openssl API从SSL_CTX中提取证书链中的叶证书。

huangapple go评论59阅读模式
英文:

openssl API to extract the leaf certificate from a certificate chain available in SSL_CTX

问题

I am using OpenSSL API calls in my C program to establish Mutual-TLS connection to a remote server.

When establishing the connection, the client uses any X509 PEM certificate (i.e.self-signed, CA-issued leaf cert or a chained certificate) provided by the user.

I load the user-provided certificate to my SSL_CTX via call to: SSL_CTX_use_certificate_chain_file (), which can load both single certificate or certificate chain.

My objective is to print the leaf certificate metadata in the prompt something like below:

% my_tls_client -key foo.key -cert foo.crt myserver.com:2566
Attempting to connect to server myserver.com port:2566
Using host certificate as follows:
serial: aa:bb:cc:dd:ee
subject: foo...
valid from: DATE1
valid untill: DATE2
WARNING: The provided certificate is about to expire in X days !
Connected to server successfully!

To do so, first I need to identify and fetch the leaf (host) certificate in X509_STORE available in SSL_CTX.

Is there any OpenSSL API that can get me the leaf certificate from the chain of certificates?

I came across a few approaches like: link
That suggests using: SSL_CTX_get0_certificate(), But I am unable to find any reference to this method in OpenSSL docs.

Also, another API: X509_STORE_CTX_get_current_cert()
This too does not seem to provide the leaf certificate specifically...

英文:

I am using OpenSSL API calls in my C program to establish Mutual-TLS connection to a remote server.

When establishing the connection, the client uses any X509 PEM certificate (i.e.self-signed, CA-issued leaf cert or a chained certificate) provided by the user.

I load the user-provided certificate to my SSL_CTX via call to: SSL_CTX_use_certificate_chain_file (), which can load both single certificate or certificate chain.

My objective is to print the leaf certificate metadata in the prompt something like below:

% my_tls_client -key foo.key -cert foo.crt myserver.com:2566
Attempting to connect to server myserver.com port:2566
Using host certificate as follows:
    serial: aa:bb:cc:dd:ee
    subject: foo...
    valid from: DATE1
    valid untill: DATE2
    WARNING: The provided certificate is about to expire in X days !
    Connected to server successfully!

To do so, first I need to identify and fetch the leaf (host) certificate in X509_STORE available in SSL_CTX.

Is there any OpenSSL API that can get me the leaf certificate from the chain of certificates?

I came across a few approaches like: https://stackoverflow.com/a/58559886/3050164
That suggests using: SSL_CTX_get0_certificate(), But I am unable to find any reference to this method in OpenSSL docs.

Also, another API: X509_STORE_CTX_get_current_cert()
This too does not seem to provide the leaf certificate specifically...

答案1

得分: 1

这个证书是专门用于SSL连接的,而不是用于上下文的(可以用于不同的连接)。你可能在寻找的API是SSL_get_certificate

英文:

The certificate used is specific to the SSL connection and not to the context (which can be used for different connections). The API you are probably looking for is SSL_get_certificate.

huangapple
  • 本文由 发表于 2023年6月8日 16:00:12
  • 转载请务必保留本文链接:https://go.coder-hub.com/76429789.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定