Question

我可以获得像

这样的主题替代名称

 X509_NAME_get_text_by_NID(X509_get_subject_name(x), NID_subject_alt_name, hc->https_domain_name, 256)

使用相同的方法将2.参数更改为 NID_issuer_alt_name 我希望获得发行者名称;

X509_NAME_get_text_by_NID(X509_get_subject_name(x), NID_issuer_alt_name, hc->https_ca_name, 256);

但我得到一个空字符串。如何正确检索发行人替代名称？

Answer 1

您可以按照https://github.com/iSECPartners/ssl-conservatory中的建议尝试以下解决方案：

static HostnameValidationResult matches_subject_alternative_name (const char *hostname, const X509 *server_cert) {
    HostnameValidationResult result = MatchNotFound;
    int i;
    int san_names_nb = -1;
    STACK_OF(GENERAL_NAME) *san_names = NULL;

    // Try to extract the names within the SAN extension from the certificate
    san_names = X509_get_ext_d2i((X509 *) server_cert, NID_subject_alt_name, NULL, NULL);
    if (san_names == NULL) {
        return NoSANPresent;
    }
    san_names_nb = sk_GENERAL_NAME_num(san_names);

    // Check each name within the extension
    for (i=0; i<san_names_nb; i++) {
        const GENERAL_NAME *current_name = sk_GENERAL_NAME_value(san_names, i);

        if (current_name->type == GEN_DNS) {
            // Current name is a DNS name, let's check it
            char *dns_name = (char *) ASN1_STRING_data(current_name->d.dNSName);

            // Make sure there isn't an embedded NUL character in the DNS name
            if (ASN1_STRING_length(current_name->d.dNSName) != strlen(dns_name)) {
                result = MalformedCertificate;
                break;
            }
            else { // Compare expected hostname with the DNS name
                if (strcasecmp(hostname, dns_name) == 0) {
                    result = MatchFound;
                    break;
                }
            }
        }
    }
    sk_GENERAL_NAME_pop_free(san_names, GENERAL_NAME_free);

    return result;
}

希望它有所帮助！

Answer 2

在使用NID_issuer_alt_name常量调用X509_NAME_get_text_by_NID时，我会将X509_get_subject_name（x）替换为X509_get_issuer_name（x）。我认为这应该是你所追求的技巧。

如何通过openssl检索ssl证书的issuer替代名称

2 个答案: