How I can find URI for this ca certificate?

[Akash Deo]

Hi,
I am trying to verify whether a ca signed certificate is revoked.

Openssl verify option requires following parameters:


   - cert : A ca signed certificate to be verified.
   - cafile: FilePath to ca certificate used to sign the certificate (cert).
   *How I can find URI for this ca certificate?*
   - crlfile: Can be obtained from CRL Distribution Points field in
   certificate (cert).


*How I can find URI for ca certificate?*

I am trying to do the verification in my code using following example. I
tested below code by being the self CA. But if the certificates are signed
by third party CA then how to get the ca certificate used for signing.
I want my code to determine the location to pick required ca cert.

Please help:

Code example:
void handle_error(const char *file, int lineno, const char *msg)
{
fprintf(stderr, "** %s:%i %s\n", file, lineno, msg);
ERR_print_errors_fp(stderr);
exit(-1);
}

#define int_error(msg) handle_error(__FILE__, __LINE_ _, msg)
/* these are defintions to make the example simpler */
#define CA_FILE "CAfile.pem"
#define CA_DIR "/etc/ssl"
#define CRL_FILE "CRLfile.pem"
#define CLIENT_CERT "cert.pem"

int verify_callback(int ok, X509_STORE_CTX *stor)
{
if(!ok)
fprintf(stderr, "Error: %s\n",
X509_verify_cert_error_string(stor->error));
return ok;
}

int main(int argc, char *argv[])
{
X509 *cert;
X509_STORE *store;
X509_LOOKUP *lookup;
X509_STORE_CTX *verify_ctx;
FILE *fp;

OpenSSL_add_all_algorithms();
ERR_load_crypto_strings();
seed_prng();

/* first read the client certificate */
if (!(fp = fopen(CLIENT_CERT, "r")))
int_error("Error reading client certificate file");
if (!(cert = PEM_read_X509(fp, NULL, NULL, NULL)))
int_error("Error reading client certificate in file");
fclose(fp);

/* create the cert store and set the verify callback */
if (!(store = X509_STORE_new()))
int_error("Error creating X509_STORE_CTX object");
X509_STORE_set_verify_cb_func(store, verify_callback);

/* load the CA certificates and CRLs */
if (!(lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file())))
fprintf(stderr, "Error creating X509_LOOKUP object\n");
if (X509_LOOKUP_load_file(lookup, CA_FILE, X509_FILETYPE_PEM) != 1)
fprintf(stderr, "Error reading the CA file\n");
if (!(lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file())))
int_error("Error creating X509_LOOKUP object");
if (X509_load_crl_file(lookup, CRL_FILE, X509_FILETYPE_PEM) != 1)
int_error("Error reading the CRL file");

/* enabling verification against CRLs is not possible
in prior versions */
#if (OPENSSL_VERSION_NUMBER > 0x00907000L)
/* set the flags of the store so that CRLs are consulted */
X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK |
X509_V_FLAG_CRL_CHECK_ALL);
#endif

/* create a verification context and initialize it */
if (!(verify_ctx = X509_STORE_CTX_new()))
int_error("Error creating X509_STORE_CTX object");

/* X509_STORE_CTX_init did not return an error condition
in prior versions */
#if (OPENSSL_VERSION_NUMBER > 0x00907000L)
if (X509_STORE_CTX_init(verify_ctx, store, cert, NULL) != 1)
int_error("Error initializing verification context");
#else
X509_STORE_CTX_init(verify_ctx, store, cert, NULL);
#endif

/* verify the certificate */
if (X509_verify_cert(verify_ctx) != 1)
int_error("Error verifying the certificate");
else
printf("Certificate verified correctly!\n");
return 0;
}

Thanks & Regards,
Akash Deo