- android - 多次调用 OnPrimaryClipChangedListener
- android - 无法更新 RecyclerView 中的 TextView 字段
- android.database.CursorIndexOutOfBoundsException : Index 0 requested, 光标大小为 0
- android - 使用 AppCompat 时,我们是否需要明确指定其 UI 组件(Spinner、EditText)颜色
为了了解 OpenSSL,我一直在尝试制作一个简单的客户端/服务器回显应用程序。我一直在关注 John Viega、Matt Messier 和 Pravir Chandra (O'Reilly) 的《Network Security with OpenSSL》。他们的示例展示了如何设置根证书颁发机构、用根 CA 签名的服务器 CA、然后用服务器 CA 签名的服务器证书,最后是用根 CA 签名的客户端证书,然后将它们导入 C 程序。我对程序做了一些小改动(比如根本不使用线程),但大部分都是他们的。我的想法是在尝试时学习,但我遇到了问题。当我尝试连接两者时,我收到一条错误消息,提示“无法获取本地颁发者证书”(错误 20)。我还想声明“以前的版本”有效(意味着他们在示例中取得了进步)。不确定问题是否出在代码、证书或两者中。我的 OpenSSL 版本是 2014 年 1 月 6 日的 OpenSSL 1.0.1f。(由 openssl version 命令返回)
目前我对这件事的了解非常浅薄,我没能找到答案。我意识到我还有很多阅读要做,我会这样做,但这是我需要克服的问题。int seed_prng(int bytes) 函数是我的,修复了在所有这些库中找不到 seed_prng(void) 函数的问题(也是我发现不合适的事情之一)。
也许,由于本教程已有 14 年历史(至少),它已经过时,我应该学习另一个教程?如果是这样,请推荐一个详细程度高的教程,因为根据我的经验,OpenSSL 的文档不是很友好。
下面,我提供了该过程中包含的所有文件(Makefile 除外。)
我用于编译的标志是:-L/usr/lib -lssl -lcrypto -Wall
通用.h :
#include <openssl/bio.h>
#include <openssl/err.h>
#include <openssl/rand.h>
#include <openssl/ssl.h>
#include <openssl/x509v3.h>
#include <openssl/rsa.h>
#include <openssl/objects.h>
#define PORT "8081"
#define SERVER "localhost"
#define CLIENT "localhost"
#define int_error(msg) handle_error(__FILE__, __LINE__, msg)
//Do not confuse with SSL_METHOD ; TLSv1_method() is also a viable option here
#define SSL_METHOD_ SSLv23_method()
#define SEED_PRNG_() seed_prng(30)
#define DEFAULT_DEPTH_ 4
#define DATA_SIZE_ 256
void handle_error(const char *file, int lineno, const char *msg) ;
void init_OpenSSL(void) ;
int seed_prng(int bytes) ;
int verify_callback(int ok, X509_STORE_CTX *store) ;
long post_connection_check(SSL *ssl, char *host) ;
通用.c:
#include "common.h"
void handle_error(const char *file, int lineno, const char *msg)
{
fprintf(stderr, "** %s:%i %s\n", file, lineno, msg);
ERR_print_errors_fp(stderr);
exit(-1);
}
void init_OpenSSL(void)
{
if (!SSL_library_init())
{
fprintf(stderr, "** OpenSSL initialization failed!\n");
exit(-1);
}
SSL_load_error_strings();
}
//Not sure if this is good idea! Have to do some research
int seed_prng(int bytes)
{
if (!RAND_load_file("/dev/urandom", bytes))
{
return 0;
}
return 1;
}
int verify_callback(int ok, X509_STORE_CTX *store)
{
char data[DATA_SIZE_];
if (!ok)
{
X509 *cert = X509_STORE_CTX_get_current_cert(store);
int depth = X509_STORE_CTX_get_error_depth(store);
int err = X509_STORE_CTX_get_error(store);
fprintf(stderr, "-Error with certificate at depth: %i\n", depth);
X509_NAME_oneline(X509_get_issuer_name(cert), data, 256);
fprintf(stderr, " issuer = %s\n", data);
X509_NAME_oneline(X509_get_subject_name(cert), data, 256);
fprintf(stderr, " subject = %s\n", data);
fprintf(stderr, " err %i:%s\n", err,
X509_verify_cert_error_string(err));
}
return ok;
}
long post_connection_check(SSL *ssl, char *host)
{
X509 *cert;
X509_NAME *subj;
char data[DATA_SIZE_];
int extcount;
