英文:
openssl API to extract the leaf certificate from a certificate chain available in SSL_CTX
问题
I am using OpenSSL API calls in my C program to establish Mutual-TLS connection to a remote server.
When establishing the connection, the client uses any X509 PEM certificate (i.e.self-signed, CA-issued leaf cert or a chained certificate) provided by the user.
I load the user-provided certificate to my SSL_CTX via call to: SSL_CTX_use_certificate_chain_file ()
, which can load both single certificate or certificate chain.
My objective is to print the leaf certificate metadata in the prompt something like below:
% my_tls_client -key foo.key -cert foo.crt myserver.com:2566
Attempting to connect to server myserver.com port:2566
Using host certificate as follows:
serial: aa:bb:cc:dd:ee
subject: foo...
valid from: DATE1
valid untill: DATE2
WARNING: The provided certificate is about to expire in X days !
Connected to server successfully!
To do so, first I need to identify and fetch the leaf (host) certificate in X509_STORE available in SSL_CTX.
Is there any OpenSSL API that can get me the leaf certificate from the chain of certificates?
I came across a few approaches like: link
That suggests using: SSL_CTX_get0_certificate()
, But I am unable to find any reference to this method in OpenSSL docs.
Also, another API: X509_STORE_CTX_get_current_cert()
This too does not seem to provide the leaf certificate specifically...
英文:
I am using OpenSSL API calls in my C program to establish Mutual-TLS connection to a remote server.
When establishing the connection, the client uses any X509 PEM certificate (i.e.self-signed, CA-issued leaf cert or a chained certificate) provided by the user.
I load the user-provided certificate to my SSL_CTX via call to: SSL_CTX_use_certificate_chain_file ()
, which can load both single certificate or certificate chain.
My objective is to print the leaf certificate metadata in the prompt something like below:
% my_tls_client -key foo.key -cert foo.crt myserver.com:2566
Attempting to connect to server myserver.com port:2566
Using host certificate as follows:
serial: aa:bb:cc:dd:ee
subject: foo...
valid from: DATE1
valid untill: DATE2
WARNING: The provided certificate is about to expire in X days !
Connected to server successfully!
To do so, first I need to identify and fetch the leaf (host) certificate in X509_STORE available in SSL_CTX.
Is there any OpenSSL API that can get me the leaf certificate from the chain of certificates?
I came across a few approaches like: https://stackoverflow.com/a/58559886/3050164
That suggests using: SSL_CTX_get0_certificate()
, But I am unable to find any reference to this method in OpenSSL docs.
Also, another API: X509_STORE_CTX_get_current_cert()
This too does not seem to provide the leaf certificate specifically...
答案1
得分: 1
这个证书是专门用于SSL连接的,而不是用于上下文的(可以用于不同的连接)。你可能在寻找的API是SSL_get_certificate。
英文:
The certificate used is specific to the SSL connection and not to the context (which can be used for different connections). The API you are probably looking for is SSL_get_certificate.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。
评论