Hi Shahin
Thanks again for your advise
still have some problems to get it work with curl
when writing :
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0);
curl_easy_setopt(curl,CURLOPT_SSL_CTX_FUNCTION,
&Connector::loadFromMemory); //suppose to load the certificate
curl_easy_setopt (curl, CURLOPT_SSL_VERIFYPEER, TRUE);
ret = curl_easy_perform(curl);
..."
It behaves like no certificate has been uploaded to the database (looking for
certificate path)
Is there another way to way to verify the certificate.
thanks :)
Itay
As Patrick wrote you can load a certificate into X509 structure, but after that
you need to validate it with other facilities such as functions implemented in
X509_STORE set. You can find a simple code below to load both PEM and DER
certificate into a X509 structure.
int loadFromMemory(char *buf, int bufLen)
{
BIO *bp = NULL;
X509 *cert = NULL;
#define retFree(x) do { \
if(bp) \
BIO_free(bp); \
if(cert) \
X509_free(cert); \
return x; \
} while(0);
if(!buf || bufLen < 1)
return 1;
bp = BIO_new(BIO_s_mem());
if(!bp)
return 2;
cert = X509_new();
if(!cert)
retFree(3);
if(!BIO_write(bp, buf, bufLen))
retFree(4);
cert = PEM_read_bio_X509(bp, NULL, NULL);
if(!cert) {
BIO_free(bp);
bp = BIO_new(BIO_s_mem());
if(!bp)
retFree(5);
if(!BIO_write(bp, (char *) buf, bufLen))
retFree(6);
cert = d2i_X509_bio(bp, NULL);
}
BIO_free(bp);
if(!cert)
retFree(7);
return 0;
}
Regards,
Shahin Khorasani
Patrick Patterson wrote:
> On November 23, 2008 10:57:55 pm ThanhTrung Do wrote:
>
> Something like the following should work if the certificate is in PEM format.
> (note: this is example only - the below code is probably full of errors,
> because I just zen'd it from memory). I'm sure that Steve or one of the other
> guru's will correct any problems :)
>
> char certbuf = "PEM-ENCODED-CERTIFICATE";
>
> BIO *bufbio = BIO_new(BIO_s_mem());
> int len = BIO_puts(bufbio , certbuf);
>
> X509 *cert = X509_new();
> PEM_read_bio_X509(bufbio, &cert, NULL, NULL);
>
> If the Cert is already in DER format, just use the d2i_X509() function to
> read
> it into the OpenSSL internal representation.
>
> Have fun.
>>> From: Itay Dagan <[EMAIL PROTECTED]>
>>> Subject: verify certificate - not from a file
>>> To: [email protected]
>>> Date: Monday, November 24, 2008, 12:37 AM
>>> Hi Guys
>>>
>>> I am new in openssl - so hopfully I am not bringing up an
>>> old issue :
>>>
>>> I am trying to verify a certificate that I am saving as
>>> string in a random place on my PC memory.
>>>
>>> I know that there is the
>>> "SSL_CTX_load_verify_locations()" that verify
>>> certificate from a file or a path.
>>>
>>> My Q is :
>>> Does openssl supports taking certificate not from a file or
>>> path but from a place in the memory ?
>>> meaning - A function that gets a char* - reads the
>>> certificate from that location and verifying it.
>>>
>>>
>>> appreciate your help :)
>>>
>> I have the same need too, highly appreciate your helps.
>>
>>
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [email protected]
Automated List Manager [email protected]
