only fail DANE verification if status is non-zero

diff --git a/src/cli.c b/src/cli.c
index d1a43fc7ad06e4319f2958b94928d0e9edbc2c03..00309a8d72ca333d0b59a534c653c388db3beaed 100644 (file)
--- a/src/cli.c
+++ b/src/cli.c
@@ -488,7 +488,7 @@ static int cert_verify_callback(gnutls_session_t session)
                                gnutls_free(out.data);
                        }
 
-                       if (!insecure && !ssh)
+                       if (status != 0 && !insecure && !ssh)
                                return -1;
                }