Hi Aleksey,
> Hm... Yes you are right! Sorry, I forgot about this. If you use
> OpenSSL then the "config" parameter is pointing to the folder
> with trusted certs (see xmlSecOpenSSLSetDefaultTrustedCertsFolder
> function).
>
> Do you have any errors from xmlsec? Can you put a breakpoint
> in xmlSecOpenSSLX509StoreInitialize() function on this line:
Yes, I get the following error when I try to load a key with
xmlSecKeyInfoNodeRead:
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=408:obj=x509-store:subj=unknown:error=71:certificate
verification failed:err=18;msg=self signed certificate
The certificate is self-signed but I have the certificate in the directory I'm
trying to set as the trusted certs folder. If I add it using
xmlSecCryptoAppKeysMngrCertLoad, the error goes away.
> path = xmlSecOpenSSLGetDefaultTrustedCertsFolder();
> if(path != NULL) {
> X509_LOOKUP *lookup = NULL;
>
> lookup = X509_STORE_add_lookup(ctx->xst,
> X509_LOOKUP_hash_dir());
> if(lookup == NULL) {
> ...
> }
> X509_LOOKUP_add_dir(lookup, (char*)path, X509_FILETYPE_DEFAULT);
> }
>
>
> and then trace down if 1) you have correct value in "path" and
> 2) X509_LOOKUP_add_dir() succeeds? BTW, there is a small bug in this
> code... I need to check the return value from X509_LOOKUP_add_dir()
> and report an error if needed. I'll fix it tonight.
I can confirm that the path is receiving the correct value at this point and
X509_LOOKUP_add_dir() is returning 1.
I did wonder what the format of the files in the directory should be? My
trusted cert is a PEM file. I have also tried using the openssl c_rehash tool
on the directory, but still the same problem. I will keep looking today.
David.
--
Der GMX SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen!
Ideal für Modem und ISDN: http://www.gmx.net/de/go/smartsurfer
_______________________________________________
xmlsec mailing list
[email protected]
http://www.aleksey.com/mailman/listinfo/xmlsec
