OpenSSL default handling of expired client certificates during mutual TLS

The goal is to enforce least‑privilege authentication by ensuring that a TLS server rejects connections when the client presents an expired certificate, even when SSL_VERIFY_PEER is set.

OpenSSL completes the handshake and stores the error X509_V_ERR_CERT_HAS_EXPIRED in the verification result, but it does not automatically abort the connection. The application must examine SSL_get_verify_result() (or provide a custom verify_callback) to decide whether to continue. This leaves an unresolved policy decision about whether the library should treat expiration as a fatal alert by default or rely solely on application‑level checks.

What verification flag or callback configuration would cause OpenSSL to treat an expired client certificate as a fatal error without requiring explicit application logic? Should developers enable additional verify modes, or is the current approach of checking SSL_get_verify_result() the recommended practice for least‑privilege enforcement?