使用 BIO_do_connect() 进行证书验证 [英] Certificate verification with BIO_do_connect()

问题描述

是否在 BIO_do_connect 调用期间执行证书验证?

Is certificate verification performed during a BIO_do_connect call?

我试图了解何时使用 ssl_get_verify_result().文档说这个函数应该与 ssl_get_peer_certificate 结合使用.但是一些示例(例如IBM 的)没有，说OpenSSL为我们做验证.他们只在 BIO_do_connect 之后调用 ssl_get_verify_result().

I am trying to understand when to use ssl_get_verify_result(). The documentation says this function should be used in conjunction with ssl_get_peer_certificate. But some of the examples (IBM's for instance) don't, saying that OpenSSL does the verification for us. They only call ssl_get_verify_result() after BIO_do_connect.

我看到 BIO_do_connect 实际上是一个宏:

I see that BIO_do_connect is actually a macro:

/* BIO_s_accept() and BIO_s_connect() */
#  define BIO_do_connect(b)       BIO_do_handshake(b)
#  define BIO_do_accept(b)        BIO_do_handshake(b)
# endif /* OPENSSL_NO_SOCK */

# define BIO_do_handshake(b)     BIO_ctrl(b,BIO_C_DO_STATE_MACHINE,0,NULL)

所以，我的理解是 BIO_do_connect 实际上并不检查服务器是否发送了证书.如果服务器确实发送了证书，则 ssl_get_verify_result 将使用它来执行验证.如果它没有发送，那么 ssl_get_verify_result 仍然返回 X509_V_OK.这就是为什么我们需要调用 ssl_get_peer_certificate 以确保确实发送了证书.这样对吗?

So, my understanding is that BIO_do_connect does not actually check to see if the server sent a certificate. If the server does send a certificate, then ssl_get_verify_result will use that to perform verification. If it doesn't send one, then ssl_get_verify_result still returns X509_V_OK. That is why we need to call ssl_get_peer_certificate to make sure that a certificate is in fact sent. Is this correct?

推荐答案

如果您查看 BIO_do_handshake 示例，您可以安全地在调用 BIO_do_handshake 后调用 ssl_get_verify_result/ssl_get_peer_certificate.

If you look at the BIO_do_handshake example, you are safe to call ssl_get_verify_result / ssl_get_peer_certificate after the call to BIO_do_handshake.

您可以使用 SSL_CTX_set_verify 自定义验证过程您可以提供回调验证功能.这允许您提供自己的验证规则，例如允许覆盖自签名证书支持等内容.

You can customize the verification process with SSL_CTX_set_verify in which you can provide a callback verification function. This allow you to provide your own validation rules like allowing overrides for things like self signed certificate support, etc.

这篇关于使用 BIO_do_connect() 进行证书验证的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！