Verify signature x509

Question

Verify signature x509

When verifying the certificate, I get

EVP_F_EVP_PKEY_GET1_DH

My goal is to verify the signature of the certificate. I have 2 certificates: 1. a CA certificate 2. a certificate issued by a CA. I have extracted the RSA Public Key (Key) RSA from the CA certificate using

pPublicKey = X509_get_pubkey(x509);
buf_len = (size_t) BN_num_bytes (bn);
key = (unsigned char *)malloc (buf_len);
n = BN_bn2bin (bn, (unsigned char *) key);
if (n != buf_len)
    LOG(ERROR," : key error\n");
if (key[0] & 0x80)
    LOG(DEBUG, "00\n");

Now I have the CA public key and the CA key length, as well as the certificate issued by the CA in the buffer, the buffer length, and the public key. To verify the signature, I have the following code

int iRet1, iRet2, iRet3, iReason;

iRet1 = EVP_VerifyInit(&md_ctx, EVP_sha1());
iRet2 = EVP_VerifyUpdate(&md_ctx, buf, buflen);
iRet3 = EVP_VerifyFinal(&md_ctx, (const unsigned char *)CAkey, CAkeyLen, pubkey);
iReason = ERR_get_error();
if(ERR_GET_REASON(iReason) == EVP_F_EVP_PKEY_GET1_DH)
{
    LOG(ERROR, "EVP_F_EVP_PKEY_GET1_DH\n");
}
LOG(INFO,"EVP_VerifyInit returned %d : EVP_VerifyUpdate returned %d : EVP_VerifyFinal = %d \n", iRet1, iRet2, iRet3);

EVP_MD_CTX_cleanup(&md_ctx);
EVP_PKEY_free(pubkey);
if (iRet3 != 1)
{
    LOG(ERROR,"EVP_VerifyFinal() failed\n");
    ret = -1;
}
LOG(INFO,"signature is valid\n");

I can't figure out what could go wrong ??? Please, if anyone faced the same problems? What does the Error mean ? EVP_F_EVP_PKEY_GET1_DH

Thanks in Advance - opensid

+2

openssl

openssid Apr 28 10 at 10:47

a source to share

2 answers

caf · Answer 1 · 2010-04-29T03:26:21+0000

X509 certificates are not signed using the same method as the encryption features of the OpenSSL wrapper, so EVP_*

is the wrong tool to do the job.

The correct function is simple X509_verify(x509, X509_get_pubkey(x509))

(for a self-signed certificate).

mmm · Answer 2 · 2013-05-24T10:41:41+0000

This is how I check the certificate:

I have a certificate stored locally on my computer, I downloaded it and then I validate it against myself since in my case it is a self signed certificate. If you have a root CA and a certificate signed with that root certificate, it should work the same.

int verify_certificate(const char* certfile, const char* CAfile)
{
    int ret=0;
    X509_STORE *cert_ctx=NULL;
    X509_LOOKUP *lookup=NULL;

    cert_ctx=X509_STORE_new();
    if (cert_ctx == NULL) goto end;

    OpenSSL_add_all_algorithms();

    lookup=X509_STORE_add_lookup(cert_ctx,X509_LOOKUP_file());
    if (lookup == NULL)
        goto end;

    if(!X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM))
        goto end;

    lookup=X509_STORE_add_lookup(cert_ctx,X509_LOOKUP_hash_dir());
    if (lookup == NULL)
        goto end;

    X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT);

    ret = check(cert_ctx, certfile);
end:
    if (cert_ctx != NULL) X509_STORE_free(cert_ctx);

    return ret;
}

X509 *load_cert(const char *file)
{
    X509 *x=NULL;
    BIO *cert;

    if ((cert=BIO_new(BIO_s_file())) == NULL)
        goto end;

    if (BIO_read_filename(cert,file) <= 0)
        goto end;

    x=PEM_read_bio_X509_AUX(cert,NULL, NULL, NULL);
end:
    if (cert != NULL) BIO_free(cert);
    return(x);
}

int check(X509_STORE *ctx, const char *file)
{
    X509 *x=NULL;
    int i=0,ret=0;
    X509_STORE_CTX *csc;

    x = load_cert(file);
    if (x == NULL)
        goto end;

    csc = X509_STORE_CTX_new();
    if (csc == NULL)
        goto end;
    X509_STORE_set_flags(ctx, 0);
    if(!X509_STORE_CTX_init(csc,ctx,x,0))
        goto end;
    i=X509_verify_cert(csc);
    X509_STORE_CTX_free(csc);

    ret=0;
end:
    ret = (i > 0);
    if (x != NULL)
        X509_free(x);

    return(ret);
}

All you have to do is implement these 3 functions and then call:

int verify_certificate(const char* certfile, const char* CAfile)

Hope this helps. Best wishes

Verify signature x509

More articles: