Hello, I think the documentation for d2i_X509 is insufficiently clear about the
reuse behaviour. The DESCRIPTION has the following:
https://www.openssl.org/docs/crypto/d2i_X509.html
If *px is not NULL then it is assumed that *px contains a valid X509
structure and an attempt is made to reuse it.
You might think that means you can save an allocation if you have a lot of
ceritificates to verify when an allocation is expensive, by reusing the same
X509 structure after you've finished with the previous one. However, this is
clarified in the BUGS section:
In some versions of OpenSSL the ``reuse'' behaviour of d2i_X509() when *px
is valid is broken and some parts of the reused structure may persist if
they are not present in the new one. As a result the use of this ``reuse''
behaviour is strongly discouraged.
I naively assumed that "some versions" meant "old versions", and used the reuse
feature. This is not the case, as even the current version does this, so
"strongly discouraged" actually means certificate verification will be silently
broken.
So the *ONLY* ways to use d2i_X509 (maybe the other X509 routines?) is like
this:
X509 *x = NULL;
d2i_x509(&x, ...); // SAFE
X509 *x = X509_new();
d2i_x509(&x, ...); // SAFE, but basically identical to previous
one.
x = d2i_x509(NULL, ...); // SAFE
X509 *x = X509_new();
for (i = 0; i < ncerts; i++) {
if (d2i_x509(&x, ...)) { // NOT SAFE - DO NOT DO THIS!!
/* stuff */
}
}
X509_free(x);
I've attached some quick example code that shows x509_verify_cert() will
validate a certificate I modified to change the commonName. Use the attached
PEM CA store.
$ openssl version
OpenSSL 1.0.1 14 Mar 2012
$ gcc reuse.c -lcrypto -o reuse
$ ./reuse
OK: /C=US/ST=California/L=Mountain View/O=Google Inc/CN=*.google.com
OK: /C=US/ST=California/L=Mountain View/O=Google Inc/CN=*.gooxxx.com
I propose this patch against trunk:
diff --git a/doc/crypto/d2i_X509.pod b/doc/crypto/d2i_X509.pod
index 298ec54..e5935f2 100644
--- a/doc/crypto/d2i_X509.pod
+++ b/doc/crypto/d2i_X509.pod
@@ -28,9 +28,9 @@ successful a pointer to the B<X509> structure is returned. If
an error
occurred then B<NULL> is returned. If B<px> is not B<NULL> then the
returned structure is written to B<*px>. If B<*px> is not B<NULL>
then it is assumed that B<*px> contains a valid B<X509>
-structure and an attempt is made to reuse it. If the call is
-successful B<*in> is incremented to the byte following the
-parsed data.
+structure from a call to B<X509_new()> (See B<WARNINGS> section for additional
+notes on reuse). If the call is successful B<*in> is incremented to the byte
+following the parsed data.
i2d_X509() encodes the structure pointed to by B<x> into DER format.
If B<out> is not B<NULL> is writes the DER encoded data to the buffer
@@ -192,12 +192,14 @@ interpret its (invalid) value as an B<X509> structure,
typically causing
a segmentation violation. If B<x> is set to NULL first then this will not
happen.
+You cannot reuse an B<X509> structure that has been previously populated by a
+different structure, it must be freshly allocated with X509_new(), or NULL.
+
=head1 BUGS
-In some versions of OpenSSL the "reuse" behaviour of d2i_X509() when
-B<*px> is valid is broken and some parts of the reused structure may
-persist if they are not present in the new one. As a result the use
-of this "reuse" behaviour is strongly discouraged.
+The "reuse" behaviour of d2i_X509() when B<*px> is valid is broken and some
+parts of the reused structure may persist if they are not present in the new
+one. As a result the use of this "reuse" behaviour is dangerous.
i2d_X509() will not return an error in many versions of OpenSSL,
if mandatory fields are not initialized due to a programming error
Thanks, Tavis.
#include <stdio.h>
#include <stdint.h>
#include <string.h>
#include <openssl/x509.h>
unsigned char google_leaf_cert[] = {
0x30, 0x82, 0x07, 0x20, 0x30, 0x82, 0x06, 0x08, 0xa0, 0x03, 0x02, 0x01,
0x02, 0x02, 0x08, 0x1f, 0xf0, 0xb4, 0x43, 0x86, 0xd5, 0x81, 0x60, 0x30,
0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05,
0x05, 0x00, 0x30, 0x49, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04,
0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55,
0x04, 0x0a, 0x13, 0x0a, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49,
0x6e, 0x63, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
0x1c, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x74, 0x65,
0x72, 0x6e, 0x65, 0x74, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
0x74, 0x79, 0x20, 0x47, 0x32, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x33, 0x30,
0x38, 0x32, 0x39, 0x31, 0x32, 0x31, 0x37, 0x34, 0x36, 0x5a, 0x17, 0x0d,
0x31, 0x34, 0x30, 0x38, 0x32, 0x39, 0x31, 0x32, 0x31, 0x37, 0x34, 0x36,
0x5a, 0x30, 0x66, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06,
0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04,
0x08, 0x0c, 0x0a, 0x43, 0x61, 0x6c, 0x69, 0x66, 0x6f, 0x72, 0x6e, 0x69,
0x61, 0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04, 0x07, 0x0c, 0x0d,
0x4d, 0x6f, 0x75, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x56, 0x69, 0x65,
0x77, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0a,
0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x63, 0x31, 0x15,
0x30, 0x13, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x0c, 0x2a, 0x2e, 0x67,
0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x30, 0x82, 0x01,
0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01,
0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01,
0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0x8e, 0xb7, 0x62, 0xbe, 0x81, 0xa1,
0x02, 0x43, 0x0b, 0x5d, 0x93, 0x66, 0x41, 0xc3, 0x69, 0xc7, 0xb1, 0x8f,
0xaf, 0x3f, 0xcf, 0x90, 0x88, 0xc3, 0xfa, 0xb6, 0x1f, 0xb7, 0xdd, 0xeb,
0xc5, 0xf4, 0x11, 0xe5, 0x81, 0x9f, 0x01, 0x66, 0x3c, 0xeb, 0xc7, 0x4c,
0x16, 0xb8, 0xab, 0x2e, 0x4f, 0x00, 0x1d, 0x58, 0x53, 0xe0, 0x48, 0x55,
0x0f, 0xef, 0x5f, 0xa9, 0x2b, 0xe0, 0xe5, 0x23, 0xd1, 0x52, 0xf0, 0x2b,
0x3a, 0xb7, 0x19, 0x92, 0xf5, 0x42, 0x74, 0x4b, 0x7d, 0x60, 0xeb, 0x95,
0xf8, 0x7c, 0x68, 0xc6, 0xc4, 0x66, 0xec, 0x37, 0xd8, 0x1e, 0xdd, 0x0f,
0x01, 0xdf, 0x30, 0x6e, 0xc2, 0x25, 0x00, 0x57, 0x36, 0x5e, 0x2c, 0xa5,
0xfd, 0x01, 0x54, 0x65, 0x89, 0x60, 0xe8, 0xab, 0x98, 0xb6, 0x4b, 0xd6,
0x44, 0x0f, 0x8f, 0xf9, 0x27, 0x53, 0x5f, 0x51, 0xd9, 0x01, 0x50, 0x7b,
0xaa, 0x2d, 0x0f, 0xda, 0x0d, 0x8d, 0x2a, 0xd8, 0x22, 0xc8, 0xa2, 0xe8,
0x77, 0x16, 0xdb, 0xfa, 0xf7, 0x0c, 0x42, 0xdd, 0xaf, 0x77, 0x3f, 0x71,
0xaf, 0xd2, 0x92, 0xc5, 0x00, 0x48, 0x41, 0x93, 0x81, 0x1e, 0x61, 0x0f,
0xa8, 0x6b, 0x04, 0x96, 0x25, 0xb4, 0x70, 0x2a, 0xda, 0xe6, 0x4a, 0x0d,
0x23, 0xfd, 0x5c, 0x72, 0x0e, 0x68, 0xa6, 0x1d, 0x59, 0xe4, 0x78, 0x31,
0x07, 0xc5, 0x8a, 0x9f, 0x75, 0xfd, 0x9a, 0x93, 0x8b, 0x70, 0xba, 0x00,
0xc5, 0x47, 0xc4, 0xfa, 0x2f, 0x8a, 0x14, 0xbd, 0x7b, 0xc7, 0xb4, 0x3a,
0xf2, 0x45, 0xd8, 0x1d, 0x6e, 0x38, 0xfd, 0x27, 0x81, 0x15, 0x8f, 0x4c,
0x96, 0xaa, 0x45, 0xf8, 0x7c, 0xd6, 0xf2, 0xc0, 0xd9, 0xfc, 0x17, 0xb9,
0x75, 0x3d, 0x14, 0x66, 0x71, 0x8e, 0xcf, 0xd4, 0x0b, 0xcb, 0xbf, 0xe3,
0x08, 0x71, 0x5d, 0x88, 0xfa, 0xe5, 0x53, 0x3d, 0x41, 0x9f, 0x02, 0x03,
0x01, 0x00, 0x01, 0xa3, 0x82, 0x03, 0xed, 0x30, 0x82, 0x03, 0xe9, 0x30,
0x1d, 0x06, 0x03, 0x55, 0x1d, 0x25, 0x04, 0x16, 0x30, 0x14, 0x06, 0x08,
0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x01, 0x06, 0x08, 0x2b, 0x06,
0x01, 0x05, 0x05, 0x07, 0x03, 0x02, 0x30, 0x82, 0x02, 0xc3, 0x06, 0x03,
0x55, 0x1d, 0x11, 0x04, 0x82, 0x02, 0xba, 0x30, 0x82, 0x02, 0xb6, 0x82,
0x0c, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f,
0x6d, 0x82, 0x0d, 0x2a, 0x2e, 0x61, 0x6e, 0x64, 0x72, 0x6f, 0x69, 0x64,
0x2e, 0x63, 0x6f, 0x6d, 0x82, 0x16, 0x2a, 0x2e, 0x61, 0x70, 0x70, 0x65,
0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
0x2e, 0x63, 0x6f, 0x6d, 0x82, 0x12, 0x2a, 0x2e, 0x63, 0x6c, 0x6f, 0x75,
0x64, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d,
0x82, 0x16, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2d, 0x61,
0x6e, 0x61, 0x6c, 0x79, 0x74, 0x69, 0x63, 0x73, 0x2e, 0x63, 0x6f, 0x6d,
0x82, 0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63,
0x61, 0x82, 0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
0x63, 0x6c, 0x82, 0x0e, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
0x2e, 0x63, 0x6f, 0x2e, 0x69, 0x6e, 0x82, 0x0e, 0x2a, 0x2e, 0x67, 0x6f,
0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x2e, 0x6a, 0x70, 0x82, 0x0e,
0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x2e,
0x75, 0x6b, 0x82, 0x0f, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x61, 0x72, 0x82, 0x0f, 0x2a, 0x2e, 0x67,
0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x61, 0x75,
0x82, 0x0f, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63,
0x6f, 0x6d, 0x2e, 0x62, 0x72, 0x82, 0x0f, 0x2a, 0x2e, 0x67, 0x6f, 0x6f,
