C++ 实现证书文件的X509验证

参考：https://blog.csdn.net/hanghang121/article/details/51579280?utm_source=blogxgwz26&utm_medium=distribute.pc_relevant.none-task-blog-baidujs_title-4&spm=1001.2101.3001.4242

 

通过证书Server，验证证书的有效性

openssl实现了标准的x509v3数字证书，其源码在crypto/x509和crypto/x509v3中。其中x509目录实现了数字证书以及证书申请相关的各种函数，包括了X509和X509_REQ结构的设置、读取、打印和比较；数字证书的验证、摘要；各种公钥的导入导出等功能。x509v3目录主要实现了数字证书扩展项相关的函数。

在进行身份认证时，首先要对发送给服务器进行认证的x509证书有效性进行验证，在Openssl中，可以用一个API接口可以实现：int X509_verify_cert(X509_STORE_CTX *ctx); 
接口中形参是X509_STORE_CTX（X509证书库上下文）类型，在X509证书库上下文中，存在一个X509证书库和一个待验证的X509证书，可以加入信任的证书链，也可以加入CRL证书链（证书撤销列表）

 

步骤： 
1）初始化环境 
a.新建证书存储区X509_STORE_new() 
b.新建证书校验上下文X509_STORE_CTX_new() 

2）导入根证书 
a.读取CA证书，从DER编码格式化为X509结构d2i_X509() 
b.将CA证书导入证书存储区X509_STORE_add_cert() 

3）导入要校验的证书test 
a.读取证书test，从DER编码格式化为X509结构d2i_X509() 
b.在证书校验上下文初始化证书test,X509_STORE_CTX_init() 
c.校验X509_verify_cert 

 

代码：

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

#include <openssl/evp.h>
#include <openssl/x509.h>

#define CERT_PATH "/home/ckelsel/work/rc4/cert"
#define ROOT_CERT "ca.cer"
#define WIN71H "win71h.cer"
#define WIN71Y "win71y.cer"


#define GET_DEFAULT_CA_CERT(str) sprintf(str, "%s/%s", CERT_PATH, ROOT_CERT)
#define GET_CUSTOM_CERT(str, path, name) sprintf(str, "%s/%s", path, name)

#define MAX_LEGTH 4096


int my_load_cert(unsigned char *str, unsigned long *str_len,
              const char *verify_cert, const unsigned int cert_len)
{
    FILE *fp;
    fp = fopen(verify_cert, "rb");
    if ( NULL == fp)
    {
        fprintf(stderr, "fopen fail\n");
        return -1;
    }

    *str_len = fread(str, 1, cert_len, fp);
    fclose(fp);
    return 0;
}

X509 *der_to_x509(const unsigned char *der_str, unsigned int der_str_len)
{
    X509 *x509;
    x509 = d2i_X509(NULL, &der_str, der_str_len);
    if ( NULL == x509 )
    {
        fprintf(stderr, "d2i_X509 fail\n");

        return NULL;
    }
    return x509;
}
int x509_verify()
{
    int ret;
    char cert[MAX_LEGTH];

    unsigned char user_der[MAX_LEGTH];
    unsigned long user_der_len;
    X509 *user = NULL;

    unsigned char ca_der[MAX_LEGTH];
    unsigned long ca_der_len;
    X509 *ca = NULL;

    X509_STORE *ca_store = NULL;
    X509_STORE_CTX *ctx = NULL;
    STACK_OF(X509) *ca_stack = NULL;

    /* x509初始化 */
    ca_store = X509_STORE_new();
    ctx = X509_STORE_CTX_new();

    /* root ca*/
    GET_DEFAULT_CA_CERT(cert);
    /* 从文件中读取 */
    my_load_cert(ca_der, &ca_der_len, cert, MAX_LEGTH);
    /* DER编码转X509结构 */
    ca = der_to_x509(ca_der, ca_der_len);
    /* 加入证书存储区 */
    ret = X509_STORE_add_cert(ca_store, ca);
    if ( ret != 1 )
    {
        fprintf(stderr, "X509_STORE_add_cert fail, ret = %d\n", ret);
        goto EXIT;
    }

    /* 需要校验的证书 */
    GET_CUSTOM_CERT(cert, CERT_PATH, WIN71H);
    my_load_cert(user_der, &user_der_len, cert, MAX_LEGTH);
    user = der_to_x509(user_der, user_der_len);

    ret = X509_STORE_CTX_init(ctx, ca_store, user, ca_stack);
    if ( ret != 1 )
    {
        fprintf(stderr, "X509_STORE_CTX_init fail, ret = %d\n", ret);
        goto EXIT;
    }

    //openssl-1.0.1c/crypto/x509/x509_vfy.h
    ret = X509_verify_cert(ctx);
    if ( ret != 1 )
    {
        fprintf(stderr, "X509_verify_cert fail, ret = %d, error id = %d, %s\n",
                ret, ctx->error, X509_verify_cert_error_string(ctx->error));
        goto EXIT;
    }
EXIT:
    X509_free(user);
    X509_free(ca);

    X509_STORE_CTX_cleanup(ctx);
    X509_STORE_CTX_free(ctx);

    X509_STORE_free(ca_store);

    return ret == 1 ? 0 : -1;
}

int main()
{
    OpenSSL_add_all_algorithms();
    x509_verify();
    return 0;
}

 

验证证书在本机是否受信 (Windows)

C#中可以实现证书文件的X509验证，从而验证证书在本机是否受信，代码很简单：

 static void Main(string[] args)
    {
        //X509Certificate2 x509 = new X509Certificate2();
        byte[] certData = File.ReadAllBytes(@"path\to\file\test.cer");
        X509Certificate2 x509 = new X509Certificate2(certData); 
        string result;
        System.Console.WriteLine(x509.Verify());
    }

在C++中需要读取系统store的所有证书，遍历并进行验证，代码如下，

• 本例中通过Wolfssl进行验证， 调用Openssl或微软MFC的接口也可以实现

int FunctionsV2::VerifyCertFile(const std::string strFilename, int& status)
    {
        status = 0;
        PCCERT_CONTEXT  pTargetCert = NULL;

        HCERTSTORE hCertSys = CertOpenStore(
            CERT_STORE_PROV_SYSTEM,
            0,
            NULL,
            CERT_SYSTEM_STORE_CURRENT_USER,
            L"CA");

        if (hCertSys == nullptr)
        {
            return -1;
        }

        X509* certification = X509_load_certificate_file(strFilename.c_str(), WOLFSSL_FILETYPE_ASN1);

        do 
        {
            if (pTargetCert = CertFindCertificateInStore(
                hCertSys,                    // Store handle.
                X509_ASN_ENCODING,            // Encoding type.
                0,                            // Not used.
                CERT_FIND_SUBJECT_STR_A,    // Find type. Find a string in the certificate's subject.
                0,                            // The string to be searched for.
                pTargetCert))                // Previous context.
            {
                WOLFSSL_CERT_MANAGER* cm = wolfSSL_CertManagerNew();
                wolfSSL_CertManagerLoadCABuffer(cm, pTargetCert->pbCertEncoded, pTargetCert->cbCertEncoded, WOLFSSL_FILETYPE_ASN1);

                const unsigned char* der;
                int der_length;
                der = wolfSSL_X509_get_der(certification, &der_length);
                int ret = wolfSSL_CertManagerVerifyBuffer(cm, der, der_length, SSL_FILETYPE_ASN1);
                wolfSSL_CertManagerFree(cm);
                if (ret == SSL_SUCCESS)
                {
                    status = 1;
                    break;
                }
            }

        } while (pTargetCert != NULL);

        if (pTargetCert)
        {
            CertFreeCertificateContext(pTargetCert);
        }
        if (certification)
        {
            X509_free(certification);
        }

        return 0;
    }