Question

我坚持在OpenSSL中通过CMS_verify（）方法演变的奇怪问题。我正在开发一种使用OpenSSL在C ++中签名和验证数据的方法，但验证会引发一个非常奇怪的错误，如下面的代码存根所示：

  // Sign
  BIO_puts(in, "My test string.");

  cms = CMS_sign(serverCert, privateKey, recips, in, CMS_BINARY);
  if (!cms) {
    cout << ERR_error_string(ERR_get_error(), NULL) << endl;
  } else {
    cout << "Successfully signed!" << endl;
  }

  // Verify
  if (!CMS_verify(cms, certs, st, NULL, out, 0)) {
    cout << ERR_error_string(ERR_get_error(), NULL) << endl;
  } else {
    cout << "Successfully verified!" << endl;
  }

  size = BIO_get_mem_data(out, &outString);
  cout << "Verified string: " << string(outString, size) << endl;

  BIO_ctrl(out, BIO_CTRL_RESET, 0, NULL);

  // Verify without certificate verification
  if (!CMS_verify(cms, certs, st, NULL, out, CMS_NO_SIGNER_CERT_VERIFY)) {
    cout << ERR_error_string(ERR_get_error(), NULL) << endl;
  } else {
    cout << "Successfully verified!" << endl;
  }

  signers = CMS_get0_signers(cms);
  for (int i = 0; i < sk_X509_num(signers); i++) {
    X509_STORE_CTX_init(storeCtx, st, sk_X509_value(signers, i), NULL);
    if (!X509_verify_cert(storeCtx)) {
      cout << X509_verify_cert_error_string(storeCtx->error) << endl;
    } else {
      cout << "Signer certificate has been verified." << endl;
    }
  }

  size = BIO_get_mem_data(out, &outString);
  cout << "Verified string: " << string(outString, size) << endl;

适当的输出：

Successfully signed!
error:2E099064:CMS routines:CMS_SIGNERINFO_VERIFY_CERT:certificate verify error
Verified string: 
Successfully verified!
Signer certificate has been verified.
Verified string: My test string.

因此可以看出，我使用的证书是有效的，但CMS_Verify（）方法无论如何都无法验证CMS结构中的封装证书。

我的解决方法似乎有效，但我真的很想知道我做错了什么。

有人可以帮助我吗？

CMS_verify无法验证使用CMS_sign创建的消息

0 个答案: