openssl - 从 "otherName"证书扩展中读取 "subjectAltName"值

Question

对于“otherName”的 subjectAltName，OpenSSL 似乎总是显示“不支持”。

写入的字符串(通过 M2Crypto 和直接在命令行通过 openssl.cnf):

1.2.3.4;UTF8:some other identifier

转储(openssl x509 -in test.crt -noout -text):

                c3:88:36:93:82:58:0c:08:7f
            Exponent: 65537 (0x10001)
    X509v3 extensions:
        X509v3 Subject Alternative Name: 
            othername:<unsupported>
Signature Algorithm: sha1WithRSAEncryption
    05:76:d5:fc:d0:44:50:af:39:76:05:b4:cb:b6:99:9f:7c:c0:

通过 OpenSSL 源查找“otherName”，这对我来说很突出(在 v3_alt.c 中):

1:

STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,
                GENERAL_NAME *gen, STACK_OF(CONF_VALUE) *ret)
{
    unsigned char *p;
    char oline[256], htmp[5];
    int i;
    switch (gen->type)
    {
        case GEN_OTHERNAME:
        X509V3_add_value("othername","<unsupported>", &ret);
        break;

        case GEN_X400:
        X509V3_add_value("X400Name","<unsupported>", &ret);
        break;

        case GEN_EDIPARTY:
        X509V3_add_value("EdiPartyName","<unsupported>", &ret);
        break;

2:

int GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen)
{
    unsigned char *p;
    int i;
    switch (gen->type)
    {
        case GEN_OTHERNAME:
        BIO_printf(out, "othername:<unsupported>");
        break;

        case GEN_X400:
        BIO_printf(out, "X400Name:<unsupported>");
        break;

        case GEN_EDIPARTY:
        /* Maybe fix this: it is supported now */
        BIO_printf(out, "EdiPartyName:<unsupported>");
        break;

所以，我愿意打赌，这和我上述尝试中获得的经验知识都意味着我不应该期望“otherName”值将永远通过以下方式正确呈现命令行或库调用。这可能是因为它们是实际的、编码的 ASN.1 字符串。那么，我该怎么做呢？人们如何提取这些值(value)？如果它们是实际的 ASN.1 字符串，是否由开发人员对其进行解码？

Answer 1

确实，命令行实用程序不以有意义的方式支持 subjectAlternateName (SAN)。但是该库确实支持通过编程来访问这些值。

在我回答您的具体问题之前，请查看 Zakir Durumeric 的 helpful post on OpenSSL certificate parsing .那篇文章提供了许多有用的提示。

这是我在 Linux/OpenSSL 1.0.1h 上测试的完整程序。它演示了如何访问 SAN 中的用户主体名称 (UPN)。 UPN 的 OID 是 1.3.6.1.4.1.311.20.2.3。如果您需要找到不同的 OID，请添加您自己对 OBJ_create 的调用，如下所示。

#include <stdio.h>
#include <stdlib.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>

static const unsigned char test_cert_der[] = {
    /* hex bytes of a cert in DER format */
};

int main() {
    /* In this example, we're looking for the Microsoft UPN, which is present
     * in X.509v3 certificates suitable for certificate-based authentication.
     */
    int upn_nid = OBJ_create("1.3.6.1.4.1.311.20.2.3", "UPN", "userPrincipleName");

    const unsigned char* in = test_cert_der;
    X509 *cert = d2i_X509(NULL, &in, sizeof(test_cert_der));
    if (cert == NULL) {
        printf("Error\n");
        return 1;
    }
    int version = ((int) X509_get_version(cert)) + 1;
    if (version < 3) {
        printf("Not a version 3 or later certificate.\n");
        return 1;
    }
    /* Now, we can look at the extensions. These are already parsed into an internal
     * format, a result of the call to d2i_X509(). We just need to loop through them,
     * looking for the SAN.
     */
    X509_EXTENSION *ext;
    int next = X509_get_ext_count(cert);
    int i;
    for (i=0; i < next; i++) {
        ext = X509_get_ext(cert, i);
        if (OBJ_obj2nid(ext->object) == NID_subject_alt_name) {
            /* OK, we found the SAN. Now parse its value as a stack of general names.
             */
            in = ext->value->data;
            GENERAL_NAMES *names = d2i_GENERAL_NAMES(NULL, &in, ext->value->length);
            if (names == NULL) {
                printf("GENERAL_NAMES not found\n");
                continue;
            }
            int nbr_of_names = sk_GENERAL_NAME_num(names);
            int j, nid;
            char *astr;
            for (j=0; j<nbr_of_names; j++) {
                /* Each general name has an implicit context tag that identifies its
                 * type.
                 */
                const GENERAL_NAME *current_name = sk_GENERAL_NAME_value(names, j);
                if (current_name == NULL) {
                    continue;
                }
                switch (current_name->type) {
                    case GEN_OTHERNAME:
                        /* Is this a UPN? */
                        nid = OBJ_obj2nid(current_name->d.otherName->type_id);
                        if (nid == upn_nid) {
                            astr = (char*)ASN1_STRING_data(current_name->d.otherName->
                                    value->value.asn1_string);
                        } else {
                            /* TODO: add support for other OIDs here. */
                            astr = "GEN_OTHERNAME";
                        }
                        break;
                    case GEN_EMAIL:
                        astr = (char*)ASN1_STRING_data(current_name->d.rfc822Name);
                        break;
                    case GEN_DNS:
                        astr = (char*)ASN1_STRING_data(current_name->d.dNSName);
                        break;
                    case GEN_X400:
                        /* TODO: add support for X400 names here. */
                        astr = "GEN_X400";
                        break;
                    case GEN_DIRNAME:
                        /* TODO: add support for directory names here. */
                        astr = "GEN_DIRNAME";
                        break;
                    case GEN_EDIPARTY:
                        /* TODO: add support for EDI party names here. */
                        astr = "GEN_EDIPARTY";
                        break;
                    case GEN_URI:
                        astr = (char*)ASN1_STRING_data(current_name->d.uniformResourceIdentifier);
                        break;
                    case GEN_IPADD:
                        /* TODO: add support for IP addresses here. */
                        astr = "GEN_IPADD";
                        break;
                    case GEN_RID:
                        /* TODO: add support for registered IDs here. */
                        astr = "GEN_RID";
                        break;
                    default:
                        astr = "Unknown name type";
                        break;
                }
                printf("name #%d: %s\n", j, astr);
            }
            GENERAL_NAMES_free(names);
        }
    }
    X509_free(cert);
    /* free any resources consumed by call(s) to OBJ_create */
    OBJ_cleanup();
    return 0;
}