verifying the signature of x509

While verifying the certificate I am getting

EVP_F_EVP_PKEY_GET1_DH

My Aim - Verify the certificate signature. I am having 2 certificates : 1. a CA certificate 2. certificate issued by CA. I extracted the 'RSA Public Key (key)' Modulus From CA Certificate using,

pPublicKey = X509_get_pubkey(x509);
buf_len = (size_t) BN_num_bytes (bn);
key = (unsigned char *)malloc (buf_len);
n = BN_bn2bin (bn, (unsigned char *) key);
if (n != buf_len)
    LOG(ERROR," : key error\n");
if (key[0] & 0x80)
    LOG(DEBUG, "00\n");

Now, I have CA public key & CA key length and also having certificate issued by CA in buffer, buffer length & public key. To verify the signature, I have following code

int iRet1, iRet2, iRet3, iReason;

iRet1 = EVP_VerifyInit(&md_ctx, EVP_sha1());
iRet2 = EVP_VerifyUpdate(&md_ctx, buf, buflen);
iRet3 = EVP_VerifyFinal(&am开发者_运维百科p;md_ctx, (const unsigned char *)CAkey, CAkeyLen, pubkey);
iReason = ERR_get_error();
if(ERR_GET_REASON(iReason) == EVP_F_EVP_PKEY_GET1_DH)
{
    LOG(ERROR, "EVP_F_EVP_PKEY_GET1_DH\n");
}
LOG(INFO,"EVP_VerifyInit returned %d : EVP_VerifyUpdate returned %d : EVP_VerifyFinal = %d \n", iRet1, iRet2, iRet3);

EVP_MD_CTX_cleanup(&md_ctx);
EVP_PKEY_free(pubkey);
if (iRet3 != 1)
{
    LOG(ERROR,"EVP_VerifyFinal() failed\n");
    ret = -1;
}
LOG(INFO,"signature is valid\n");

I am unable to figure out What might went wrong??? Please if anybody faced same issues? What EVP_F_EVP_PKEY_GET1_DH Error means?

Thanks in Advance - opensid

X509 certificates aren't signed using the same method as OpenSSL's envelope encryption functions, so EVP_* is the wrong tool for the job.

The right function is just X509_verify(x509, X509_get_pubkey(x509)) (for a self-signed certificate).

This is the way I do to verify a certificate:

I have the certificate stored locally on my computer, I loaded it and then I verify it against itself as in my case it is a self signed certificate. If you have a root CA and a certificate signed with this Root certificate it should work the same way.

int verify_certificate(const char* certfile, const char* CAfile)
{
    int ret=0;
    X509_STORE *cert_ctx=NULL;
    X509_LOOKUP *lookup=NULL;

    cert_ctx=X509_STORE_new();
    if (cert_ctx == NULL) goto end;

    OpenSSL_add_all_algorithms();

    lookup=X509_STORE_add_lookup(cert_ctx,X509_LOOKUP_file());
    if (lookup == NULL)
        goto end;

    if(!X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM))
        goto end;

    lookup=X509_STORE_add_lookup(cert_ctx,X509_LOOKUP_hash_dir());
    if (lookup == NULL)
        goto end;

    X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT);

    ret = check(cert_ctx, certfile);
end:
    if (cert_ctx != NULL) X509_STORE_free(cert_ctx);

    return ret;
}

X509 *load_cert(const char *file)
{
    X509 *x=NULL;
    BIO *cert;

    if ((cert=BIO_new(BIO_s_file())) == NULL)
        goto end;

    if (BIO_read_filename(cert,file) <= 0)
        goto end;

    x=PEM_read_bio_X509_AUX(cert,NULL, NULL, NULL);
end:
    if (cert != NULL) BIO_free(cert);
    return(x);
}

int check(X509_STORE *ctx, const char *file)
{
    X509 *x=NULL;
    int i=0,ret=0;
    X509_STORE_CTX *csc;

    x = load_cert(file);
    if (x == NULL)
        goto end;

    csc = X509_STORE_CTX_new();
    if (csc == NULL)
        goto end;
    X509_STORE_set_flags(ctx, 0);
    if(!X509_STORE_CTX_init(csc,ctx,x,0))
        goto end;
    i=X509_verify_cert(csc);
    X509_STORE_CTX_free(csc);

    ret=0;
end:
    ret = (i > 0);
    if (x != NULL)
        X509_free(x);

    return(ret);
}

All you have to do is to implement these 3 functions, and then call the:

int verify_certificate(const char* certfile, const char* CAfile)

Hope it helps. Best Regards