【Qt】x509证书操作之加载证书

Qt提供QSslCertificate实现对x509证书的一些基本操作，如获取证书的信息、证书格式转化、证书验证等，搭配QSslSocket实现ssl通信，所以提供的功能不多

证书加载

首先pro文件添加network模块

QT       += network

QSslCertificate构造函数支持QIODevice的文件描述符和QByteArray证书内容的传参，QIODevice需要是打开状态，处于可以被读取的状态

证书格式为der或pem，格式需对应才能解析

explicit QSslCertificate(QIODevice *device, QSsl::EncodingFormat format = QSsl::Pem);
explicit QSslCertificate(const QByteArray &data = QByteArray(), QSsl::EncodingFormat format = QSsl::Pem);

通过以下代码可实现pem和der证书的加载，通过isNull()判断证书是否加载成功，以pem的方式加载失败再使用der的方式

加载某个路径下所有的证书

static QList<QSslCertificate> fromPath(
        const QString &path, QSsl::EncodingFormat format = QSsl::Pem,
        QRegExp::PatternSyntax syntax = QRegExp::FixedString);

加载所有证书

    static QList<QSslCertificate> fromDevice(
        QIODevice *device, QSsl::EncodingFormat format = QSsl::Pem);
    static QList<QSslCertificate> fromData(
        const QByteArray &data, QSsl::EncodingFormat format = QSsl::Pem);

加载device和data所包含的所有证书，如多个证书放在一起，但不支持加载p7b格式

加载pfx证书

pfx证书包含多个证书和私钥，加载pfx证书可获取到当前证书和对应的私钥，还有相关的其他证书

static bool importPkcs12(QIODevice *device,
                             QSslKey *key, QSslCertificate *cert,
                             QList<QSslCertificate> *caCertificates = nullptr,
                             const QByteArray &passPhrase=QByteArray());

• device——文件描述符，文件处于打开状态
• key——返回的私钥
• cert——返回的证书
• caCertificate——包含的其他的证书
• passPhrase——秘钥（如果需要）

    QFile file1("D:/cert-test/test1.pfx");
    if(!file1.open(QIODevice::ReadOnly)) {
        return;
    }
    QSslKey priKey;
    QSslCertificate cert;
    QList<QSslCertificate> certList;
    int ret = QSslCertificate::importPkcs12(&file1, &priKey, &cert, &certList, "123456");
    qDebug() << __FUNCTION__ << "song" << ret << cert.serialNumber() << priKey.algorithm();

证书格式转换

QSslCertificate支持导出DER和PEM格式数据

QByteArray toPem() const;
QByteArray toDer() const;

DER格式为二进制数据，证书是以ASN1格式进行存储，DER为ASN1数据的表现形式

PEM为Base64编码格式，通过对DER进行Base64编码，再辅以头“-----BEGIN CERTIFICATE-----”和尾“-----BEGIN CERTIFICATE-----”，我们可以通过Base64进行编解码实现DER和PEM格式的转换，有兴趣的同学可以自行尝试

PEM证书文件可通过文本文件查看的方式进行打开，以下就是一个PEM格式的证书

-----BEGIN CERTIFICATE-----
MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG
A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv
b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw
MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i
YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT
aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ
jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp
xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp
1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG
snUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ
U26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8
9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E
BTADAQH/MB0GA1UdDgQWBBRge2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0B
AQUFAAOCAQEA1nPnfE920I2/7LqivjTFKDK1fPxsnCwrvQmeU79rXqoRSLblCKOz
yj1hTdNGCbM+w6DjY1Ub8rrvrTnhQ7k4o+YviiY776BQVvnGCv04zcQLcFGUl5gE
38NflNUVyRRBnMRddWQVDf9VMOyGj/8N7yy5Y0b2qvzfvGn9LhJIZJrglfCm7ymP
AbEVtQwdpf5pLGkkeB6zpxxxYu7KyJesF12KwvhHhm4qxFYxldBniYUr+WymXUad
DKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME
HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==
-----END CERTIFICATE-----

QSslCertificate文本数据展示

QString toText() const;

即ASN1数据对应的文本显示，生成的数据如下，所有的证书内容都罗列了出来

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:50:32:8d:d5:ad:a9:ff:af:fe:91:a1:27:98:0d:6e
        Signature Algorithm: 1.2.156.10197.1.501
        Issuer: C=CN, O=WoTrus CA Limited, CN=WoTrus Test SM2 Client CA
        Validity
            Not Before: Mar 23 07:45:34 2020 GMT
            Not After : May 23 07:45:34 2022 GMT
        Subject: C=CN, ST=\xE5\xB9\xBF\xE4\xB8\x9C\xE7\x9C\x81, L=\xE6\xB7\xB1\xE5\x9C\xB3\xE5\xB8\x82, O=WoTrus, CN=\xE6\xB5\x8B\xE8\xAF\x95
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:53:27:94:b6:d9:1b:9d:14:03:f8:fb:95:87:26:
                    83:a1:42:ba:57:1e:ab:0b:f8:54:a4:24:48:24:17:
                    4a:ba:dc:56:79:21:54:1d:1d:57:33:ad:87:e7:ae:
                    7c:ce:d4:4e:22:1f:37:70:84:32:2c:48:bf:11:82:
                    7f:ec:0e:0b:b1
                ASN1 OID: SM2
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, E-mail Protection
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Subject Key Identifier: 
                79:F7:DB:4A:DC:82:DD:CE:90:13:85:DA:8A:34:E2:7B:AB:55:CF:51
            X509v3 Authority Key Identifier: 
                keyid:B6:BB:C1:5A:A0:F3:5A:2B:61:CC:6F:1B:88:FF:26:9D:32:31:15:5D

            Authority Information Access: 
                OCSP - URI:http://ocsp.ims.cn
                CA Issuers - URI:http://aia.ims.cn/sm2c.cer

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.ims.cn/sm2c.crl

            X509v3 Certificate Policies: 
                Policy: 1.2.156.150570.2.9
                Policy: 1.2.156.150570.13
                Policy: 1.2.156.150570.8.5.3
                  CPS: http://www.ims.cn/policy/

    Signature Algorithm: 1.2.156.10197.1.501
         30:45:02:21:00:97:39:88:56:3a:9b:b9:f1:21:40:b5:35:16:
         8e:8d:74:b3:01:24:11:2b:35:54:74:0a:78:b1:6b:82:74:07:
         a3:02:20:47:f5:cb:77:46:0c:96:21:8d:47:71:30:14:31:1c:
         b7:93:f8:8d:4c:90:ff:cf:48:cd:ec:fc:bd:c2:8d:c2:1d

可以通过该接口简略的显示证书内容