SSL_CTX_set_info_callback notification noise during TLS handshakes

Handshake Monitoring in OpenSSL 3.x

Implementing a monitoring system to capture TLS handshake failures requires balancing detailed visibility with the volume of informational events. Using SSL_CTX_set_info_callback allows an application to track the progress of a connection, but the callback triggers for both successful state transitions and error conditions.

Error Queue Management

Because OpenSSL utilizes a thread-local error queue, failures captured via ERR_get_error may persist across multiple checks if the queue is not explicitly drained. This creates a risk of duplicate alerts or stale error reporting when combined with the high-frequency events of the info callback.

There is uncertainty regarding the most efficient way to filter out routine handshake progress to isolate only actionable certificate verification failures without missing transient TLS alerts.

• How can the where and ret parameters in the info callback be used to distinguish critical failures from informational noise?
• What is the recommended pattern for draining the error queue within this callback to prevent duplicate notifications?