OpenSSL证书操作

水深无声 2022-08-18 12:26 290阅读 0赞

**OpenSSL证书操作**

# **1.目的** #

(1) 掌握OpenSSL X509证书验证和获取证书信息的原理以及常用的API；

(2) 基于OpenSSL库开发X509证书验证和证书信息查看程序。

# 2.**步骤** #

(1) 在函数tX509\_Verify() 中，完成对证书的验证。

(2) 在函数tGetX509Info() 中，获取证书的信息，包括证书版本号、证书序列号、证书颁发者信息、证书使用者信息、证书有效期和证书公钥。

(3) 程序输出参考下图：

![Center][]

# 3.结果 #

(1) 对证书“guojing.cer”和“huangfeihong.cer”进行了验证，包括证书有效期、证书颁发者签名、证书链和CRL验证；对证书进行解析，显示了证书的版本、序列号、颁发者、使用者、公钥、有效期等信息。

(2) 实验代码：

#include<stdio.h>
    #include<string.h>
    #include<windows.h>
    #include<openssl/evp.h>
    #include<openssl/x509.h>
    void tX509_Verify()
    {
        unsigned char usrCertificate1[4096];
    	   unsigned long usrCertificate1Len;
        unsigned char usrCertificate2[4096];
        unsigned long usrCertificate2Len;
        unsigned char derCrl[4096];
    unsigned long derCrlLen;
        unsigned char derRootCert[4096];
    	   unsigned long derRootCertLen;
    int rv;
    
    	X509_STORE_CTX *ctx=NULL;
    	X509 *usrCert1=NULL;
    	X509 *usrCert2=NULL;
    	X509 *caCert=NULL;
     X509 *rootCert=NULL;</span>
    	<span style="font-size:18px;">X509_CRL *Crl=NULL;
    	STACK_OF(X509)*caCertStack=NULL;
    	X509_STORE *rootCertStore =NULL;
    	int j=0;
     const unsigned char *pTmp=NULL;
    	FILE *fp;
    
    	fp=fopen("root.cer","rb");
    	if(fp==NULL)
    	{
    		printf("open file\"root.cer\"err.\n");
    		return;
    	}
    	derRootCertLen=fread(derRootCert,1,4096,fp);
    	fclose(fp);
    
        fp=fopen("crl.crl","rb");
    	if(fp==NULL)
    	{
    		printf("open file\"crl.crl\"err.\n");
    		return;
    	}
    	derCrlLen=fread(derCrl,1,4096,fp);
    	fclose(fp);
    
    	fp=fopen("guojing.cer","rb");
    	if(fp==NULL)
    	{
    		printf("open file\"guojing.cer\"err.\n");
    		return;
    	}
    	usrCertificate1Len=fread(usrCertificate1,1,4096,fp);
    	fclose(fp);
    
    	fp=fopen("huangfeihong.cer","rb");
    	if(fp==NULL)
    	{
    		printf("open file\"huangfeihong.cer\"err.\n");
    		return;
    	}
    	usrCertificate2Len=fread(usrCertificate2,1,4096,fp);
    	fclose(fp);
    
    	pTmp=derRootCert;
    	rootCert=d2i_X509(NULL,&pTmp,derRootCertLen);
    	if(rootCert==NULL)
    	{
    		printf("d2i_X509 err.\n");
    		return;
    	}
    
    	pTmp=usrCertificate1;
    	usrCert1=d2i_X509(NULL,&pTmp,usrCertificate1Len);
    	if(usrCert1==NULL)
    	{
    		printf("d2i_X509 err.\n");
    		return;
    	}
    
        pTmp=usrCertificate2;
    	usrCert2=d2i_X509(NULL,&pTmp,usrCertificate2Len);
    	if(usrCert2==NULL)
    	{
    		printf("d2i_X509 err.\n");
    		return;
    	}
        
        pTmp=derCrl;
    	Crl=d2i_X509_CRL(NULL,&pTmp,derCrlLen);
    	if(usrCert2==NULL)
    	{
    		printf("d2i_X509_CRL err.\n");
    		return;
    	}
    
    	printf("---------------Certificate Verify ---------------\n");
    	rootCertStore=X509_STORE_new();
    	X509_STORE_add_cert(rootCertStore,rootCert);
    	X509_STORE_set_flags(rootCertStore,X509_V_FLAG_CRL_CHECK);
    	X509_STORE_add_crl(rootCertStore,Crl);
    
    	ctx=X509_STORE_CTX_new();
    	rv=X509_STORE_CTX_init(ctx,rootCertStore,usrCert1,caCertStack);
    	if(rv!=1)
    	{
    		printf("X509_STORE_CTX_init err.\n");
    		X509_free(usrCert1);
    		X509_free(usrCert2);
    		X509_free(rootCert);
            X509_STORE_CTX_cleanup(ctx);
    		X509_STORE_CTX_free(ctx);
    		X509_STORE_free(rootCertStore);
    		return;
    	}
    
        rv=X509_verify_cert(ctx);
    	if(rv!=1)
    	{
    		printf("verify guojing.cer err. error=%d,info:%s.\n",ctx->error,X509_verify_cert_error_string(ctx->error));
    	}
    	else
    	{
    		printf("verify guojing.cer OK.\n");
    	}
        
    	rv=X509_STORE_CTX_init(ctx,rootCertStore,usrCert2,caCertStack);
    	if(rv!=1)
    	{
    		printf("X509_STORE_CTX_init err.\n");
    		X509_free(usrCert1);
    		X509_free(usrCert2);
    		X509_free(rootCert);
            X509_STORE_CTX_cleanup(ctx);
    		X509_STORE_CTX_free(ctx);
    		X509_STORE_free(rootCertStore);
    		return;
    	}
    
        rv=X509_verify_cert(ctx);
    	if(rv!=1)
    	{
    		printf("verify huangfeihong.cer err. error=%d,info:%s.\n",ctx->error,X509_verify_cert_error_string(ctx->error));
    	}
    	else
    	{
    		printf("verify huangfeihong.cer OK.\n");
    	}
        
    	X509_free(usrCert1);
    	X509_free(usrCert2);
    	X509_free(rootCert);
    	X509_STORE_CTX_cleanup(ctx);
    	X509_STORE_CTX_free(ctx);
    	X509_STORE_free(rootCertStore);
    	return;
    }
    
    
    void tGetX509Info()
    {
    	unsigned char usrCertificate[4096];
    	unsigned long usrCertificateLen;
    	X509 *x509Cert=NULL;
        const unsigned char *pTmp=NULL;
    	X509_NAME *issuer=NULL;
    	X509_NAME *subject=NULL;
    	int i;
    	int entriesNum;
    	X509_NAME_ENTRY *name_entry;
    	ASN1_INTEGER *Serial=NULL;
    	long Nid;
    	ASN1_TIME *time;
    	EVP_PKEY *pubKey;
    	long Version;
    	FILE *fp;
    	unsigned char derpubkey[1024];
    	int derpubkeyLen;
    	unsigned char msginfo[1024];
    	int msginfoLen;
    	unsigned short *pUtf8=NULL;
    	int nUtf8;
    	int rv;
    
    	fp=fopen("huangfeihong.cer","rb");
    	if(fp==NULL)
    	{
    		printf("open file err.\n");
    		return;
    	}
    	usrCertificateLen=fread(usrCertificate,1,4096,fp);
    	fclose(fp);
    	pTmp=usrCertificate;
    	x509Cert=d2i_X509(NULL,&pTmp,usrCertificateLen);
    	if(x509Cert==NULL)
    	{
    		printf("d2i_X509 err.\n");
    		return;
    	}
    
    	printf("---------------Certificate Info --------------\n");
    	Version=X509_get_version(x509Cert);
        printf("X509 Version:%d\n",Version);
    	Serial =X509_get_serialNumber(x509Cert);
    	printf("serialNumber:");
    	for(i=0;i<Serial->length;i++)
    	{
    		printf("%02x",Serial->data[i]);
    	}
    	printf("\n--------------------------------------------\n");
    	issuer=X509_get_issuer_name(x509Cert);
    	entriesNum=sk_X509_NAME_ENTRY_num(issuer->entries);
    	for(i=0;i<entriesNum;i++)
    	{
    		name_entry=sk_X509_NAME_ENTRY_value(issuer->entries,i);
    		Nid=OBJ_obj2nid(name_entry->object);
    		if(name_entry->value->type==V_ASN1_UTF8STRING)
    		{
    			nUtf8=2*name_entry->value->length;
    //			pUtf8=malloc(nUtf8);
    			memset(pUtf8,0,nUtf8);
    			rv=MultiByteToWideChar(
                                CP_UTF8,
                                0,
                                (char*)name_entry->value->data,
                                name_entry->value->length,
                                pUtf8,
                                nUtf8);
                            rv=WideCharToMultiByte(
                               CP_ACP,
                               0,
                               pUtf8,
                               rv,
                               (char*)msginfo,
                               nUtf8,
                               NULL,
                               NULL);
                            free(pUtf8);
                            pUtf8=NULL;
                            msginfoLen=rv;
                            msginfo[msginfoLen]='\0';
                       }
                      else
                      {
                         msginfoLen=name_entry->value->length;
                         memcpy(msginfo,name_entry->value->data,msginfoLen);
                         msginfo[msginfoLen]='\0';
                       }
                     switch(Nid)
                     {
                        case NID_countryName:
                             printf("Issuer's countryName:%s\n",msginfo);
                             break;
                        case NID_stateOrProvinceName:
                             printf("Issuer's ProvinceName:%s\n",msginfo);
                             break;
                        case NID_localityName:
                             printf("Issuer's localityName:%s\n",msginfo);
                             break;
                        case NID_organizationName:
                             printf("Issuer's organizationName:%s\n",msginfo);
                             break;
                        case NID_organizationalUnitName:
                             printf("Issuer's organizationalUnitName:%s\n",msginfo);
                             break;
                        case NID_commonName:
                             printf("Issuer's commonName:%s\n",msginfo);
                             break;
                        case NID_pkcs9_emailAddress:
                             printf("Issuer's emailAddress:%s\n",msginfo);
                             break;
                      }
                 }
                 printf("-----------------\n");
                 subject=X509_get_subject_name(x509Cert);
                 entriesNum=sk_X509_NAME_ENTRY_num(subject->entries);
                 for(i=0;i<entriesNum;i++)
                 {
                   name_entry=sk_X509_NAME_ENTRY_value(subject->entries,i);
                   Nid=OBJ_obj2nid(name_entry->object);
                   if(name_entry->value->type==V_ASN1_UTF8STRING)
                   {
                      nUtf8=2*name_entry->value->length;
                      //pUtf8=malloc(nUtf8);
                      memset(pUtf8,0,nUtf8);
                      rv=MultiByteToWideChar(
                         CP_UTF8,
                         0,
                         (char*)name_entry->value->data,
                         name_entry->value->length,
                         pUtf8,
                         nUtf8);
                      rv=WideCharToMultiByte(
                         CP_ACP,
                         0,
                         pUtf8,
                         rv,
                         (char*)msginfo,
                         nUtf8,
                         NULL,
                         NULL);
                      free(pUtf8);
                      pUtf8=NULL;
                      msginfoLen=rv;
                      msginfo[msginfoLen]='\0';
                    }
                    else
                    {
                       msginfoLen=name_entry->value->length;
                       memcpy(msginfo,name_entry->value->data,msginfoLen);
                       msginfo[msginfoLen]='\0';
                     }
                    switch(Nid)
                    {
                        case NID_countryName:
                             printf("Subject's countryName:%s\n",msginfo);
                             break;
                        case NID_stateOrProvinceName:
                             printf("Subject's ProvinceName:%s\n",msginfo);
                             break;
                        case NID_localityName:
                             printf("Subject's localityName:%s\n",msginfo);
                             break;
                        case NID_organizationName:
                             printf("Subject's organizationName:%s\n",msginfo);
                             break;
                        case NID_organizationalUnitName:
                             printf("Subject's organizationalUnitName:%s\n",msginfo);
                             break;
                        case NID_commonName:
                             printf("Subject's commonName:%s\n",msginfo);
                             break;
                        case NID_pkcs9_emailAddress:
                             printf("Subject's emailAddress:%s\n",msginfo);
                             break;
                     }
                 }
           printf("-----------------\n");
           time=X509_get_notBefore(x509Cert);
           printf("Cert notBefore:%s\n",time->data);
           time=X509_get_notAfter(x509Cert);
           printf("Cert notAfter:%s\n",time->data);
           printf("---------------------------\n");
           pubKey=X509_get_pubkey(x509Cert);
     /*    pTmp=derpubkey;
           derpubkeyLen=i2d_PublicKey(pubKey,&pTmp);
           printf("PublicKey is:\n");
           for(i=0;i<derpubkeyLen;i++)
           {
              printf("%02x",derpubkey[i]);
            }
            */     
            printf("\n--------------------\n");
            X509_free(x509Cert);
            return;
    }
               
    void main()
    {
    	OpenSSL_add_all_algorithms();
    	tX509_Verify();
    	tGetX509Info();
    }

![Center 1][]

#  4.**问题及解决方法** #

(1) 传参问题：

unsigned char *pTmp=NULL;
      rootCert=d2i_X509(NULL, &pTmp ,derRootCertLen);
      usrCert1=d2i_X509(NULL,&pTmp,usrCertificate1Len);
      usrCert2=d2i_X509(NULL,&pTmp,usrCertificate2Len);

解决方法为将unsigned char \*pTmp=NULL;改为const unsigned char \*pTmp=NULL;

(2) 证书验证存在问题：证书与实验所要用的证书有所不同。

(3) 未打印出公钥public key:

![Center 2][]

[Center]: /images/20220731/877b887e597345cfafbc7f21ea90c71f.png
[Center 1]: /images/20220731/a8f1538d7c6f40bdb078bd2838384e49.png
[Center 2]: /images/20220731/ee4947cefcbb46819b7de7dac00cbbba.png