Dear OpenSSL team,
First, thanks for reading this.
I try to verify a certificate with the function "X509_verify_cert" which works
well when I provide a STACK_OF(X509) with one or more CA certificate. But when
I try to verify a single certificate (not self-signed but CA signed) without
providing any CA certificate, I get
X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY which is normal.
I'd still like to use this function to verify a single certificate because I do
not only want to verify a signature (as X509_verify does) but I also want to
check other things (attributes, time...) that X509_verify_cert verifies
(X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD or X509_V_ERR_CERT_NOT_YET_VALID
etc...)
In order to bypass the error mentioned above, I tried to set my own verify
callback function with X509_STORE_set_verify_cb_func and catch the case
X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY which worked, but also bypassed
among other things the time verificate of the certificate (It seems the
verification process doesn't go any further after my callback function returns
1).
At last, I tried to address the root cause of this *problem* by overwriting the
X509_STORE internal "check_issued" function and this worked great. Here is how
the code would look like:
int my_check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer) {
return 1;
}
int blablabla() {
X509_STORE *store = X509_STORE_new();
X509_STORE_CTX ctx;
[...]
store->check_issued=my_check_issued;
[...]
if (X509_verify_cert(&ctx)<=0) {
[...]
Is this acceptable from a security perspective, or am I doing something
terribly wrong by doing this ?
Also: Am I using a wrong approach of the things ? Is there any much easier way
to check an single X509 certificate I am not aware of ?
Thank you very much for your time and support,
Valéry.
_______________________________________________________________________
EINE FÜR ALLE: die kostenlose WEB.DE-Plattform für Freunde und Deine
Homepage mit eigenem Namen. Jetzt starten! http://unddu.de/[EMAIL PROTECTED]
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [EMAIL PROTECTED]
