Qt提供QSslCertificate实现对x509证书的一些基本操作,如获取证书的信息、证书格式转化、证书验证等,搭配QSslSocket实现ssl通信,所以提供的功能不多
证书加载
首先pro文件添加network模块
QT += network
QSslCertificate构造函数支持QIODevice的文件描述符和QByteArray证书内容的传参,QIODevice需要是打开状态,处于可以被读取的状态
证书格式为der或pem,格式需对应才能解析
explicit QSslCertificate(QIODevice *device, QSsl::EncodingFormat format = QSsl::Pem);
explicit QSslCertificate(const QByteArray &data = QByteArray(), QSsl::EncodingFormat format = QSsl::Pem);
通过以下代码可实现pem和der证书的加载,通过isNull()判断证书是否加载成功,以pem的方式加载失败再使用der的方式
加载某个路径下所有的证书
static QList<QSslCertificate> fromPath(
const QString &path, QSsl::EncodingFormat format = QSsl::Pem,
QRegExp::PatternSyntax syntax = QRegExp::FixedString);
加载所有证书
static QList<QSslCertificate> fromDevice(
QIODevice *device, QSsl::EncodingFormat format = QSsl::Pem);
static QList<QSslCertificate> fromData(
const QByteArray &data, QSsl::EncodingFormat format = QSsl::Pem);
加载device和data所包含的所有证书,如多个证书放在一起,但不支持加载p7b格式
加载pfx证书
pfx证书包含多个证书和私钥,加载pfx证书可获取到当前证书和对应的私钥,还有相关的其他证书
static bool importPkcs12(QIODevice *device,
QSslKey *key, QSslCertificate *cert,
QList<QSslCertificate> *caCertificates = nullptr,
const QByteArray &passPhrase=QByteArray());
- device——文件描述符,文件处于打开状态
- key——返回的私钥
- cert——返回的证书
- caCertificate——包含的其他的证书
- passPhrase——秘钥(如果需要)
QFile file1("D:/cert-test/test1.pfx");
if(!file1.open(QIODevice::ReadOnly)) {
return;
}
QSslKey priKey;
QSslCertificate cert;
QList<QSslCertificate> certList;
int ret = QSslCertificate::importPkcs12(&file1, &priKey, &cert, &certList, "123456");
qDebug() << __FUNCTION__ << "song" << ret << cert.serialNumber() << priKey.algorithm();
证书格式转换
QSslCertificate支持导出DER和PEM格式数据
QByteArray toPem() const;
QByteArray toDer() const;
DER格式为二进制数据,证书是以ASN1格式进行存储,DER为ASN1数据的表现形式
PEM为Base64编码格式,通过对DER进行Base64编码,再辅以头“-----BEGIN CERTIFICATE-----”和尾“-----BEGIN CERTIFICATE-----”,我们可以通过Base64进行编解码实现DER和PEM格式的转换,有兴趣的同学可以自行尝试
PEM证书文件可通过文本文件查看的方式进行打开,以下就是一个PEM格式的证书
-----BEGIN CERTIFICATE-----
MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG
A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv
b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw
MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i
YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT
aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ
jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp
xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp
1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG
snUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ
U26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8
9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E
BTADAQH/MB0GA1UdDgQWBBRge2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0B
AQUFAAOCAQEA1nPnfE920I2/7LqivjTFKDK1fPxsnCwrvQmeU79rXqoRSLblCKOz
yj1hTdNGCbM+w6DjY1Ub8rrvrTnhQ7k4o+YviiY776BQVvnGCv04zcQLcFGUl5gE
38NflNUVyRRBnMRddWQVDf9VMOyGj/8N7yy5Y0b2qvzfvGn9LhJIZJrglfCm7ymP
AbEVtQwdpf5pLGkkeB6zpxxxYu7KyJesF12KwvhHhm4qxFYxldBniYUr+WymXUad
DKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME
HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==
-----END CERTIFICATE-----
QSslCertificate文本数据展示
QString toText() const;
即ASN1数据对应的文本显示,生成的数据如下,所有的证书内容都罗列了出来
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
22:50:32:8d:d5:ad:a9:ff:af:fe:91:a1:27:98:0d:6e
Signature Algorithm: 1.2.156.10197.1.501
Issuer: C=CN, O=WoTrus CA Limited, CN=WoTrus Test SM2 Client CA
Validity
Not Before: Mar 23 07:45:34 2020 GMT
Not After : May 23 07:45:34 2022 GMT
Subject: C=CN, ST=\xE5\xB9\xBF\xE4\xB8\x9C\xE7\x9C\x81, L=\xE6\xB7\xB1\xE5\x9C\xB3\xE5\xB8\x82, O=WoTrus, CN=\xE6\xB5\x8B\xE8\xAF\x95
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
pub:
04:53:27:94:b6:d9:1b:9d:14:03:f8:fb:95:87:26:
83:a1:42:ba:57:1e:ab:0b:f8:54:a4:24:48:24:17:
4a:ba:dc:56:79:21:54:1d:1d:57:33:ad:87:e7:ae:
7c:ce:d4:4e:22:1f:37:70:84:32:2c:48:bf:11:82:
7f:ec:0e:0b:b1
ASN1 OID: SM2
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature, Non Repudiation
X509v3 Extended Key Usage:
TLS Web Client Authentication, E-mail Protection
X509v3 Basic Constraints:
CA:FALSE
X509v3 Subject Key Identifier:
79:F7:DB:4A:DC:82:DD:CE:90:13:85:DA:8A:34:E2:7B:AB:55:CF:51
X509v3 Authority Key Identifier:
keyid:B6:BB:C1:5A:A0:F3:5A:2B:61:CC:6F:1B:88:FF:26:9D:32:31:15:5D
Authority Information Access:
OCSP - URI:http://ocsp.ims.cn
CA Issuers - URI:http://aia.ims.cn/sm2c.cer
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.ims.cn/sm2c.crl
X509v3 Certificate Policies:
Policy: 1.2.156.150570.2.9
Policy: 1.2.156.150570.13
Policy: 1.2.156.150570.8.5.3
CPS: http://www.ims.cn/policy/
Signature Algorithm: 1.2.156.10197.1.501
30:45:02:21:00:97:39:88:56:3a:9b:b9:f1:21:40:b5:35:16:
8e:8d:74:b3:01:24:11:2b:35:54:74:0a:78:b1:6b:82:74:07:
a3:02:20:47:f5:cb:77:46:0c:96:21:8d:47:71:30:14:31:1c:
b7:93:f8:8d:4c:90:ff:cf:48:cd:ec:fc:bd:c2:8d:c2:1d
可以通过该接口简略的显示证书内容