Skip to content

Commit 03af3cf

Browse files
SparkiDevSparkiDev
committed
Low-level certificate verification examples
1 parent d9fcb0e commit 03af3cf

6 files changed

Lines changed: 659 additions & 0 deletions

File tree

‎.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,10 @@ pkcs7/signedData-verifyFile
198198
certmanager/certloadverifybuffer
199199
certmanager/certverify
200200

201+
certvfy/certvfy
202+
certvfy/certsigvfy
203+
certvfy/sigvfycert
204+
201205
rsa/sign
202206
rsa/verify
203207

‎certvfy/Makefile‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
CC=gcc -g
2+
CFLAGS=-Wall
3+
LIBS= -lwolfssl
4+
5+
all: certvfy certsigvfy sigvfycert
6+
7+
certvfy: certvfy.o
8+
$(CC) -o $@ $^ $(CFLAGS) $(LIBS)
9+
certsigvfy: certsigvfy.o
10+
$(CC) -o $@ $^ $(CFLAGS) $(LIBS)
11+
sigvfycert: sigvfycert.o
12+
$(CC) -o $@ $^ $(CFLAGS) $(LIBS)
13+
14+
.PHONY: clean
15+
16+
clean:
17+
rm -f *.o certvfy certsigvfy sigvfycert

‎certvfy/README.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# wolfSSL Cert Verification Examples
2+
3+
This directory contains:
4+
5+
A simple example of using the low level wolfSSL APIs to verify a certificate
6+
in a standalone manner, separate from an SSL/TLS connection.
7+
8+
## Compiling and Running the Example
9+
10+
```
11+
$ cd wolfssl
12+
$ ./autogen.sh # If downloaded from github
13+
$ ./configure '--enable-cryptonly' '--enable-singlethreaded' 'CFLAGS=-DWOLFSSL_SMALL_CERT_VERIFY'
14+
$ make all
15+
$ make check
16+
$ sudo make install
17+
```
18+
19+
```
20+
$ cd wolfssl-examples
21+
$ cd certvfy
22+
$ make all
23+
$ ./certvfy
24+
$ ./certsigvfy
25+
$ ./sigvfycert
26+
```
27+

‎certvfy/certsigvfy.c‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
/* certsigvfy.c
2+
*
3+
* Copyright (C) 2006-2024 wolfSSL Inc.
4+
*
5+
* This file is part of wolfSSL.
6+
*
7+
* wolfSSL is free software; you can redistribute it and/or modify
8+
* it under the terms of the GNU General Public License as published by
9+
* the Free Software Foundation; either version 2 of the License, or
10+
* (at your option) any later version.
11+
*
12+
* wolfSSL is distributed in the hope that it will be useful,
13+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
14+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15+
* GNU General Public License for more details.
16+
*
17+
* You should have received a copy of the GNU General Public License
18+
* along with this program; if not, write to the Free Software
19+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
20+
*/
21+
22+
#include <stdio.h>
23+
24+
#ifdef HAVE_CONFIG_H
25+
#include <config.h>
26+
#endif
27+
28+
#ifndef WOLFSSL_USER_SETTINGS
29+
#include <wolfssl/options.h>
30+
#endif
31+
#include <wolfssl/wolfcrypt/settings.h>
32+
33+
#include <wolfssl/wolfcrypt/asn_public.h>
34+
#include <wolfssl/wolfcrypt/asn.h>
35+
#include <wolfssl/wolfcrypt/error-crypt.h>
36+
37+
#define MAX_DER_SZ 4096
38+
39+
int load_file(const char* name, byte* buf, int bufSz)
40+
{
41+
FILE* file;
42+
43+
file = fopen(name, "rb");
44+
if (file == NULL) {
45+
return 0;
46+
}
47+
bufSz = fread(buf, 1, bufSz, file);
48+
fclose(file);
49+
50+
return bufSz;
51+
}
52+
53+
int main(void)
54+
{
55+
int res = 0;
56+
int ret;
57+
58+
const char* caCert = "../certs/ca-cert.der";
59+
const char* verifyCert = "../certs/server-cert.der";
60+
61+
byte caDer[MAX_DER_SZ];
62+
int caDerSz;
63+
byte certDer[MAX_DER_SZ];
64+
int certDerSz;
65+
66+
DecodedCert ca;
67+
68+
XMEMSET(&ca, 0, sizeof(ca));
69+
70+
wolfCrypt_Init();
71+
72+
/* Load the DER encoded CA certificate. */
73+
caDerSz = load_file(caCert, caDer, (int)sizeof(caDer));
74+
if (caDerSz == 0) {
75+
printf("Failed to load CA file\n");
76+
res = 1;
77+
goto exit;
78+
}
79+
80+
/* Put the CA certificate data into the object. */
81+
wc_InitDecodedCert(&ca, caDer, caDerSz, NULL);
82+
/* Parse fields of the certificate. */
83+
ret = wc_ParseCert(&ca, CERT_TYPE, 0, NULL);
84+
if (ret != 0) {
85+
printf("Parsing CA failed: %s (%d)\n", wc_GetErrorString(ret), ret);
86+
res = 1;
87+
goto exit;
88+
}
89+
90+
/* Load the DER encoded certificate to verify. */
91+
certDerSz = load_file(verifyCert, certDer, (int)sizeof(certDer));
92+
if (certDerSz == 0) {
93+
printf("Failed to load certificate file\n");
94+
res = 1;
95+
goto exit;
96+
}
97+
98+
/* Verify the signature of the certificate with the public key from the CA
99+
* certificate.
100+
*/
101+
ret = wc_CheckCertSigPubKey(certDer, certDerSz, NULL, ca.publicKey,
102+
ca.pubKeySize, ca.keyOID);
103+
if (ret != 0) {
104+
printf("Signature verification failed: %s (%d)\n",
105+
wc_GetErrorString(ret), ret);
106+
res = 1;
107+
goto exit;
108+
}
109+
printf("Verification Successful!\n");
110+
111+
exit:
112+
wc_FreeDecodedCert(&ca);
113+
wolfCrypt_Cleanup();
114+
115+
return res;
116+
}
117+

