FreeBSD下使用OpenSSL验证SSL证书的示例代码

本示例代码介绍在FreeBSD下如何使用OpenSSL库进行SSL证书验证。使用了OpenSSL的证书链和证书验证函数来检查证书和颁发者是否可信，同时验证了证书中的公钥是否能够对应私钥。

#include <stdio.h>
#include <openssl/ssl.h>
#include <openssl/err.h>

int main()
{
    SSL_CTX *ssl_ctx;
    SSL *ssl;
    X509 *cert;
    BIO *bio;
    int ret;

    SSL_library_init();

    ssl_ctx = SSL_CTX_new(TLS_method());
    SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER, NULL);
    SSL_CTX_load_verify_locations(ssl_ctx, "root.pem", NULL);

    bio = BIO_new_ssl_connect(ssl_ctx);
    SSL_set_cipher_list(ssl, "DEFAULT");
    BIO_get_ssl(bio, &ssl);
    SSL_set_mode(ssl, SSL_MODE_AUTO_RETRY);
    BIO_set_conn_hostname(bio, "www.example.com:443");

    if (BIO_do_connect(bio) <= 0) {
        fprintf(stderr, "Error: failed to connect to server.\n");
        ERR_print_errors_fp(stderr);
        return 1;
    }

    if (SSL_get_verify_result(ssl) != X509_V_OK) {
        fprintf(stderr, "Error: verify result is not X509_V_OK.\n");
        ERR_print_errors_fp(stderr);
        return 1;
    }

    cert = SSL_get_peer_certificate(ssl);
    if (cert == NULL) {
        fprintf(stderr, "Error: certificate not found.\n");
        return 1;
    }

    /* 验证公钥是否对应私钥 */
    ret = X509_verify(cert, X509_get_pubkey(cert));
    if (ret != 1) {
      fprintf(stderr, "Error: X509_verify error.\n");
      return 1;
    }

    printf("Certificate is trusted and the public key matches the private key.\n");

    BIO_free_all(bio);
    SSL_CTX_free(ssl_ctx);

    return 0;
}

免责申明：文章和图片全部来源于公开网络，如有侵权，请通知删除 server@dude6.com