Hi again, sorry, it doesn't work, I am kind of tired and wrote to fast ;) I get an X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT error, which is normal.
Best regards. > -----Ursprüngliche Nachricht----- > Von: [email protected] > Gesendet: 19.05.08 18:50:56 > An: [email protected] > Betreff: X509_verify_cert without CA certificate > Dear OpenSSL team, > > First, thanks for reading this. > > I try to verify a certificate with the function "X509_verify_cert" which > works well when I provide a STACK_OF(X509) with one or more CA certificate. > But when I try to verify a single certificate (not self-signed but CA signed) > without providing any CA certificate, I get > X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY which is normal. > > I'd still like to use this function to verify a single certificate because I > do not only want to verify a signature (as X509_verify does) but I also want > to check other things (attributes, time...) that X509_verify_cert verifies > (X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD or X509_V_ERR_CERT_NOT_YET_VALID > etc...) > > In order to bypass the error mentioned above, I tried to set my own verify > callback function with X509_STORE_set_verify_cb_func and catch the case > X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY which worked, but also bypassed > among other things the time verificate of the certificate (It seems the > verification process doesn't go any further after my callback function > returns 1). > > At last, I tried to address the root cause of this *problem* by overwriting > the X509_STORE internal "check_issued" function and this worked great. Here > is how the code would look like: > > int my_check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer) { > return 1; > } > > int blablabla() { > > X509_STORE *store = X509_STORE_new(); > X509_STORE_CTX ctx; > [...] > store->check_issued=my_check_issued; > [...] > if (X509_verify_cert(&ctx)<=0) { > [...] > > Is this acceptable from a security perspective, or am I doing something > terribly wrong by doing this ? > Also: Am I using a wrong approach of the things ? Is there any much easier > way to check an single X509 certificate I am not aware of ? > > Thank you very much for your time and support, > Valéry. > _______________________________________________________________________ > EINE FÜR ALLE: die kostenlose WEB.DE-Plattform für Freunde und Deine > Homepage mit eigenem Namen. Jetzt starten! http://unddu.de/[EMAIL PROTECTED] > > ______________________________________________________________________ > OpenSSL Project http://www.openssl.org > User Support Mailing List [email protected] > Automated List Manager [EMAIL PROTECTED] > ______________________________________________________ Bis 50 MB Dateianhänge? Kein Problem! http://freemail.web.de/club/landingpage.htm/?mc=025556 ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