‎certvfy/certvfy.c‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
/* certvfy.c
2+
*
3+
* Copyright (C) 2006-2024 wolfSSL Inc.
4+
*
5+
* This file is part of wolfSSL.
6+
*
7+
* wolfSSL is free software; you can redistribute it and/or modify
8+
* it under the terms of the GNU General Public License as published by
9+
* the Free Software Foundation; either version 2 of the License, or
10+
* (at your option) any later version.
11+
*
12+
* wolfSSL is distributed in the hope that it will be useful,
13+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
14+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15+
* GNU General Public License for more details.
16+
*
17+
* You should have received a copy of the GNU General Public License
18+
* along with this program; if not, write to the Free Software
19+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
20+
*/
21+
22+
#include <stdio.h>
23+
24+
#ifdef HAVE_CONFIG_H
25+
#include <config.h>
26+
#endif
27+
28+
#ifndef WOLFSSL_USER_SETTINGS
29+
#include <wolfssl/options.h>
30+
#endif
31+
#include <wolfssl/wolfcrypt/settings.h>
32+
33+
#include <wolfssl/wolfcrypt/asn_public.h>
34+
#include <wolfssl/wolfcrypt/asn.h>
35+
#include <wolfssl/wolfcrypt/error-crypt.h>
36+
37+
#define MAX_DER_SZ 4096
38+
39+
int load_file(const char* name, byte* buf, int bufSz)
40+
{
41+
FILE* file;
42+
43+
file = fopen(name, "rb");
44+
if (file == NULL) {
45+
return 0;
46+
}
47+
bufSz = fread(buf, 1, bufSz, file);
48+
fclose(file);
49+
50+
return bufSz;
51+
}
52+
53+
int main(void)
54+
{
55+
int res = 0;
56+
int ret;
57+
58+
const char* caCert = "../certs/ca-cert.der";
59+
const char* verifyCert = "../certs/server-cert.der";
60+
61+
byte caDer[MAX_DER_SZ];
62+
int caDerSz;
63+
byte certDer[MAX_DER_SZ];
64+
int certDerSz;
65+
66+
DecodedCert ca;
67+
Signer caSigner;
68+
DecodedCert cert;
69+
70+
XMEMSET(&ca, 0, sizeof(ca));
71+
XMEMSET(&caSigner, 0, sizeof(caSigner));
72+
XMEMSET(&cert, 0, sizeof(cert));
73+
74+
wolfCrypt_Init();
75+
76+
/* Load the DER encoded CA certificate. */
77+
caDerSz = load_file(caCert, caDer, (int)sizeof(caDer));
78+
if (caDerSz == 0) {
79+
printf("Failed to load CA file\n");
80+
res = 1;
81+
goto exit;
82+
}
83+
84+
/* Put the CA certificate data into the object. */
85+
wc_InitDecodedCert(&ca, caDer, caDerSz, NULL);
86+
/* Parse fields of the certificate. */
87+
ret = wc_ParseCert(&ca, CERT_TYPE, 0, NULL);
88+
if (ret != 0) {
89+
printf("Parsing CA failed: %s (%d)\n", wc_GetErrorString(ret), ret);
90+
res = 1;
91+
goto exit;
92+
}
93+
/* Put fields into CA signer object. */
94+
caSigner.publicKey = ca.publicKey;
95+
caSigner.pubKeySize = ca.pubKeySize;
96+
caSigner.keyOID = ca.keyOID;
97+
XMEMCPY(caSigner.subjectNameHash, ca.subjectHash, KEYID_SIZE);
98+
99+
/* Load the DER encoded certificate to verify. */
100+
certDerSz = load_file(verifyCert, certDer, (int)sizeof(certDer));
101+
if (certDerSz == 0) {
102+
printf("Failed to load certificate file\n");
103+
res = 1;
104+
goto exit;
105+
}
106+
107+
/* Put the certificate data into the object. */
108+
wc_InitDecodedCert(&cert, certDer, certDerSz, NULL);
109+
/* Parse and verify the certificate. */
110+
ret = wc_ParseCert(&cert, CERT_TYPE, 1, &caSigner);
111+
if (ret != 0) {
112+
printf("Verification failed: %s (%d)\n", wc_GetErrorString(ret), ret);
113+
res = 1;
114+
goto exit;
115+
}
116+
printf("Verification Successful!\n");
117+
118+
exit:
119+
wc_FreeDecodedCert(&cert);
120+
wc_FreeDecodedCert(&ca);
121+
wolfCrypt_Cleanup();
122+
return res;
123+
}
124+

0 commit comments

Comments
 (0)