CODEWITHSUNDEEP
securitysocketsvisual-c++opensslssl-certificate
Pooven
Pooven

Reputation: 1764

Listing the certificate chain provided by a server on SSL_connect

I'm new to security so some of the terms might be used incorrectly:

I would like to view the certificates returned by the server to verify that I'm getting back the entire certificate chain. Here's what I've tried:

Consider:

STACK_OF(X509)* certificateChain = SSL_get_peer_cert_chain(ssl);
while (char* stackCertificate = sk_pop(certificateChain))
{
  X509* certificate = (X509*)stackCertificate;
}

Is this the correct way to get the certificate chain? Is my understanding of the situation correct? Is there perhaps a better way to do this?

Thank you for your time and contribution.

Upvotes: 2

Views: 913

Answers (1)

Pooven
Pooven

Reputation: 1764

The following code snippet is based off code in s_client:

SSL* ssl = ...;
STACK_OF(X509)* certCollection = SSL_get_peer_cert_chain(ssl);
for (size_t i = 0; i < sk_X509_num(certCollection); i++)
{
  X509* cert = sk_X509_value(certCollection, i);
  ...
}

As far as I understand, an SSL session must have been created otherwise SSL_get_peer_cert_chain will return null. Additionally I haven't found any evidence to contradict the list I noted in my question.

Perhaps an easier alternative would be to use the command line tool (downloaded from here):

openssl s_client -connect {server}:{port} -ssl3

Upvotes: 2

Related Questions