logo标签列表

OpenSSL 证书缺少密钥标识符。

c++certificateopensslkey
11

我如何将这些部分添加到证书中（我正在使用C++手动构建）。

    X509v3 Subject Key Identifier: 
        A4:F7:38:55:8D:35:1E:1D:4D:66:55:54:A5:BE:80:25:4A:F0:68:D0
    X509v3 Authority Key Identifier: 
        keyid:A4:F7:38:55:8D:35:1E:1D:4D:66:55:54:A5:BE:80:25:4A:F0:68:D0

目前我的代码生成证书很好，除了那些密钥... :/

static X509 * GenerateSigningCertificate(EVP_PKEY* pKey)
{
    X509 *x;
    x = X509_new(); //create x509 certificate

    X509_set_version(x, NID_X509);
    ASN1_INTEGER_set(X509_get_serialNumber(x), 0x00000000); //set serial number
    X509_gmtime_adj(X509_get_notBefore(x), 0);
    X509_gmtime_adj(X509_get_notAfter(x),(long)60*60*24*365); //1 year
    X509_set_pubkey(x, pKey); //set pub key from just generated rsa

    X509_NAME *name;

    name = X509_get_subject_name(x);

    NAME_StringField(name, "C", "LV");
    NAME_StringField(name, "CN", "Point"); //common name
    NAME_StringField(name, "O", "Point"); //organization

    X509_set_subject_name(x, name); //save name fields to certificate
    X509_set_issuer_name(x, name); //save name fields to certificate

    X509_EXTENSION *ex;
    ex = X509V3_EXT_conf_nid(NULL, NULL, NID_netscape_cert_type, "server");
    X509_add_ext(x,ex,-1);
    X509_EXTENSION_free(ex);

    ex = X509V3_EXT_conf_nid(NULL, NULL, NID_netscape_comment, "example comment extension");
    X509_add_ext(x, ex, -1);
    X509_EXTENSION_free(ex);

    ex = X509V3_EXT_conf_nid(NULL, NULL, NID_netscape_ssl_server_name, "www.lol.lv");

    X509_add_ext(x, ex, -1);
    X509_EXTENSION_free(ex);

    ex = X509V3_EXT_conf_nid(NULL, NULL, NID_basic_constraints, "critical,CA:TRUE");
    X509_add_ext(x, ex, -1);
    X509_EXTENSION_free(ex);

    X509_sign(x, pKey, EVP_sha1()); //sign x509 certificate
    return x;
}
1
提醒：如果有人将此代码作为示例，请注意，调用“X509_set_version（x，NID_X509）;”是错误的，应该是“X509_set_version（x，2）;”。 - Wheezil
1个回答
17

找到解决方案 - 将这些行添加到代码中

ex = X509V3_EXT_conf_nid(NULL, NULL, NID_subject_key_identifier, "hash");
X509_add_ext(x, ex, -1);
X509_EXTENSION_free(ex);

ex = X509V3_EXT_conf_nid(NULL, NULL, NID_authority_key_identifier, "keyid:always");
X509_add_ext(x, ex, -1);
X509_EXTENSION_free(ex);
仅为完整起见：此函数不是OpenSSL API的一部分，它来自于OpenSSL示例。 - ereOn
很奇怪。我无法使类似的代码（.../demos/mkcert.c）正常工作。当我尝试添加SKI时，从X509V3_EXT_conf_nid返回了一个空的X509_EXTENSION，并显示错误“0x22073072”（“X509 V3 routines:S2I_SKEY_ID:no public key”）。是的，公钥早先已通过X509_set_pubkey设置。 - jww
@jww，我也遇到了同样的问题。你找到解决方案了吗？ - jcoffland
2
为了使其正常工作，您应该将上下文初始化并设置为第二个参数 X509V3_set_ctx(&v3ctx, issuer, subject, 0, 0, 0); X509V3_EXT_conf_nid(0, &v3ctx, nid, val));。http://openssl.6102.n7.nabble.com/Error-0x22073072-when-adding-SKI-to-CA-Cert-tp48661p48662.html - zed
网页内容由stack overflow 提供, 点击上面的
可以查看英文原文，
原文链接