Manual Validation Callbacks vs. External TLS Engines for Certificate Verification

TLS Certificate Chain Validation in Zig

The std.crypto.tls implementation in the Zig standard library handles the TLS handshake but does not include built-in RFC-5280 certificate chain verification. By default, the client accepts any presented certificate unless a custom validation callback is provided by the developer.

When building a secure client, there is a trade-off between implementing a custom verification routine using std.crypto.x509 and linking against an external TLS engine like BoringSSL or OpenSSL to handle the trust store and chain validation.

Using the standard library's callback mechanism maintains a lightweight binary and avoids external ABI dependencies, but requires the developer to manually manage root certificates and validation logic. Conversely, external engines provide robust, battle-tested verification but increase the project's dependency footprint.

• Which approach is preferred for maintaining long-term compatibility with the evolving std.crypto.tls API?
• Does the manual callback approach provide sufficient primitives for full chain validation without external libraries?