poco as well.

Now I've been informed that in the operational emvirnment there will be no DNS. The application should connect to an URL containing on of two IP addresses and the name used to check the server certificate must be supplied additionally. So far I have found two options to implement this.

1. The following constructor's documentation says, the hostname will be used for certificate verification:

explicit HTTPSClientSession(
    const SecureStreamSocket & socket,
    const std::string & host,
    Poco::UInt16 port = HTTPS_PORT
);

But how do I tell the session which IP to connect to? I suspect it will still use DNS...

2. Write my own InvalidCertificateHandler:

class MyInvalidCertificateHandler : public InvalidCertificateHandler
{
public:
   MyInvalidCertificateHandler(const std::string vhost)
      : InvalidCertificateHandler(false),
        mVHost(vhost)
   { }

   void onInvalidCertificate(const void*, VerificationErrorArgs& errorCert)  override
   {
      if (errorCert.certificate().verify(mVHost)
      {
         errorCert.setIgnoreError(true);
      }
   }

private:
   std::string mVHost;
};

Now I tried adding it to both context and SSLManager, but its onInvalidCertificate() method never gets called and the server certificate is rejected.

   Context::Ptr contextPtr = new Context(Context::CLIENT_USE, trustDB, Context::VERIFY_STRICT);
   // client certificate code setup removed
   SharedPtr<InvalidCertificateHandler> crtHdlPtr = new MyInvalidCertificateHandler(certName);
   contextPtr->setInvalidCertificateHandler(crtHdlPtr);
   SSLManager::instance().initializeClient(nullptr, crtHdlPtr, contextPtr);
   sessionPtr = std::make_shared<HTTPSClientSession>(uri.getHost(), uri.getPort());

Any ideas what I do wrong?
Or How I could implement such a virtual host name checking with Poco?

[Grummel7]

I've compile the library to look into it. The issue seems the same in 12.4 and main.
NetSSL_OpenSSL/src:SecureSocketImpl.cpp:

void SecureSocketImpl::connectSSL(bool performHandshake)
...
		if (performHandshake && _pSocket->getBlocking())
		{
			int ret = ::SSL_connect(_pSSL);
			handleError(ret);
			verifyPeerCertificate();
		}

::SSL_connect, can call onInvalidCertificate via SSLManager::verifyCallback
But verifyPeerCertificate does not use the defined InvalidCertificateHandler.

Is this intended?

[Grummel7]

After digging through the code, I found a way that works:

   Context::Ptr contextPtr = new Context(Context::CLIENT_USE, trustDB, Context::VERIFY_STRICT);
   // client certificate code setup removed
   SecureStreamSocket sss;
   sss.setPeerHostName(mVHost);
   sessionPtr = std::make_shared<HTTPSClientSession>(sss);
   sessionPtr->setHost(uri.getHost());
   sessionPtr->setPort(uri.getPort());