0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x63, 0x6f, 0x82, 0x0f,
0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d,
0x2e, 0x6d, 0x78, 0x82, 0x0f, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x74, 0x72, 0x82, 0x0f, 0x2a, 0x2e,
0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x76,
0x6e, 0x82, 0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
0x64, 0x65, 0x82, 0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
0x2e, 0x65, 0x73, 0x82, 0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
0x65, 0x2e, 0x66, 0x72, 0x82, 0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
0x6c, 0x65, 0x2e, 0x68, 0x75, 0x82, 0x0b, 0x2a, 0x2e, 0x67, 0x6f, 0x6f,
0x67, 0x6c, 0x65, 0x2e, 0x69, 0x74, 0x82, 0x0b, 0x2a, 0x2e, 0x67, 0x6f,
0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x6e, 0x6c, 0x82, 0x0b, 0x2a, 0x2e, 0x67,
0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x6c, 0x82, 0x0b, 0x2a, 0x2e,
0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x74, 0x82, 0x0f, 0x2a,
0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x61, 0x70, 0x69, 0x73, 0x2e,
0x63, 0x6e, 0x82, 0x14, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x72, 0x63, 0x65, 0x2e, 0x63, 0x6f, 0x6d,
0x82, 0x0d, 0x2a, 0x2e, 0x67, 0x73, 0x74, 0x61, 0x74, 0x69, 0x63, 0x2e,
0x63, 0x6f, 0x6d, 0x82, 0x0c, 0x2a, 0x2e, 0x75, 0x72, 0x63, 0x68, 0x69,
0x6e, 0x2e, 0x63, 0x6f, 0x6d, 0x82, 0x10, 0x2a, 0x2e, 0x75, 0x72, 0x6c,
0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x82,
0x16, 0x2a, 0x2e, 0x79, 0x6f, 0x75, 0x74, 0x75, 0x62, 0x65, 0x2d, 0x6e,
0x6f, 0x63, 0x6f, 0x6f, 0x6b, 0x69, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x82,
0x0d, 0x2a, 0x2e, 0x79, 0x6f, 0x75, 0x74, 0x75, 0x62, 0x65, 0x2e, 0x63,
0x6f, 0x6d, 0x82, 0x16, 0x2a, 0x2e, 0x79, 0x6f, 0x75, 0x74, 0x75, 0x62,
0x65, 0x65, 0x64, 0x75, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x63,
0x6f, 0x6d, 0x82, 0x0b, 0x2a, 0x2e, 0x79, 0x74, 0x69, 0x6d, 0x67, 0x2e,
0x63, 0x6f, 0x6d, 0x82, 0x0b, 0x61, 0x6e, 0x64, 0x72, 0x6f, 0x69, 0x64,
0x2e, 0x63, 0x6f, 0x6d, 0x82, 0x04, 0x67, 0x2e, 0x63, 0x6f, 0x82, 0x06,
0x67, 0x6f, 0x6f, 0x2e, 0x67, 0x6c, 0x82, 0x14, 0x67, 0x6f, 0x6f, 0x67,
0x6c, 0x65, 0x2d, 0x61, 0x6e, 0x61, 0x6c, 0x79, 0x74, 0x69, 0x63, 0x73,
0x2e, 0x63, 0x6f, 0x6d, 0x82, 0x0a, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
0x2e, 0x63, 0x6f, 0x6d, 0x82, 0x12, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x72, 0x63, 0x65, 0x2e, 0x63, 0x6f, 0x6d,
0x82, 0x0a, 0x75, 0x72, 0x63, 0x68, 0x69, 0x6e, 0x2e, 0x63, 0x6f, 0x6d,
0x82, 0x08, 0x79, 0x6f, 0x75, 0x74, 0x75, 0x2e, 0x62, 0x65, 0x82, 0x0b,