int ok = 0;
if (!(cert = SSL_get_peer_certificate(ssl)) || !host)
{
if (cert)
{
X509_free(cert);
}
return X509_V_ERR_APPLICATION_VERIFICATION;
}
if ((extcount = X509_get_ext_count(cert)) > 0)
{
int i;
for (i = 0; i < extcount; i++)
{
const char *extstr;
X509_EXTENSION *ext;
ext = X509_get_ext(cert, i);
extstr = OBJ_nid2sn(OBJ_obj2nid(X509_EXTENSION_get_object(ext)));
if (!strcmp(extstr, "subjectAltName"))
{
int j;
unsigned char *data;
STACK_OF(CONF_VALUE) *val;
CONF_VALUE *nval;
const X509V3_EXT_METHOD *meth;
if (!(meth = X509V3_EXT_get(ext)))
{
break;
}
data = ext->value->data;
val = meth->i2v(meth,(meth->d2i(NULL, (const unsigned char **)(&data), ext->value->length)), NULL);
for (j = 0; j < sk_CONF_VALUE_num(val); j++)
{
nval = sk_CONF_VALUE_value(val, j);
if (!strcmp(nval->name, "DNS") && !strcmp(nval->value, host))
{
ok = 1;
break;
}
}
}
if (ok)
{
break;
}
}
}
if (!ok && (subj = X509_get_subject_name(cert)) && X509_NAME_get_text_by_NID(subj, NID_commonName, data, DATA_SIZE_) > 0)
{
data[DEFAULT_DEPTH_ - 1] = 0;
if (strcasecmp(data, host) != 0)
{
if (cert)
{
X509_free(cert);
}
return X509_V_ERR_APPLICATION_VERIFICATION;
}
}
X509_free(cert);
return SSL_get_verify_result(ssl);
}
服务器.c:
#include "common.h"
#define BUF_SIZE_ 80
#define CERTFILE "certificates/serverNOKEY.pem"
#define CAFILE "certificates/rootcert.pem"
#define CADIR NULL
SSL_CTX *setup_server_ctx(void)
{
SSL_CTX *ctx;
//This specifies that either SSL or TLS can be used
//Later, we will "filter" out SSLv2
ctx = SSL_CTX_new(SSLv23_method());
//These two functions are used to load trusted CAs
if (SSL_CTX_load_verify_locations(ctx, CAFILE, CADIR) != 1)
{
int_error("Error loading CA file and/or directory");
}
if (SSL_CTX_set_default_verify_paths(ctx) != 1)
{
int_error("Error loading default CA file and/or directory");
}
//This loads a certificate from a file
if (SSL_CTX_use_certificate_chain_file(ctx, CERTFILE) != 1)
{
int_error("Error loading certificate from file");
}
//This loads a private key (in our code, from the same file but I think that it is not necessary)
if (SSL_CTX_use_PrivateKey_file(ctx, CERTFILE, SSL_FILETYPE_PEM) != 1)
{
int_error("Error loading private key from file");
}
SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT, verify_callback);
SSL_CTX_set_verify_depth(ctx, DEFAULT_DEPTH_);
return ctx;
}
int do_server_loop(SSL *ssl)
{
int err, nread;
char buf[BUF_SIZE_];
//I think that this reading should be redone 'cause there's something wrong
do
{
for (nread = 0; nread < sizeof(buf) - 1; nread += err)
{
err = SSL_read(ssl, buf + nread, sizeof(buf) - nread);
printf("read %d bytes\n", err);
if (err <= 0)
{
break;
}
}
fwrite(buf, sizeof(char), nread, stdout);
} while (err > 0);
return (SSL_get_shutdown(ssl) & SSL_RECEIVED_SHUTDOWN) ? 1 : 0;
}
void server_part(SSL *ssl)
{
long err;
//accepting connection from ssl object (structure)
if (SSL_accept(ssl) <= 0)
{
int_error("Error accepting SSL connection");
}
if ((err = post_connection_check(ssl, CLIENT)) != X509_V_OK)
{
fprintf(stderr, "-Error: peer certificate: %s\n",
X509_verify_cert_error_string(err));
int_error("Error checking SSL object after connection");
}
fprintf(stderr, "SSL Connection opened\n");
//As I figured, SSL_shutdown is a clean way to go but SSL_clear
//will force the closing of the communication if it wasn't closed cleanly
if (do_server_loop(ssl))
{
//See this https://www.openssl.org/docs/manmaster/ssl/SSL_shutdown.html
SSL_shutdown(ssl);
}
else
{
// https://www.openssl.org/docs/manmaster/ssl/SSL_clear.html
SSL_clear(ssl);
}
fprintf(stderr, "SSL Connection closed\n");
SSL_free(ssl);
}
int main(int argc, char *argv[])
{
BIO *acc, *client;
SSL *ssl;
SSL_CTX *ctx;
init_OpenSSL();
//This is my function, gotta investigate it and see what should be there (maybe I got it right?)
SEED_PRNG_();
ctx = setup_server_ctx();
acc = BIO_new_accept(PORT);
if (!acc)
{
int_error("Error creating server socket");
}
if (BIO_do_accept(acc) <= 0)
{
int_error("Error binding server socket");
}
for (;;)
{
if (BIO_do_accept(acc) <= 0)
{
int_error("Error accepting connection");
}
client = BIO_pop(acc);
if (!(ssl = SSL_new(ctx)))
{
int_error("Error creating SSL context");
}
SSL_set_bio(ssl, client, client);
server_part(ssl);
}
SSL_CTX_free(ctx);
BIO_free(acc);
return 0;
}
客户端.c:
#include "common.h"
#define BUF_SIZE_ 80
#define CERTFILE "certificates/clientNOKEY.pem"
#define CAFILE "certificates/rootcert.pem"
#define CADIR NULL
SSL_CTX *setup_client_ctx(void)
{
SSL_CTX *ctx;
ctx = SSL_CTX_new(SSL_METHOD_);
if (SSL_CTX_load_verify_locations(ctx, CAFILE, CADIR) != 1)
{
int_error("Error loading CA file and/or directory");
}
if (SSL_CTX_set_default_verify_paths(ctx) != 1)
{
int_error("Error loading default CA file and/or directory");
}
if (SSL_CTX_use_certificate_chain_file(ctx, CERTFILE) != 1)
{
int_error("Error loading certificate from file");
}
if (SSL_CTX_use_PrivateKey_file(ctx, CERTFILE, SSL_FILETYPE_PEM) != 1)
{
int_error("Error loading private key from file");
}
SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, verify_callback);
SSL_CTX_set_verify_depth(ctx, DEFAULT_DEPTH_);
return ctx;
}
int do_client_loop(SSL *ssl)
{
int err, nwritten;
char buf[BUF_SIZE_];
for (;;)
{
if (!fgets(buf, sizeof(buf), stdin))
{
break;
}
//printf("ucitao: %s\n", buf);
for (nwritten = 0; nwritten < sizeof(buf); nwritten += err)
{
err = SSL_write(ssl, buf + nwritten, strlen(buf) - nwritten);
if (err <= 0)
{
return 0;
}
else
{
printf("Sent: %s\n", buf);
}
}
}
return 1;
}
int main(int argc, char *argv[])
{
BIO *conn;
SSL *ssl;
SSL_CTX *ctx;
long err;
init_OpenSSL();
SEED_PRNG_();
ctx = setup_client_ctx();
conn = BIO_new_connect(SERVER ":" PORT);
if (!conn)
{
int_error("Error creating connection BIO");
}
if (BIO_do_connect(conn) <= 0)
{
int_error("Error connecting to remote machine");
}
if (!(ssl = SSL_new(ctx)))
int_error("Error creating an SSL context");
SSL_set_bio(ssl, conn, conn);
if (SSL_connect(ssl) <= 0)
{
int_error("Error connecting SSL object");
}
if ((err = post_connection_check(ssl, SERVER)) != X509_V_OK)
{
fprintf(stderr, "-Error: peer certificate: %s\n",
X509_verify_cert_error_string(err));
int_error("Error checking SSL object after connection");
}
fprintf(stderr, "SSL Connection opened\n");
if (do_client_loop(ssl))
{
SSL_shutdown(ssl);
}
else
{
SSL_clear(ssl);
}
fprintf(stderr, "SSL Connection closed\n");
SSL_free(ssl);
SSL_CTX_free(ctx);
return 0;
}
我用来创建 CA、证书并签署它们的脚本:
#! /bin/bash
echo "Begin"
#the line below ensures that the script finishes after an unsuccessful command, not trying to execute any next command,
#since it's the assumption that every previous command was successful
set -e
echo "Creating the root CA"
openssl req -newkey rsa:1024 -sha1 -keyout rootkey.pem -out rootreq.pem
openssl x509 -req -in rootreq.pem -sha1 -extfile myopenssl.cnf -extensions v3_ca -signkey rootkey.pem -out rootcert.pem
cat rootcert.pem rootkey.pem > root.pem
openssl x509 -subject -issuer -noout -in root.pem
echo "Creating the server CA and signing it with the root CA"
openssl req -newkey rsa:1024 -sha1 -keyout serverCAkey.pem -out serverCAreq.pem
openssl x509 -req -in serverCAreq.pem -sha1 -extfile myopenssl.cnf -extensions v3_ca -CA root.pem -CAkey root.pem -CAcreateserial -out serverCAcert.pem
cat serverCAcert.pem serverCAkey.pem rootcert.pem > serverCA.pem
openssl x509 -subject -issuer -noout -in serverCA.pem
echo "Creating the server\'s certificate and signing it with the server CA"
openssl req -newkey rsa:1024 -sha1 -keyout serverkey.pem -out serverreq.pem
openssl x509 -req -in serverreq.pem -sha1 -extfile myopenssl.cnf -extensions usr_cert -CA serverCA.pem -CAkey serverCA.pem -CAcreateserial -out servercert.pem
cat servercert.pem serverkey.pem serverCAcert.pem rootcert.pem > server.pem
openssl x509 -subject -issuer -noout -in server.pem
echo "Creating the client certificate and signing it with the root CA"
openssl req -newkey rsa:1024 -sha1 -keyout clientkey.pem -out clientreq.pem
openssl x509 -req -in clientreq.pem -sha1 -extfile myopenssl.cnf -extensions usr_cert -CA root.pem -CAkey root.pem -CAcreateserial -out clientcert.pem
cat clientcert.pem clientkey.pem rootcert.pem > client.pem
openssl x509 -subject -issuer -noout -in client.pem
echo "creating dh512.pem and dh1024.pem"
openssl dhparam -check -text -5 512 -out dh512.pem
openssl dhparam -check -text -5 1024 -out dh1024.pem
echo "Making new keys which do not require passkey"
echo "Creating no passkey server key"
openssl rsa -in server.pem -out serverNOKEY.pem
openssl x509 -in server.pem >>serverNOKEY.pem
echo "serverNOKEY.pem created"
echo "Creating no passkey client key"
openssl rsa -in client.pem -out clientNOKEY.pem
openssl x509 -in client.pem >>clientNOKEY.pem
echo "clientNOKEY.pem created"
echo "Done! Success!"
最佳答案
当我在 Java 应用程序之间设置 SSL 通信时,我遇到了类似的问题。要确定它是代码问题还是证书问题本身,您可以在 openssl 命令下运行。如果证书未得到验证,则表示使用根 CA 验证证书时存在问题。
Verify a certificate
openssl verify certificate_name
此外,由于您似乎正在处理自签名证书,因此您可以关闭代码中的证书验证并继续。在证书颁发机构 (CA) 签署证书的生产环境中,此类错误不太可能出现。
关于c - OpenSSL 错误 : unable to verify the first certificate,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/38900888/
这个问题在这里已经有了答案: android studio adb Syntax error: ")" unexpected (4 个答案) 关闭 5 年前。 我确实将我的工作室更新到 Linux
当我打开 Android Studio 时,它会显示下面的对话框,我的应用程序无法以 Debug模式运行。 最佳答案 找到sdk->platform-tool文件夹,然后运行命令adb tcpip 5
我在 Fedora 33 机器上使用了 VSCode (1.52.1) 一段时间。 我正在使用 Docker 扩展 (v1.9.0) 但由于某种原因,在过去几天中,当我尝试将 VSCode 附加到 D
我正在尝试为我的任务加载一个名为“tr_model.h5”的预训练模型,但出现以下错误: Traceback (most recent call last): File "Trigger_Proje
我最近在 Google Play 中发布了一个 Android 应用程序,到目前为止一切看起来都很棒,但有一个异常(exception)(见下文),我有时会收到控制台崩溃的消息,它只发生在某些用户身上
单击警告时,我收到此消息。这是案件的截图。 错误写道, Unable to open 'warning.cpp': Unable to read file '/Users/dimen/code/C++
重新编译 php 后,当我使用 php cli 时出现以下错误: PHP Warning: PHP Startup: imap: Unable to initialize module Module
使用 git 1.6.4.2,当我尝试 git pull 时出现此错误: error: unable to resolve reference refs/remotes/origin/LT558-op
我是 Kotlin 的新手,我正在学习教程。运行我的应用程序会导致它在运行时崩溃。我在底部导航栏应用程序中有三个 fragment 和一个主要 Activity 。我的目标实际上只是成功运行该应用程序
我在 Windows 10 64 位上运行 Android Studio。我在 5 月 20 日早上升级到了最新的版本和 SDK,从那时起,我在打开 Android Studio 时收到上述错误。我还
因此,我创建了一个 GitHub 操作,该操作应该在发生推送时构建 docker 镜像并将其推送到 docker hub。所以这是我的 GitHub 操作:(第一次创建 GitHub 操作) name
当这些问题中的任何一个都没有帮助我时,这意味着我需要删除并重新安装 Android Studio。 这是错误: Error initializing ADB: Unable to create Deb
Iam running the latest OSX/Flutter/XCode Versions using flutter, android studio and firebase and
我最近重新安装了 ubuntu 20.04.3,在做了一些设置后,我现在在运行 apt update 时总是收到以下错误.我一定是不小心删除了某种缓存文件或目录,但我不知道如何诊断或解决这个问题。 任
今天,当我将更改推送到 Gitlab 中的代码存储库时,我才开始在 Gitlab 中收到此错误消息。 Gitlab fatal: unable to access '.......' SSL Cert
我正在使用 Protractor 和 Jasmine 。 我已经确定了 chrome 驱动程序版本:2.32.498550 (latest)与 Chrome 测试版不兼容 (Version 62.0.
我正在尝试使用 terraform (0.12.24) 和多个 Docker 提供程序(插件版本 2.7.0)执行简单部署。我使用下面的 Terraform 模板的目的是将两个不同的容器部署到两个不同
这个问题我看了很久,最后决定在这里提出来。我需要维护一些用 Delphi 2007 for .NET (ASP.NET 2.0) 编写的应用程序。通常,第一次运行应用程序(使用 IIS)时,我会收到经
如何修复 - 无法创建调试桥:无法启动 adb 服务器:无法检测 adb 版本,adb 输出:/home/dilip/Downloads/sdk/platform-tools/adb: 1:/home
通过命令提示符连接到 android 中的 Sqlite DB 时出现错误。 以下是我遵循的步骤: 我已经在 android 中通过 java 程序创建了 Sqlite 数据库。创建表并向其中插入数据
我是一名优秀的程序员,十分优秀!