Problem - Kevin Tafuro

10.5 Performing X.509 Certificate Verification
with OpenSSL
Problem
You have an X.509 certificate and you want to verify its validity using OpenSSL.
Solution
OpenSSLrepresents an X.509 certificate using an X509 object. Another object, an
X509_STORE, must be combined with the X509 object to be verified into an X509_STORE_
CTX object. An X509_STORE object contains the certificates that OpenSSLwill use to
verify the certificate under scrutiny, as well as an optional CRL. The X509_STORE_CTX
object simply combines the X509_STORE and X509 objects. The actual certificate verification
is performed by calling X509_verify_cert( ) and passing it the X509_STORE_CTX
object.
Discussion
Actually performing the certificate verification requires a significant amount of setup
work. Much of the work should not really be necessary, but there are some issues
with the current version of OpenSSLthat need to be addressed. The OpenSSLteam
is aware of the problems we have encountered, and we anticipate that they will be
fixed at some point in the future, but unfortunately, we do not know when that
might be.
OpenSSLprovides a set of functions for manipulating X509_STORE objects, and we
will be using them, but in versions of OpenSSLup to and including the initial release
of 0.9.7, no X.509 objects are reference counted while other OpenSSLobjects
(including EVP_PKEY, SSL_CTX, and many others) are. This presents a problem for us
because much of the code that we will be presenting needs to have only a single
X509_STORE object used for different purposes. If we attach the X509_STORE object to
an SSL_CTX, for example, when the SSL_CTX is destroyed, so is the X509_STORE object.
When trying to build a higher-level API on top of OpenSSL’s API, things quickly get
ugly.
The situation is complicated by the fact that OpenSSLprovides no APIs to duplicate
objects. Our solution to this problem as a whole is to create a new structure that contains
everything we might need, then to create X509_STORE objects from that structure
as we need them. It is obviously not optimal, and it is also not a perfect solution,
but it is difficult to do any better. The proper solution is OpenSSL’s to implement,
but it’s not a small task. Reference counting is often difficult to get right, and adding
that kind of memory management into a large body of existing code is even harder.
Performing X.509 Certificate Verification with OpenSSL | 525
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.