c - 从内存加载检查证书

Question

我想用任何其他从内存加载证书的函数替换SSL_CTX_verify_locations(X509, "cert.pem", 0)函数，我尝试过

X509_STORE* store = X509_STORE_new();
X509* temp;
BIO* mem;
unsigned char CAPEM[] = {0x13, ..., ...};
store = SSL_CTX_get_cert_store(SSL_CONTEXT)
mem = BIO_new_mem_buf((void*)CAPEM, sizeof(CAPEM));
PEM_read_bio_X509(mem, &temp, 0, 0)
X509_STORE_add_cert(store, temp)
SSL_CTX_set_verify(SSL_CONTEXT, SSL_VERIFY_PEER, 0);

和

SSL_CTX_add_extra_chain_cert(SSL_CONTEXT, temp)

我正在使用 openssl 1.0.2，谢谢

Answer 1

您首先需要使用 X509_STORE_new() 创建证书存储，然后使用 X509_STORE_add_cert() 添加证书