OCSP signature verification discards OpenSSL error information

In https://github.com/ruby/openssl/blob/master/ext/openssl/ossl_ocsp.c#L428-L429, ossl_ocspreq_verify does:

    if (result <= 0)
	ossl_clear_error();

return result > 0 ? Qtrue : Qfalse;

If the result is not successful, the error information is cleared. This makes it not available in OpenSSL.errors for inspection by the caller.

Response verification has the same issue.

To get this information, one needs to enable OpenSSL.debug prior to calling the verify method.

Example missing information:

(byebug) resp.verify([ca_cert], store)
Result: 0
false
(byebug) OpenSSL.errors 
[]
(byebug) resp.verify([ca_cert], store)
Result: 0
false
(byebug) OpenSSL.errors 
[]
(byebug) OpenSSL.debug=true
true
(byebug) resp.verify([ca_cert], store)
(byebug):1: warning: error on stack: error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error (Verify error:self signed certificate)
Result: 0
false
(byebug) store.add_cert(ca_cert)
#<OpenSSL::X509::Store:0x00005630c0470120 @verify_callback=nil, @error=nil, @error_string=nil, @chain=nil, @time=nil>
(byebug) resp.verify [],store
(byebug):1: warning: error on stack: error:27069076:OCSP routines:OCSP_basic_verify:signer certificate not found
Result: 0
false
(byebug) resp.verify [ca_cert],store
Result: 1
true

Without the debug information, figuring out why verification failed is impractical.

One way of solving this is to provide a method like verify! which would raise an exception if verification fails, including the openssl error information into the method.

Start in ext/openssl/ossl_ocsp.c around ossl_ocspreq_verify at lines 428-429, then trace the corresponding response verification path. Compare the failed-verification behavior with OpenSSL.errors and OpenSSL.debug using the examples in the issue. Done means callers can inspect the OpenSSL error information after failed request and response verification, with the resulting API behavior covered by tests.