Hello everyone, sorry for the multiple mails but I think I found my issue. In the documentation I discovered this:
"Note that gnutls_pubkey_get_key_id <https://www.gnutls.org/manual/html_node/Abstract-key-API.html#gnutls_005fpubkey_005fget_005fkey_005fid> calculates a SHA1 digest of the public key as a DER-formatted, subjectPublicKeyInfo object. Other implementations use different approaches, e.g., some use the “common method” described in section 4.2.1.2 of [RFC5280 <https://www.gnutls.org/manual/html_node/Bibliography.html#RFC5280>] which calculates a digest on a part of the subjectPublicKeyInfo object. " Is it with gnutls possible to generate the key id with one of the "common methods" described in RFC5280? Regards, ckmk14 2018-07-16 15:06 GMT+02:00 Markus Karch <[email protected]>: > Hello, > > I am creating a self signed X.509 certificate and trying to set the SKI > and the AKI. > These values should be the SHA-1 of the public key. > But when I am settign these values I am only getting the SHA-1 hash value > of the private key. > What am I doing wrong? Here is a code snippet : > > > > gnutls_x509_crt_t crt; > gnutls_x509_privkey_t privKey; > > gnutls_x509_crt_init(&crt); > gnutls_x509_privkey_init(&privKey); > > int gnuErr = gnutls_x509_privkey_generate(privKey, GNUTLS_PK_RSA, 2048, 0); > gnuErr = gnutls_x509_crt_set_dn (crt, "O=test,CN=test", NULL); > gnuErr = gnutls_x509_crt_set_key(crt, privKey); > gnutls_x509_crt_set_version(crt, 3); > int serialNumber = rand(); > gnuErr = gnutls_x509_crt_set_serial(crt, &serialNumber, sizeof(int)); > > //Here is the problem > gnutls_pubkey_t pubKey; > gnuErr = gnutls_pubkey_init(&pubKey); > gnuErr = gnutls_pubkey_import_x509(pubKey, crt,0 ); > unsigned char test[20]; // Normally 20 bytes (SHA1) > size_t size = sizeof(test); > //Here I am getting the hash of the private key > gnuErr = gnutls_pubkey_get_key_id(pubKey, 0, test, &size); > gnuErr = gnutls_x509_crt_set_subject_key_id(crt, test, size); > > //.... > > Regards, > ckmk14 > >
_______________________________________________ Gnutls-help mailing list [email protected] http://lists.gnupg.org/mailman/listinfo/gnutls-help
