通过OpenSSL解析X509证书基本项

深藏阁楼爱情的钟 2022-05-20 05:20 682阅读 0赞

转载自：https://blog.csdn.net/yyfzy/article/details/46798965

在之前的文章“[通过OpenSSL解码X509证书文件][OpenSSL_X509]”里，讲述了如何使用OpenSSL将证书文件解码，得到证书上下文结构体X509的方法。下面我们接着讲述如何通过证书上下文结构体X509，获得想要的证书项。本文先讲述如何获取证书的基本项，后面还有文章介绍如何获取证书的扩展项。

下面的代码，都是假定已经通过解码证书文件、得到了证书上下文结构体X509。至于如何使用OpenSSL解码证书文件、得到证书上下文结构体X509，请阅读之前的文章。

首先，我们看看关于证书结构体X509定义：

1.  struct x509\_st
2.  \{
3.  X509\_CINF \*cert\_info;
4.  X509\_ALGOR \*sig\_alg;
5.  ASN1\_BIT\_STRING \*signature;
6.  int valid;
7.  int references;
8.  char \*name;
9.  CRYPTO\_EX\_DATA ex\_data;
10. */\* These contain copies of various extension values \*/*
11. long ex\_pathlen;
12. long ex\_pcpathlen;
13. unsigned long ex\_flags;
14. unsigned long ex\_kusage;
15. unsigned long ex\_xkusage;
16. unsigned long ex\_nscert;
17. ASN1\_OCTET\_STRING \*skid;
18. AUTHORITY\_KEYID \*akid;
19. X509\_POLICY\_CACHE \*policy\_cache;
20. STACK\_OF(DIST\_POINT) \*crldp;
21. STACK\_OF(GENERAL\_NAME) \*altname;
22. NAME\_CONSTRAINTS \*nc;
23. \#ifndef OPENSSL\_NO\_RFC3779
24. STACK\_OF(IPAddressFamily) \*rfc3779\_addr;
25. struct ASIdentifiers\_st \*rfc3779\_asid;
26. \#endif
27. \#ifndef OPENSSL\_NO\_SHA
28. unsigned char sha1\_hash\[SHA\_DIGEST\_LENGTH\];
29. \#endif
30. X509\_CERT\_AUX \*aux;
31. \} */\* X509 \*/*;
32. 
33. typedef struct x509\_cinf\_st
34. \{
35. ASN1\_INTEGER \*version; */\* \[ 0 \] default of v1 \*/*
36. ASN1\_INTEGER \*serialNumber;
37. X509\_ALGOR \*signature;
38. X509\_NAME \*issuer;
39. X509\_VAL \*validity;
40. X509\_NAME \*subject;
41. X509\_PUBKEY \*key;
42. ASN1\_BIT\_STRING \*issuerUID; */\* \[ 1 \] optional in v2 \*/*
43. ASN1\_BIT\_STRING \*subjectUID; */\* \[ 2 \] optional in v2 \*/*
44. STACK\_OF(X509\_EXTENSION) \*extensions; */\* \[ 3 \] optional in v3 \*/*
45. ASN1\_ENCODING enc;
46. \} X509\_CINF;

我们想要获取的证书基本项，有些就直接存在于这两个结构体中。  
一、版本号

通过解码证书文件，得到证书结构体m\_pX509之后，可以通过函数X509\_get\_version()获取证书的版本。具体代码如下：

1.  int ver = X509\_get\_version(m\_pX509);
2.  switch(ver)
3.  \{
4.  case 0: *//V1*
5.  *//...*
6.  break;
7.  case 1: *//V2*
8.  *//...*
9.  break;
10. case 2: *//V3*
11. *//...*
12. break;
13. default:
14. *//Error!*
15. break;
16. \}

需要注意的是，0代表V1；1代表V2；2代表V3。目前绝大多数证书都是V3版本。

二、序列号

同样，有了m\_pX509之后，调用函数X509\_get\_serialNumber()即可获得证书的序列号。只是该函数返回的是ASN1\_INTEGER类型，需要转换后才能是我们平常看到的十六进制表示的序列号。具体实现函数如下：

1.  ULONG COpenSSLCertificate::get\_SN(LPSTR lptcSN, ULONG \*pulLen)
2.  \{
3.  ULONG ulRet = CERT\_ERR\_OK;
4.  ASN1\_INTEGER \*asn1\_i = NULL;
5.  BIGNUM \*bignum = NULL;
6.  char \*serial = NULL;
7.  
8.  if (!m\_pX509)
9.  \{
10. return CERT\_ERR\_INVILIDCALL;
11. \}
12. if (!pulLen)
13. \{
14. return CERT\_ERR\_INVALIDPARAM;
15. \}
16. asn1\_i = X509\_get\_serialNumber(m\_pX509);
17. bignum = ASN1\_INTEGER\_to\_BN(asn1\_i, NULL);
18. if (bignum == NULL)
19. \{
20. ulRet = CERT\_ERR\_FAILED;
21. goto FREE\_MEMORY;
22. \}
23. serial = BN\_bn2hex(bignum);
24. if (serial == NULL)
25. \{
26. ulRet = CERT\_ERR\_FAILED;
27. goto FREE\_MEMORY;
28. \}
29. BN\_free(bignum);
30. if (!lptcSN)
31. \{
32. \*pulLen = strlen(serial) + 1;
33. ulRet = CERT\_ERR\_OK;
34. goto FREE\_MEMORY;
35. \}
36. if (\*pulLen < strlen(serial) + 1)
37. \{
38. ulRet = CERT\_ERR\_BUFFER\_TOO\_SMALL;
39. goto FREE\_MEMORY;
40. \}
41. strcpy\_s(lptcSN, \*pulLen, serial);
42. \*pulLen = strlen(serial);
43. FREE\_MEMORY:
44. OPENSSL\_free(serial);
45. return ulRet;
46. \}

三、公钥算法（证书算法）

要想获取证书公钥算法，需要先调用函数X509\_get\_pubkey()得到公钥属性结构体，然后通过type字段来判断公钥的算法类型。具体实现函数如下：

1.  ULONG COpenSSLCertificate::get\_KeyType(ULONG\* pulType)
2.  \{
3.  EVP\_PKEY \*pk = NULL;
4.  stack\_st\_X509\* chain = NULL;
5.  X509\_EXTENSION \*pex = NULL;
6.  
7.  if (!m\_pX509)
8.  \{
9.  return CERT\_ERR\_INVILIDCALL;
10. \}
11. if (!pulType)
12. \{
13. return CERT\_ERR\_INVALIDPARAM;
14. \}
15. 
16. pk = X509\_get\_pubkey(m\_pX509);
17. if (!pk)
18. \{
19. return CERT\_ERR\_FAILED;
20. \}
21. 
22. if (EVP\_PKEY\_RSA == pk->type)
23. \{
24. \*pulType = CERT\_KEY\_ALG\_RSA;
25. \}
26. else if (EVP\_PKEY\_EC == pk->type)
27. \{
28. \*pulType = CERT\_KEY\_ALG\_ECC;
29. \}
30. else if (EVP\_PKEY\_DSA == pk->type)
31. \{
32. \*pulType = CERT\_KEY\_ALG\_DSA;
33. \}
34. else if (EVP\_PKEY\_DH == pk->type)
35. \{
36. \*pulType = CERT\_KEY\_ALG\_DH;
37. \}
38. else
39. \{
40. return CERT\_KEY\_ALG\_UNKNOWN;
41. \}
42. 
43. return CERT\_ERR\_OK;
44. \}

目前常见的证书算法为RSA和ECC，ECC在国内又成为SM2。SM2是国家密码管理局基于椭圆算法(ECC)制定的国内非对称算法标准。

四、证书用途

证书从用途来分，分为“签名证书”和“加密证书”两大类。“签名证书”的公钥用来验证签名，而“加密证书”的公钥则用来加密数据。我们可以通过调用X509中的ex\_kusage字段来判断证书的用途，具体函数实现如下：

1.  ULONG COpenSSLCertificate::get\_KeyUsage(ULONG\* lpUsage)
2.  \{
3.  ULONG lKeyUsage = 0;
4.  
5.  if (!m\_pX509)
6.  \{
7.  return CERT\_ERR\_INVILIDCALL;
8.  \}
9.  if (!lpUsage)
10. \{
11. return CERT\_ERR\_INVALIDPARAM;
12. \}
13. 
14. \*lpUsage = CERT\_USAGE\_UNKNOWN;
15. 
16. *//X509\_check\_ca() MUST be called!*
17. X509\_check\_ca(m\_pX509);
18. lKeyUsage = m\_pX509->ex\_kusage;
19. if ((lKeyUsage & KU\_DATA\_ENCIPHERMENT) == KU\_DATA\_ENCIPHERMENT)
20. \{
21. \*lpUsage = CERT\_USAGE\_EXCH;<span style= "white-space:pre"> </span> *//加密证书*
22. \}
23. else if ((lKeyUsage & KU\_DIGITAL\_SIGNATURE) == KU\_DIGITAL\_SIGNATURE)
24. \{
25. \*lpUsage = CERT\_USAGE\_SIGN;<span style= "white-space:pre"> </span> *//签名证书*
26. \}
27. 
28. return CERT\_ERR\_OK;
29. \}

五、签名算法

证书的签名算法，是指证书用来签名时使用的算法(包含HASH算法)。签名算法用结构体X509中sig\_alg字段来表示，可以通过sig\_alg的子字段algorithm返回签名算法对象，从而得到签名算法的Oid。首先，签名算法的Oid常见得定义如下：

1.  */\* Certificate siganture alg \*/*
2.  \#define CERT\_SIGNATURE\_ALG\_RSA\_RSA "1.2.840.113549.1.1.1"
3.  \#define CERT\_SIGNATURE\_ALG\_MD2RSA "1.2.840.113549.1.1.2"
4.  \#define CERT\_SIGNATURE\_ALG\_MD4RSA "1.2.840.113549.1.1.3"
5.  \#define CERT\_SIGNATURE\_ALG\_MD5RSA "1.2.840.113549.1.1.4"
6.  \#define CERT\_SIGNATURE\_ALG\_SHA1RSA "1.2.840.113549.1.1.5"
7.  \#define CERT\_SIGNATURE\_ALG\_SM3SM2 "1.2.156.10197.1.501"

获取签名算法Oid的具体实现函数如下：

1.  ULONG COpenSSLCertificate::get\_SignatureAlgOid(LPSTR lpscOid, ULONG \*pulLen)
2.  \{
3.  char oid\[ 128\] = \{ 0\};
4.  ASN1\_OBJECT\* salg = NULL;
5.  
6.  if (!m\_pX509)
7.  \{
8.  return CERT\_ERR\_INVILIDCALL;
9.  \}
10. if (!pulLen)
11. \{
12. return CERT\_ERR\_INVALIDPARAM;
13. \}
14. 
15. salg = m\_pX509->sig\_alg->algorithm;
16. OBJ\_obj2txt(oid, 128, salg, 1);
17. if (!lpscOid)
18. \{
19. \*pulLen = strlen(oid) + 1;
20. return CERT\_ERR\_OK;
21. \}
22. if (\*pulLen < strlen(oid) + 1)
23. \{
24. return CERT\_ERR\_BUFFER\_TOO\_SMALL;
25. \}
26. 
27. strcpy\_s(lpscOid, \*pulLen, oid);
28. \*pulLen = strlen(oid) + 1;
29. return CERT\_ERR\_OK;
30. \}

由于Windows对SM2/SM3算法还没有定义，所以对于ECC(SM2)证书，Windows直接显示签名算法的Oid：“1.2.156.10197.1.501”，如下图所示：  
![Center][]

六、颁发者

关于颁发者，我们可以通过调用函数X509\_get\_issuer\_name()获取属性。不过该函数返回的是X509\_NAME类型，需要调用函数X509\_NAME\_get\_text\_by\_NID()将其转化为ASCII字符形式。具体通过下面函数实现：

1.  ULONG COpenSSLCertificate::get\_Issuer(LPSTR lpValue, ULONG \*pulLen)
2.  \{
3.  int nNameLen = 512;
4.  CHAR csCommonName\[ 512\] = \{ 0\};
5.  X509\_NAME \*pCommonName = NULL;
6.  
7.  if (!m\_pX509)
8.  \{
9.  return CERT\_ERR\_INVILIDCALL;
10. \}
11. if (!pulLen)
12. \{
13. return CERT\_ERR\_INVALIDPARAM;
14. \}
15. 
16. pCommonName = X509\_get\_issuer\_name(m\_pX509);
17. if (!pCommonName)
18. \{
19. return CERT\_ERR\_FAILED;
20. \}
21. nNameLen = X509\_NAME\_get\_text\_by\_NID(pCommonName, NID\_commonName, csCommonName, nNameLen);
22. if ( \-1 == nNameLen)
23. \{
24. return CERT\_ERR\_FAILED;
25. \};
26. if (!lpValue)
27. \{
28. \*pulLen = nNameLen + 1;
29. return CERT\_ERR\_OK;
30. \}
31. if (\*pulLen < (ULONG)nNameLen + 1)
32. \{
33. return CERT\_ERR\_BUFFER\_TOO\_SMALL;
34. \}
35. 
36. strcpy\_s(lpValue, \*pulLen, csCommonName);
37. \*pulLen = nNameLen;
38. return CERT\_ERR\_OK;
39. \}

七、使用者

关于证书使用者，我们可以通过调用函数X509\_get\_subject\_name)获取属性。同样，该函数返回的是X509\_NAME类型，需要调用函数X509\_NAME\_get\_text\_by\_NID()将其转化为ASCII字符形式。具体通过下面函数实现：

1.  ULONG COpenSSLCertificate::get\_SubjectName(LPSTR lpValue, ULONG \*pulLen)
2.  \{
3.  int iLen = 0;
4.  int iSubNameLen = 0;
5.  CHAR csSubName\[ 1024\] = \{ 0\};
6.  CHAR csBuf\[ 256\] = \{ 0\};
7.  X509\_NAME \*pSubName = NULL;
8.  
9.  if (!m\_pX509)
10. \{
11. return CERT\_ERR\_INVILIDCALL;
12. \}
13. if (!pulLen)
14. \{
15. return CERT\_ERR\_INVALIDPARAM;
16. \}
17. 
18. pSubName = X509\_get\_subject\_name(m\_pX509);
19. if (!pSubName)
20. \{
21. return CERT\_ERR\_FAILED;
22. \}
23. 
24. ZeroMemory(csBuf, 256);
25. iLen = X509\_NAME\_get\_text\_by\_NID(pSubName, NID\_countryName, csBuf, 256);
26. if (iLen > 0)
27. \{
28. strcat\_s(csSubName, 1024, "C=");
29. strcat\_s(csSubName, 1024, csBuf);
30. strcat\_s(csSubName, 1024, ", ");
31. \}
32. 
33. ZeroMemory(csBuf, 256);
34. iLen = X509\_NAME\_get\_text\_by\_NID(pSubName, NID\_organizationName, csBuf, 256);
35. if (iLen > 0)
36. \{
37. strcat\_s(csSubName, 1024, "O=");
38. strcat\_s(csSubName, 1024, csBuf);
39. strcat\_s(csSubName, 1024, ", ");
40. \}
41. 
42. ZeroMemory(csBuf, 256);
43. iLen = X509\_NAME\_get\_text\_by\_NID(pSubName, NID\_organizationalUnitName, csBuf, 256);
44. if (iLen > 0)
45. \{
46. strcat\_s(csSubName, 1024, "OU=");
47. strcat\_s(csSubName, 1024, csBuf);
48. strcat\_s(csSubName, 1024, ", ");
49. \}
50. 
51. ZeroMemory(csBuf, 256);
52. iLen = X509\_NAME\_get\_text\_by\_NID(pSubName, NID\_commonName, csBuf, 256);
53. if (iLen > 0)
54. \{
55. strcat\_s(csSubName, 1024, "CN=");
56. strcat\_s(csSubName, 1024, csBuf);
57. \}
58. 
59. if (!lpValue)
60. \{
61. \*pulLen = strlen(csSubName) + 1;
62. return CERT\_ERR\_OK;
63. \}
64. if (\*pulLen < strlen(csSubName) + 1)
65. \{
66. return CERT\_ERR\_BUFFER\_TOO\_SMALL;
67. \}
68. 
69. strcpy\_s(lpValue, \*pulLen, csSubName);
70. \*pulLen = strlen(csSubName);
71. return CERT\_ERR\_OK;
72. \}

八、有效期限

要获取证书的有效期属性，需要通过调用函数X509\_get\_notBefore()和X509\_get\_notAfter()来实现。而且这两个函数返回的时间是time\_t类型，需要转化为SYSTEMTIME类型。具体实现函数如下：

1.  ULONG COpenSSLCertificate::get\_ValidDate(SYSTEMTIME \*ptmStart, SYSTEMTIME \*ptmEnd)
2.  \{
3.  int err = 0;
4.  ASN1\_TIME \*start = NULL;
5.  ASN1\_TIME \*end = NULL;
6.  time\_t ttStart = \{ 0\};
7.  time\_t ttEnd = \{ 0\};
8.  LONGLONG nLLStart = 0;
9.  LONGLONG nLLEnd = 0;
10. FILETIME ftStart = \{ 0\};
11. FILETIME ftEnd = \{ 0\};
12. 
13. if (!m\_pX509)
14. \{
15. return CERT\_ERR\_INVALIDPARAM;
16. \}
17. 
18. start = X509\_get\_notBefore(m\_pX509);
19. end = X509\_get\_notAfter(m\_pX509);
20. 
21. ttStart = ASN1\_TIME\_get(start, &err);
22. ttEnd = ASN1\_TIME\_get(end, &err);
23. nLLStart = Int32x32To64(ttStart, 10000000) + 116444736000000000;
24. nLLEnd = Int32x32To64(ttEnd, 10000000) + 116444736000000000;
25. 
26. ftStart.dwLowDateTime = (DWORD)nLLStart;
27. ftStart.dwHighDateTime = (DWORD)(nLLStart >> 32);
28. ftEnd.dwLowDateTime = (DWORD)nLLEnd;
29. ftEnd.dwHighDateTime = (DWORD)(nLLEnd >> 32);
30. 
31. FileTimeToSystemTime(&ftStart, ptmStart);
32. FileTimeToSystemTime(&ftEnd, ptmEnd);
33. 
34. return 0;
35. \}

至此，X509证书的基本项通过OpenSLL均已解析完毕！如需获取证书的扩展项或者公钥等数据，请关注后续博文。

[OpenSSL_X509]: http://blog.csdn.net/yyfzy/article/details/46682207
[Center]: /images/20220520/83857ef28ec44dbba875935db9eb3a81.png