untrusted comment: verify with openbsd-72-base.pub
RWQTKNnK3CZZ8BpZmfrQRq2F0DAhW6dxBSUKYtuqw3xcqBllvEsr7g3ZDLgB0T2zx/+fb509DjF9XHjo/kCSMuoKHqcNryx14wo=

OpenBSD 7.2 errata 001, October 24, 2022:

Custom verification callbacks could cause the X.509 verifier to fail
to store errors resulting from leaf certificate verification.

Apply by doing:
    signify -Vep /etc/signify/openbsd-72-base.pub -x 001_x509.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install libcrypto and unwind:
    cd /usr/src/lib/libcrypto
    make obj
    make includes
    make
    make install

Index: lib/libcrypto/x509/x509_verify.c
===================================================================
RCS file: /cvs/src/lib/libcrypto/x509/x509_verify.c,v
retrieving revision 1.60
diff -u -p -r1.60 x509_verify.c
--- lib/libcrypto/x509/x509_verify.c	5 Aug 2022 14:46:52 -0000	1.60
+++ lib/libcrypto/x509/x509_verify.c	18 Oct 2022 08:32:25 -0000
@@ -494,6 +494,15 @@ x509_verify_ctx_add_chain(struct x509_ve
 	if (!x509_verify_ctx_validate_legacy_chain(ctx, chain, depth))
 		return 0;
 
+	/* Verify the leaf certificate and store any resulting error. */
+	if (!x509_verify_cert_valid(ctx, leaf, NULL))
+		return 0;
+	if (!x509_verify_cert_hostname(ctx, leaf, name))
+		return 0;
+	if (ctx->error_depth == 0 &&
+	    ctx->error != X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY)
+		chain->cert_errors[0] = ctx->error;
+
 	/*
 	 * In the non-legacy code, extensions and purpose are dealt
 	 * with as the chain is built.
@@ -508,16 +517,11 @@ x509_verify_ctx_add_chain(struct x509_ve
 		return x509_verify_cert_error(ctx, last, depth,
 		    X509_V_ERR_OUT_OF_MEM, 0);
 	}
-
-	if (!x509_verify_cert_valid(ctx, leaf, NULL))
-		return 0;
-
-	if (!x509_verify_cert_hostname(ctx, leaf, name))
-		return 0;
-
 	ctx->chains_count++;
+
 	ctx->error = X509_V_OK;
 	ctx->error_depth = depth;
+
 	return 1;
 }