Store a private key and a certificate in C++/OpenSSL

Question

I need to store certificates and their private key in memory. Certificates can be in the 4 following formats : PEM, PKCS12, PKCS7, DER. I'ill need to write them back as PEM later.

All the snippets i see are storing only the public certificate in a X509 struct. What about the private part ??

I've found a way using X509_INFO, but i got a major problem with it : I haven't find a way to get a X509_INFO from DER/PKCS7/PKCS12 files

For the moment i got the following code :

    QList<X509_INFO*>* Certificat::stringPEMToX509_INFO(QString stringPem)
{
    QList <X509_INFO*>* liste_certificats = new QList<X509_INFO*>;
    STACK_OF(X509_INFO)* pile_certificats = NULL;
    X509_INFO* certificat;

    BIO* bio = BIO_new(BIO_s_mem());

    const char* pem = stringPem.toAscii().constData();
    BIO_puts(bio, pem);

    //https://github.com/openssl/openssl/blob/master/crypto/pem/pem_info.c
    pile_certificats = PEM_X509_INFO_read_bio(bio, NULL, NULL, NULL);

    for (int i = 0; i < sk_X509_INFO_num(pile_certificats); i++)
    {
        certificat = sk_X509_INFO_value(pile_certificats, i);
        liste_certificats->push_back(certificat);
    }
    sk_X509_INFO_pop_free(pile_certificats, X509_INFO_free);
    BIO_free_all(bio);

    return liste_certificats;

}

My goal would be to have the same function but for DER, PKCS12 and PKCS7.

I tried to get a X509_INFO from a DER like this :

p12 = d2i_PKCS12_bio(bio, NULL);
certificat = X509_INFO_new();
certificat->x509 = cert;
certificat->x_pkey = pkey;

But x_pkey is a X509_PKEY and pkey an EVP_PKEY...

If there is no way to store it as a single struct, would it be possible to store my certificates as X509 + a EVP_PKEY for the private key, and still output both private and public part in a PEM ?

score 0 · Accepted Answer · answered Jun 01 '18 at 22:13

PKCS7 is only meant for public keys. DER and PEM are simply ways of encoding a PKCS (and many other) objects. Since you want to store everything into a single structure, you would probably most benefit from PKCS12. OpenSSL provides functions to parse PKCS12 data and get both the cert and key out of it.

Store a private key and a certificate in C++/OpenSSL

1 Answers1