openssl - 带有证书链的 SSL_CTX_set_client_cert_cb

Question

OpenSSL Doc 说:client_cert_cb() 不能返回完整的证书链，它只能返回一个客户端证书。

在我的例子中，我想返回/设置证书链，但不知道它是如何实现的。任何示例如何做将不胜感激？？？

Answer 1

在 OpenSSL 的手册页中 SSL_CTX_set_client_cert_cb命令，它说，正如您在问题中所说，client_cert_cb() 无法返回完整的证书链，但它也说明了该问题的解决方法:

BUGS

The client_cert_cb() cannot return a complete certificate chain, it can only return one client certificate. If the chain only has a length of 2, the root CA certificate may be omitted according to the TLS standard and thus a standard conforming answer can be sent to the server. For a longer chain, the client must send the complete chain (with the option to leave out the root CA certificate). This can only be accomplished by either adding the intermediate CA certificates into the trusted certificate store for the SSL_CTX object (resulting in having to add CA certificates that otherwise maybe would not be trusted), or by adding the chain certificates using the SSL_CTX_add_extra_chain_cert function, which is only available for the SSL_CTX object as a whole and that therefore probably can only apply for one client certificate, making the concept of the callback function (to allow the choice from several certificates) questionable.

这是否适用于您的情况？

---

编辑

您可以使用 SSL_CTX_add_extra_chain_cert 添加链证书功能。请注意，正如引文中所述，您不必发送根 CA 证书。