Question

我正在尝试连接到需要客户端身份验证的服务器。我在C中用libcurl做它。问题是当我尝试连接时，我得到： curl_easy_perform（）失败：SSL连接错误我读到我应该将服务器证书添加到ca-bundle.crt;但服务器的证书是自签名的，所以当我将它添加到ca-bundle时，我得到了SSL对等证书或SSH远程密钥不正常。之后我尝试将CURLOPT_SSL_VERIFYPEER设置为false;但我得到第一个错误curl_easy_perform（）失败：SSL连接错误这是我目前的代码：

#define SKIP_HOSTNAME_VERIFICATION
#define SKIP_PEER_VERIFICATION

int authenticate(CURL *curl) {
    char* pathToCert = "sslCert.pem";
    char* pathToKey = "privateKey.pem";
    curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM");
    int res = curl_easy_setopt(curl, CURLOPT_SSLCERT, pathToCert);
    if (res != CURLE_OK)
        fprintf(stderr, "curl_easy_perform() failed: %s\n",
            curl_easy_strerror(res));
    curl_easy_setopt(curl, CURLOPT_SSLKEY, pathToKey);
}


int main(int argc, char **argv) {
    CURL *curl;
    CURLcode res;

    curl_global_init(CURL_GLOBAL_DEFAULT);

    curl = curl_easy_init();
    if (curl) {
        curl_easy_setopt(curl, CURLOPT_URL, "https://localhost:8443/RemSig/status");
        authenticate(curl);

#ifdef SKIP_PEER_VERIFICATION
        /*
         * If you want to connect to a site who isn't using a certificate that is
         * signed by one of the certs in the CA bundle you have, you can skip the
         * verification of the server's certificate. This makes the connection
         * A LOT LESS SECURE.
         *
         * If you have a CA cert for the server stored someplace else than in the
         * default bundle, then the CURLOPT_CAPATH option might come handy for
         * you.
         */
        curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
#endif

#ifdef SKIP_HOSTNAME_VERIFICATION
        /*
         * If the site you're connecting to uses a different host name that what
         * they have mentioned in their server certificate's commonName (or
         * subjectAltName) fields, libcurl will refuse to connect. You can skip
         * this check, but this will make the connection less secure.
         */
        curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
#endif

        /* Perform the request, res will get the return code */
        res = curl_easy_perform(curl);
        /* Check for errors */
        if (res != CURLE_OK)
            fprintf(stderr, "curl_easy_perform() failed: %s\n",
                curl_easy_strerror(res));

        /* always cleanup */
        curl_easy_cleanup(curl);
    }

    curl_global_cleanup();

    return 0;
}

有人知道哪里可能有问题吗？服务器正在运行，可以从不同的客户端和浏览器访问。

编辑 - 解决方案

添加curl_easy_setopt（curl，CURLOPT_VERBOSE，1）后;在我的代码中，我发现问题出在证书路径中。在添加证书的路径中./应该添加，否则libcurl找不到证书。

在SKIP_PEER_VERIFICATION之后，SSL连接错误与libcurl？

0 个答案: