使用OpenSSL C库验证SSL证书

介绍如何使用OpenSSL C库来进行SSL证书验证，防止中间人攻击和伪造证书攻击。通过建立SSL连接并验证证书链来确保通信安全。

#include <openssl/ssl.h>
#include <openssl/x509.h>
#include <openssl/err.h>

SSL_CTX *ctx;

//初始化SSL环境
int ssl_init(){
    SSL_load_error_strings();
    OpenSSL_add_ssl_algorithms();
    ctx = SSL_CTX_new(SSLv23_method());
    if (!ctx) {
        ERR_print_errors_fp(stderr);
        return 0;
    }
    return 1;
}

//SSL连接函数
int ssl_connect(int sockfd, const char *hostname){
    SSL *ssl;

    ssl = SSL_new(ctx);
    SSL_set_fd(ssl, sockfd);
    if (SSL_connect(ssl) != 1) {
        ERR_print_errors_fp(stderr);
        return 0;
    }

    //获取证书链
    X509 *cert;
    X509_NAME *cert_name;
    int depth = 0;
    STACK_OF(X509) *chain = SSL_get_peer_cert_chain(ssl);
    while ((cert = sk_X509_shift(chain)) != NULL) {
        depth++;

        if (X509_V_OK != SSL_get_verify_result(ssl)) {
            fprintf(stderr, "certificate verify failed, ssl error: %s\n", ERR_error_string(ERR_get_error(), NULL));
            return 0;
        }
        cert_name = X509_get_subject_name(cert);
        char *cn = X509_NAME_oneline(cert_name, NULL, 0);
        printf("depth:%d,subject name:%s\n", depth, cn); //打印证书链

        OPENSSL_free(cn);
        X509_free(cert);
    }

    //释放SSL
    SSL_shutdown(ssl);
    SSL_free(ssl);
    return 1;
}

//释放SSL环境
void ssl_cleanup(){
    SSL_CTX_free(ctx);
    EVP_cleanup();
}

免责申明：文章和图片全部来源于公开网络，如有侵权，请通知删除 server@dude6.com