Problem - Kevin Tafuro

take precedence over a preexisting OpenSSLobject. If a preexisting key object is
used, it is the caller’s responsibility to free it using EVP_PKEY_free( ) at any point after
it is added into the spc_x509store_t object because it is reference counted, and spc_
x509store_setusekey( ) increments its reference count.
When specifying the certificates to be sent to a peer (whether the peer will be a server
or a client), multiple certificates may be specified. The first certificate specified
should always be the certificate belonging to your program. Any additional certificates
should be certificates in the chain that may be needed to verify the validity of
your own certificate. This is true whether the certificates are loaded from a file and
specified via spc_x509store_setusecertfile( ), or are added to the spc_x509store_t
one at a time using spc_x509store_addusecert( ). Note also that the certificates and
the required private key may be contained within the same file. For both certificate
and key files, PEM format should be used, because the alternative binary ASN.1 format
(also known as DER) does not allow multiple objects to be present in the same
file.
At this point, spc_create_sslctx( ) has everything it needs. It takes a single argument—the
spc_x509store_t object—to get its information from, and it returns a new
SSL_CTX object that can be used to establish SSL-enabled connections.
#include
#define SPC_X509STORE_USE_CERTIFICATE 0x04
#define SPC_X509STORE_SSL_VERIFY_NONE 0x10
#define SPC_X509STORE_SSL_VERIFY_PEER 0x20
#define SPC_X509STORE_SSL_VERIFY_FAIL_IF_NO_PEER_CERT 0x40
#define SPC_X509STORE_SSL_VERIFY_CLIENT_ONCE 0x80
#define SPC_X509STORE_SSL_VERIFY_MASK 0xF0
SSL_CTX *spc_create_sslctx(spc_x509store_t *spc_store) {
int i, verify_flags = 0;
SSL_CTX *ctx = 0;
X509_STORE *store = 0;
spc_x509verifycallback_t verify_callback;
if (!(ctx = SSL_CTX_new(SSLv23_method( )))) goto error_exit;
if (!(store = spc_create_x509store(spc_store))) goto error_exit;
SSL_CTX_set_cert_store(ctx, store); store = 0;
SSL_CTX_set_options(ctx, SSL_OP_ALL | SSL_OP_NO_SSLv2);
SSL_CTX_set_cipher_list(ctx, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH");
if (!(verify_callback = spc_store->callback))
verify_callback = spc_verify_callback;
if (!(spc_store->flags & SPC_X509STORE_SSL_VERIFY_MASK))
verify_flags = SSL_VERIFY_NONE;
else {
if (spc_store->flags & SPC_X509STORE_SSL_VERIFY_NONE)
verify_flags |= SSL_VERIFY_NONE;
if (spc_store->flags & SPC_X509STORE_SSL_VERIFY_PEER)
verify_flags |= SSL_VERIFY_PEER;
if (spc_store->flags & SPC_X509STORE_SSL_VERIFY_FAIL_IF_NO_PEER_CERT)
538 | Chapter 10: Public Key Infrastructure
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.