hopefully someone can help me with this one. i have scoured the
documentation, source code and mailing list but it is to no avail.
here is the problem. i want to trust peer certificates based upon the
issuer. seems simple but i can't seem to make it work. to add to the
difficulty, i am not adding the certificates from files, they are maintained
in a database which i am loading when i am adding the trust certificate and
specifying the name. i have tried just letting the built-in verifyier do
the work but that didn't work. it reports it can't find the certificates
with its standard error message. anyway here is my code to add the trusted
issuers and the verify callback setup:
X509_STORE* store = SSL_CTX_get_cert_store( ssl->ctx );
for( int x = 0; x < hData->trustlevel->certificates.size(); x++ )
{
PeerCertificate* cert = hData->trustlevel->certificates[x];
X509* x509 = CryptoServices::blobToX509( cert->certificateBlob );
// First add the certificates to the store so they can be found.
X509_STORE_add_cert( store, x509 );
// now add the certificate names to the list of issuers that are
valid.
SSL_CTX_add_client_CA( ssl->ctx, x509 );
X509_free( x509 );
}
// make sure we go as deep as possible on checking the issuer.
SSL_CTX_set_verify_depth( ssl->ctx, 9 );
SSL_CTX_set_verify( ssl->ctx,
SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT|SSL_VERIFY_CLIENT_ONCE,
issuer_verify_callback );
here is the verify callback:
int issuer_verify_callback(int ok, X509_STORE_CTX *ctx)
{
char buf[256];
X509 *ver_cert;
X509 *issuer;
int err,depth;
int retval = 0;
X509 *cert;
ver_cert=X509_STORE_CTX_get_current_cert(ctx);
// or i can use:
// ver_cert = ctx->cert;
err= X509_STORE_CTX_get_error(ctx);
depth= X509_STORE_CTX_get_error_depth(ctx);
int count = ctx->get_issuer( &cert, ctx, x509 );
for( int x = 0; x < count && retval == 0; x++ )
{
if( X509_find_by_subject( ctx->chain, X509_get_subject_name(
&(cert[x]) )) != NULL )
{
ok= 1;
}
}
< some other checking here... >
return(ok);
}
This code works fine for some certificates but not all. is what i am doing
necessary? am i doing it correctly or should it be done in another manner.
when it works, it receive a certificate at depth 0 and i obtain the issuers
for the user cert and i then look to see if the issuer certificate is
present in the ctx->chain which i am supposing is created from the trusted
store loaded from the setup step. in those instances where it does not
work, the certificates found in the chain are passed in one at a time,
starting with the root CA ending with the user certificate, for a total
depth of 4. for each pass with this certificate, i am unable to obtain the
issuer certificate that goes with the user certificate.
this code is being run as a server application and the client application i
am using is:
openssl s_client -connect 192.168.0.8:443 -state -debug -CAfile
dstissuer.pem -cert dstcert.pem -key dstkey.pem
no problems are being reported from the client application as it runs.
thanks.
chris
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
