Here's my situation:
I have a setup where all private keys (encrypted) and certificates are
stored in a directory service from where I retrieve them. So I don't
have files where the things are kept.
Now I want to do certification verification when establishing SSL
connections. The certification structure is very simple, one single
root CA certificate, all other ceritificates are signed directly by
this CA.
As long as I have the CA certificate in a file, things work as
expected. I do something like (on the server side):
ctx=SSL_CTX_new(meth);
SSL_CTX_use_certificate(ctx, server_cert);
SSL_CTX_use_PrivateKey(ctx, server_pkey);
SSL_CTX_check_private_key(ctx);
SSL_CTX_load_verify_locations(ctx, ca_cert_file, NULL);
SSL_CTX_set_verify(ctx, s_server_verify, verify_callback);
SSL_CTX_set_verify_depth(ctx, verify_depth);
SSL_accept()
On the client side I do it analog. I get correct result, it recognizes
expired, valid etc. certificates.
But in my real world situation, I don't have the CA certificate in a
file, but rather already as a X509 structure. Now I do
X509_STORE_add_cert(SSL_CTX_get_cert_store(ctx), ca_cert);
instead of
SSL_CTX_load_verify_locations(ctx, ca_cert_file, NULL);
Things seem to work ok at first sight, but I wonder if I do it
correctly. To me, it seems like this goes a bit deep into the SSL_CTX
structure and I'm not sure if I don't damage anything else...
Can somebody confirm me that I'm doing "the right thing" or give me
advice on how to do it correctly.
Regards, Joe
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
