How to verify a X509 certificate in C

Question

I have a certificate in X509 format. this a input parameters in a function. What I would like to do is to verify the validity of the certificate. How can it be done?

X509_verify_cert();

I found this function, but this does not accept a X509* certificate, it accepts X509_store and I only have a X509.

Thanks best regards.

You may consider narrowing down the *platform* on which you're attempting to accomplish this, though even with that this may be too nebulous for this Q&A forum. — WhozCraig, Apr 05 '13 at 15:11
The function name is misleading - it doesn't fully verify the validity of the certificate, you have to also check whether the host names match, don't forget to do that. There is a function for it since OpenSSL 1.0.2: https://www.openssl.org/docs/manmaster/crypto/X509_check_email.html — Velizar Hristov, Sep 14 '15 at 14:57

mmm · Answer 1 · 2013-04-07T14:03:15.927

I am here just to post my answer as I found it with the above comments.

I had no certificate chain, so in the work I'm doing I only have a certificate generated by me programatically. I wanted to check the validity of it, so I created the following function, which checks the certificate against itself in other to verify the validity of it.

void check_certificate_validaty(X509* certificate)
{
    int status;
    X509_STORE_CTX *ctx;
    ctx = X509_STORE_CTX_new();
    X509_STORE *store = X509_STORE_new();

    X509_STORE_add_cert(store, certificate);

    X509_STORE_CTX_init(ctx, store, certificate, NULL);

    status = X509_verify_cert(ctx);
    if(status == 1)
    {
        printf("Certificate verified ok\n");
    }else
    {
        printf("%s\n", X509_verify_cert_error_string(ctx->error));
    }
}

Hope this helps someone :)

In short above code can be used to validate self signed certificates. — jaaw, Mar 16 '16 at 01:49

score 11 · Accepted Answer · edited Feb 23 '17 at 16:48

11

See the documentation here.

You need to create a certificate store using X509_STORE_CTX_new. Then add certificate chain using X509_STORE_CTX_set_chain. Add trusted root certificate using X509_STORE_CTX_trusted_stack. Finally add certificate to be verified using X509_STORE_CTX_set_cert.

After that call X509_verify_cert.

I hope this will help you to start on this.

edited Feb 23 '17 at 16:48

Nitesh

2,681
4
27
45

answered Apr 05 '13 at 15:44

doptimusprime

9,115
6
52
90

score 7 · Answer 3 · answered Oct 28 '14 at 20:16

To verify a certificate signature, you need the public key of an issuer certificate. This issuer certificate's signature is verified with another issuing certificate (or trusted root certificate). Thus if a certificate's signature verifies all the way up a chain to a trusted root, then that certificate is considered trusted.

Self-signed certificates' signatures are verified using their own public key, like the example below:

int verify_cert(const char* pem_c_str)
{
    BIO *bio_mem = BIO_new(BIO_s_mem());
    BIO_puts(bio_mem, pem_c_str);
    X509 * x509 = PEM_read_bio_X509(bio_mem, NULL, NULL, NULL);

    EVP_PKEY *pkey=X509_get_pubkey(x509);
    int r= X509_verify(x509, pkey);
    EVP_PKEY_free(pkey);

    BIO_free(bio_mem);
    X509_free(x509);
    return r;
}

from: http://www.zedwood.com/article/openssl-c-verify-self-signed-certificate-signature

How to verify a X509 certificate in C

3 Answers3

Linked