0x79, 0x6f, 0x75, 0x74, 0x75, 0x62, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x82,
0x14, 0x79, 0x6f, 0x75, 0x74, 0x75, 0x62, 0x65, 0x65, 0x64, 0x75, 0x63,
0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x63, 0x6f, 0x6d, 0x30, 0x68, 0x06,
0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x01, 0x01, 0x04, 0x5c, 0x30,
0x5a, 0x30, 0x2b, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30,
0x02, 0x86, 0x1f, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b,
0x69, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d,
0x2f, 0x47, 0x49, 0x41, 0x47, 0x32, 0x2e, 0x63, 0x72, 0x74, 0x30, 0x2b,
0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x86, 0x1f,
0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e,
0x74, 0x73, 0x31, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63,
0x6f, 0x6d, 0x2f, 0x6f, 0x63, 0x73, 0x70, 0x30, 0x1d, 0x06, 0x03, 0x55,
0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0x6b, 0x36, 0x89, 0x3b, 0x32, 0x31,
0x63, 0x1b, 0xd7, 0x13, 0x7e, 0x07, 0xba, 0x4b, 0x3f, 0xe9, 0x27, 0xe9,
0x58, 0x76, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff,
0x04, 0x02, 0x30, 0x00, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04,
0x18, 0x30, 0x16, 0x80, 0x14, 0x4a, 0xdd, 0x06, 0x16, 0x1b, 0xbc, 0xf6,
0x68, 0xb5, 0x76, 0xf5, 0x81, 0xb6, 0xbb, 0x62, 0x1a, 0xba, 0x5a, 0x81,
0x2f, 0x30, 0x17, 0x06, 0x03, 0x55, 0x1d, 0x20, 0x04, 0x10, 0x30, 0x0e,
0x30, 0x0c, 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01, 0xd6, 0x79, 0x02,
0x05, 0x01, 0x30, 0x30, 0x06, 0x03, 0x55, 0x1d, 0x1f, 0x04, 0x29, 0x30,
0x27, 0x30, 0x25, 0xa0, 0x23, 0xa0, 0x21, 0x86, 0x1f, 0x68, 0x74, 0x74,
0x70, 0x3a, 0x2f, 0x2f, 0x70, 0x6b, 0x69, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x47, 0x49, 0x41, 0x47, 0x32,
0x2e, 0x63, 0x72, 0x6c, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00,
0x99, 0x3a, 0x45, 0x6b, 0xf1, 0xd4, 0x62, 0x6f, 0xd8, 0xb6, 0x24, 0x1b,
0x60, 0x4b, 0x48, 0x5e, 0xb9, 0x38, 0x87, 0x67, 0xfb, 0x42, 0x3f, 0x3c,
0x10, 0xfd, 0x54, 0x82, 0x8b, 0x39, 0x1c, 0x25, 0xa6, 0xdc, 0x52, 0x94,
0x1c, 0x82, 0xb9, 0x09, 0xfa, 0x8c, 0x52, 0x14, 0x3c, 0x1d, 0x3c, 0xc9,
0x22, 0xd6, 0xab, 0x8a, 0xb6, 0x1c, 0xc4, 0xa5, 0xc1, 0x3c, 0x48, 0x1a,
0x4d, 0x05, 0xb3, 0x8f, 0x59, 0x04, 0xcc, 0x31, 0x67, 0x18, 0x05, 0xd1,
0x6c, 0xa4, 0x61, 0x8b, 0x69, 0x09, 0x72, 0x44, 0x44, 0x57, 0xda, 0x22,
0x8f, 0xbb, 0x00, 0xb0, 0x31, 0xe2, 0x32, 0x7c, 0x98, 0x29, 0xe7, 0x34,
0xac, 0xbb, 0x58, 0x98, 0x7b, 0xae, 0x8f, 0x45, 0xb3, 0x37, 0xb9, 0x64,
0x00, 0x8e, 0x20, 0x20, 0xb4, 0xb2, 0x3a, 0x90, 0xbd, 0xa9, 0x77, 0x5d,
0xc6, 0xa7, 0xcc, 0x23, 0x8d, 0x4a, 0x73, 0x9f, 0x27, 0x08, 0xcd, 0xd2,
0x19, 0xf5, 0x5a, 0x91, 0x8c, 0x3a, 0x89, 0xf4, 0xf7, 0x9c, 0x4b, 0x66,
0x70, 0x97, 0x14, 0x8e, 0x19, 0x5a, 0x1b, 0xd1, 0x0e, 0x99, 0x93, 0x58,
0x89, 0x18, 0x90, 0xe2, 0x93, 0x49, 0x2b, 0xbd, 0x6f, 0x8e, 0xc7, 0x1b,
0xbd, 0x27, 0xa3, 0x5b, 0xee, 0xba, 0x47, 0xe7, 0xaa, 0xb0, 0xe4, 0x60,
0x98, 0x14, 0x9c, 0xad, 0x0d, 0xee, 0x23, 0x0f, 0x81, 0xa8, 0xbc, 0xa5,
0x5c, 0x79, 0x69, 0x88, 0x10, 0x58, 0x57, 0xd7, 0x5a, 0xc0, 0x2f, 0x50,
0xfd, 0xfd, 0x3b, 0xf9, 0xcd, 0x1a, 0x8f, 0x4b, 0xb6, 0x69, 0x9d, 0xbc,
0xc4, 0x3f, 0xf4, 0xa7, 0xca, 0x6a, 0x94, 0x0b, 0xb1, 0xa4, 0x92, 0x4c,
0x45, 0xdc, 0x18, 0xb6, 0x34, 0x30, 0x83, 0x40, 0xb3, 0xd5, 0xbd, 0x5b,
0xa4, 0x84, 0x40, 0x9a, 0x1a, 0xc3, 0xb6, 0xa3, 0x93, 0xb3, 0xdb, 0xb1,
0x0e, 0x10, 0xa1, 0x7a
};
// DO NOT USE THIS CODE - IT DEMONSTRATES HOW *NOT* TO VERIFY CERTS.
int main(int argc, char **argv)
{
X509_STORE *store = X509_STORE_new();
X509 *cert = X509_new();
X509_STORE_CTX *storectx = X509_STORE_CTX_new();
uint8_t *buf, *ptr;
OpenSSL_add_all_algorithms();
ERR_load_crypto_strings();
if (!X509_LOOKUP_load_file(X509_STORE_add_lookup(store, X509_LOOKUP_file()),
"cafile.pem",
X509_FILETYPE_PEM)) {
fprintf(stderr, "please put the cafile.pem in this directory first\n");
abort();
}
ptr = google_leaf_cert;
// Parse first valid certificate.
if (!d2i_X509(&cert, &ptr, sizeof(google_leaf_cert))) {
abort();
}
if (!X509_STORE_CTX_init(storectx, store, cert, NULL)) {
abort();
}
// Verify it.
if (X509_verify_cert(storectx) == 1) {
fprintf(stderr, "OK: %s\n", cert->name);
}
ptr = google_leaf_cert;
// Change the CN
ptr[242] = 'x';
ptr[243] = 'x';
ptr[244] = 'x';
// Reuse X509 with bad cert.
if (!d2i_X509(&cert, &ptr, sizeof(google_leaf_cert))) {
abort();
}
if (!X509_STORE_CTX_init(storectx, store, cert, NULL)) {
abort();
}
// This should fail, but won't.
if (X509_verify_cert(storectx) == 1) {
fprintf(stderr, "OK: %s\n", cert->name);
}
return 0;
}
Issuer: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
Subject: C=US, O=Google Inc, CN=Google Internet Authority G2
-----BEGIN CERTIFICATE-----
MIIEBDCCAuygAwIBAgIDAjppMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT
MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i
YWwgQ0EwHhcNMTMwNDA1MTUxNTU1WhcNMTUwNDA0MTUxNTU1WjBJMQswCQYDVQQG
EwJVUzETMBEGA1UEChMKR29vZ2xlIEluYzElMCMGA1UEAxMcR29vZ2xlIEludGVy
bmV0IEF1dGhvcml0eSBHMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
AJwqBHdc2FCROgajguDYUEi8iT/xGXAaiEZ+4I/F8YnOIe5a/mENtzJEiaB0C1NP
VaTOgmKV7utZX8bhBYASxF6UP7xbSDj0U/ck5vuR6RXEz/RTDfRK/J9U3n2+oGtv
h8DQUB8oMANA2ghzUWx//zo8pzcGjr1LEQTrfSTe5vn8MXH7lNVg8y5Kr0LSy+rE
ahqyzFPdFUuLH8gZYR/Nnag+YyuENWllhMgZxUYi+FOVvuOAShDGKuy6lyARxzmZ
EASg8GF6lSWMTlJ14rbtCMoU/M4iarNOz0YDl5cDfsCx3nuvRTPPuj5xt970JSXC
DTWJnZ37DhF5iR43xa+OcmkCAwEAAaOB+zCB+DAfBgNVHSMEGDAWgBTAephojYn7
qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQUSt0GFhu89mi1dvWBtrtiGrpagS8wEgYD
VR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwOgYDVR0fBDMwMTAvoC2g
K4YpaHR0cDovL2NybC5nZW90cnVzdC5jb20vY3Jscy9ndGdsb2JhbC5jcmwwPQYI
KwYBBQUHAQEEMTAvMC0GCCsGAQUFBzABhiFodHRwOi8vZ3RnbG9iYWwtb2NzcC5n
ZW90cnVzdC5jb20wFwYDVR0gBBAwDjAMBgorBgEEAdZ5AgUBMA0GCSqGSIb3DQEB
BQUAA4IBAQA21waAESetKhSbOHezI6B1WLuxfoNCunLaHtiONgaX4PCVOzf9G0JY
/iLIa704XtE7JW4S615ndkZAkNoUyHgN7ZVm2o6Gb4ChulYylYbc3GrKBIxbf/a/
zG+FA1jDaFETzf3I93k9mTXwVqO94FntT0QJo544evZG0R0SnU++0ED8Vf4GXjza
HFa9llF7b1cq26KqltyMdMKVvvBulRP/F/A8rLIQjcxz++iPAsbw+zOzlTvjwsto
WHPbqCRiOwY1nQ2pM714A5AuTHhdUDqB1O6gyHA43LL5Z/qHQF1hwFGPa4NrzQU6
yuGnBXj8ytqU0CwIPX4WecigUCAkVDNx
-----END CERTIFICATE-----
Issuer: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
Subject: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
-----BEGIN CERTIFICATE-----
MIIDVDCCAjygAwIBAgIDAjRWMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT
MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i
YWwgQ0EwHhcNMDIwNTIxMDQwMDAwWhcNMjIwNTIxMDQwMDAwWjBCMQswCQYDVQQG
EwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEbMBkGA1UEAxMSR2VvVHJ1c3Qg
R2xvYmFsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2swYYzD9
9BcjGlZ+W988bDjkcbd4kdS8odhM+KhDtgPpTSEHCIjaWC9mOSm9BXiLnTjoBbdq
fnGk5sRgprDvgOSJKA+eJdbtg/OtppHHmMlCGDUUna2YRpIuT8rxh0PBFpVXLVDv
iS2Aelet8u5fa9IAjbkU+BQVNdnARqN7csiRv8lVK83Qlz6cJmTM386DGXHKTubU
1XupGc1V3sjs0l44U+VcT4wt/lAjNvxm5suOpDkZALeVAjmRCw7+OC7RHQWa9k0+
bw8HHa8sHo9gOeL6NlMTOdReJivbPagUvTLrGAMoUgRx5aszPeE4uwc2hGKceeoW
MPRfwCvocWvk+QIDAQABo1MwUTAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTA
ephojYn7qwVkDBF9qn1luMrMTjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1l
uMrMTjANBgkqhkiG9w0BAQUFAAOCAQEANeMpauUvXVSOKVCUn5kaFOSPeCpilKIn
Z57QzxpeR+nBsqTP3UEaBU6bS+5Kb1VSsyShNwrrZHYqLizz/Tt1kL/6cdjHPTfS
tQWVYrmm3ok9Nns4d0iXrKYgjy6myQzCsplFAMfOEVEiIuCl6rYVSAlk6l5PdPcF
PseKUgzbFbS9bZvlxrFUaKnjaZC2mqUPuLk/IH2uSrW4nOQdtqvmlKXBx4Ot2/Un
hw4EbNX/3aBd7YdStysVAq45pmp06drE57xNNB6pXE0zX5IJL4hmXXeXxx12E6nV
5fEWCRE11azbJHFwLJhWC9kXtNHjUStedejV0NxPNO3CBWaAocvmMw==
-----END CERTIFICATE-----
