Question

请帮助我了解证书的情况。我有一些代码来自IBM网站。

#include "openssl/ssl.h"
#include "openssl/bio.h"
#include "openssl/err.h"
#include "stdio.h"
#include "string.h"
int main()
{
BIO * bio;
SSL * ssl;
SSL_CTX * ctx;

int p;

char * request = "GET / HTTP/1.1\x0D\x0AHost: 
www.verisign.com\x0D\x0A\x43onnection: 
Close\x0D\x0A\x0D\x0A";
char r[1024];

/* Set up the library */

ERR_load_BIO_strings();
SSL_load_error_strings();
OpenSSL_add_all_algorithms();

/* Set up the SSL context */

ctx = SSL_CTX_new(SSLv23_client_method());

/* Load the trust store */

if(! SSL_CTX_load_verify_locations(ctx, "TrustStore.pem", NULL))
{
    fprintf(stderr, "Error loading trust store\n");
    ERR_print_errors_fp(stderr);
    SSL_CTX_free(ctx);
    return 0;
}

/* Setup the connection */

bio = BIO_new_ssl_connect(ctx);

/* Set the SSL_MODE_AUTO_RETRY flag */

BIO_get_ssl(bio, & ssl);
SSL_set_mode(ssl, SSL_MODE_AUTO_RETRY);

/* Create and setup the connection */

BIO_set_conn_hostname(bio, "www.verisign.com:https");

if(BIO_do_connect(bio) <= 0)
{
    fprintf(stderr, "Error attempting to connect\n");
    ERR_print_errors_fp(stderr);
    BIO_free_all(bio);
    SSL_CTX_free(ctx);
    return 0;
}

/* Check the certificate */

if(SSL_get_verify_result(ssl) != X509_V_OK)
{
    fprintf(stderr, "Certificate verification 
    error: %i\n", SSL_get_verify_result(ssl));
    BIO_free_all(bio);
    SSL_CTX_free(ctx);
    return 0;
}

/* Send the request */

BIO_write(bio, request, strlen(request));

/* Read in the response */

for(;;)
{
    p = BIO_read(bio, r, 1023);
    if(p <= 0) break;
    r[p] = 0;
    printf("%s", r);
}

/* Close the connection and free the context */

BIO_free_all(bio);
SSL_CTX_free(ctx);
return 0;
}

此代码SSL_CTX_load_verify_locations(ctx, "TrustStore.pem", NULL)中有一个函数，该函数采用名称为“ TrustStore.pem”的证书。我如何获得该证书？某些名为 Ristic Ivan-OpenSSL Cookbook 的书对如何获取自签名证书进行了说明（第15页）。例如：$ openssl req -new -x509 -days 365 -key fd.key -out fd.crt。此证书“ fd.crt”是否足以连接到www.google.com等服务器？

具有自签名证书的OpenSSL客户端应用程序

0 个答案: