openssl demo1

最新推荐文章于 2024-02-01 12:43:44 发布

大头石

最新推荐文章于 2024-02-01 12:43:44 发布

阅读量565

点赞数

分类专栏： openssl 文章标签： openssl cert demo

openssl 专栏收录该内容

0 篇文章 0 订阅

订阅专栏

#define sprintf_s sprintf

#include "stdafx.h"

#include <LOCALE.H>

#include "ca.h"

#include <OPENSSL pem.h>

#include <OPENSSL x509.h>

#include <OPENSSL x509v3.h>

#include <OPENSSL pkcs12.h>

#include <OPENSSL rand.h>

#include <STDLIB.H>

#include <STDIO.H>

#include <OPENSSL engine.h>

#define EXT_COPY_NONE 0

#define EXT_COPY_ADD 1

#define EXT_COPY_ALL 2

BOOL APIENTRY DllMain( HANDLE hModule,

DWORD ul_reason_for_call,

LPVOID lpReserved

)

{

return TRUE;

}

/*此函数可以将DER、PEM、P12文件公钥读出来*/

X509 *load_cert(BIO *cert/*输入BIO*/, int format/*格式*/,char * pwd,/*P12密码*/

char * outMsg) //从DER、PEM、P12格式中读取公钥证书

{

X509 * x=NULL;

if (format == DER)

x=d2i_X509_bio(cert,NULL);

else if (format == PEM)

x=PEM_read_bio_X509(cert,NULL,NULL,NULL);//PEM_read_bio_X509_AUX

else if (format == P12)

{

PKCS12 *p12 = d2i_PKCS12_bio(cert, NULL);

PKCS12_parse(p12, pwd, NULL, &x, NULL);

PKCS12_free(p12);

p12 = NULL;

}

else

{

sprintf_s(outMsg,"bad input format specified for input cert\n");

goto end;

}

end:

if (x == NULL)

{

sprintf(outMsg,"unable to load certificate\n");

}

return(x);

}

X509 * LoadCert(char * cert,int certlen,char * outMsg)//枚举DER/PEM格式

{

BIO * in=NULL;

X509 * x509=NULL;

if(certlen==0)//输入为磁盘文件

{

if((in=BIO_new_file(cert, "r")) == NULL)

{

sprintf(outMsg,"open CA certificate file error");

return NULL;

}

else//输入为内存中文件

{

if((in=BIO_new_mem_buf(cert,certlen))== NULL)//只读类型

{

sprintf(outMsg,"Make Mem Bio Error");

return NULL;

}

if((x509=load_cert(in,DER,NULL,outMsg))==NULL)//尝试DER

{

BIO_reset(in);//恢复bio

x509=load_cert(in,PEM,NULL,outMsg);//尝试PEM

}

if (in != NULL) BIO_free(in);

return x509;

}

EVP_PKEY *load_key(BIO *bio, int format, char *pass,char * outMsg)//枚举DER/PEM格式

{

EVP_PKEY *pkey=NULL;

if (format == DER)

{

pkey=d2i_PrivateKey_bio(bio, NULL);

}

else if (format == PEM)

{

pkey=PEM_read_bio_PrivateKey(bio,NULL,NULL,pass);

}

else if (format == P12)

{

PKCS12 *p12 = d2i_PKCS12_bio(bio, NULL);

PKCS12_parse(p12, pass, &pkey, NULL, NULL);

PKCS12_free(p12);

p12 = NULL;

}

else

{

sprintf(outMsg,"bad input format specified for key\n");

goto end;

}

end:

if (pkey == NULL)

sprintf(outMsg,"unable to load Private Key\n");

return(pkey);

}

EVP_PKEY * LoadKey(char * key,int keylen,char * pass,char * outMsg)

{

EVP_PKEY *pkey=NULL;

BIO * in=NULL;

if(keylen==0)//输入为磁盘文件

{

if((in=BIO_new_file(key, "r")) == NULL)

{

sprintf(outMsg,"open CA certificate file error");

return NULL;

}

else//输入为内存中文件

{

if((in=BIO_new_mem_buf(key,keylen))== NULL)//只读类型

{

sprintf(outMsg,"Make Mem Bio Error");

return NULL;

}

if((pkey=load_key(in,DER,pass,outMsg))==NULL)//尝试DER

{

BIO_reset(in);//BIO是可读写的，那么该BIO所有数据都会被清空；

//如果该BIO是只读的，那么该操作只会简单将指

//针指向原始位置，里面的数据可以再读.

pkey=load_key(in,PEM,pass,outMsg);//尝试PEM

}

if (in != NULL) BIO_free(in);

return pkey;

}

int Rand(const char *file,int dont_warn,char * outMsg)//产生随机数,return 0 ---成功

{

int consider_randfile = (file == NULL);

char buffer[200];

RAND_screen();

if (file == NULL)

file = RAND_file_name(buffer, sizeof buffer);

else if (RAND_egd(file) > 0)

{

/* we try if the given filename is an EGD socket.

if it is, we don't write anything back to the file. */

return 1;

}

if (file == NULL || !RAND_load_file(file, -1))

{

if (RAND_status() == 0 && !dont_warn)

{

sprintf(outMsg,"unable to load 'random state'\n");

sprintf(outMsg,"This means that the random number generator has not been seeded\n");

if (consider_randfile) /* explanation does not apply when a file is explicitly named */

{

sprintf(outMsg,"Consider setting the RANDFILE environment variable to point at a file that\n");

sprintf(outMsg,"'random' data can be kept in (the file will be overwritten).\n");

}

return 0;

}

return 1;

}

/ end

/ begin //

/* Add extension using V3 code: we can set the config file as NULL

* because we wont reference any other sections.

int Add_ExtCert(X509 *cert/*正被添加的证书*/,X509 * root/*根证书（从中得到信息)*/, int nid, char *value)

{

X509_EXTENSION *ex;

X509V3_CTX ctx;

/* This sets the 'context' of the extensions. */

/* No configuration database */

// X509V3_set_ctx_nodb(&ctx);

/* Issuer and subject certs: both the target since it is self signed,

* no request and no CRL

X509V3_set_ctx(&ctx,root, cert, NULL, NULL, 0);

ex = X509V3_EXT_conf_nid(NULL, &ctx, nid, value);

if (!ex)

return 0;

X509_add_ext(cert,ex,-1);

X509_EXTENSION_free(ex);

return 1;

}

bool Add_Name(X509_NAME * x509name,int type/*c\cn*/,char * iput/*中国*/,

int ilen/*输入长度*/,char * outMsg)//支持中文名称

{

wchar_t * ws,wc;

ASN1_STRING stmp, *str = &stmp;

UCHAR cbuf[256]={0};

int wslen, wcnt,i;

char input[256]={0};

strncpy(input, iput, ilen);

wslen = strlen(input) + 1;

if(wslen==1)

return true;

ws =new unsigned short[sizeof(wchar_t) * wslen];

if ((wcnt = mbstowcs(ws, input, wslen)) == -1)

{

sprintf(outMsg,"mbstowcs convert error");

delete ws;

return false;

}

for(i=0;i<(int)wcslen(ws);i++)

{

wc=ws[i];

cbuf[2*i]=wc/256;

cbuf[2*i+1]=wc%256;

}

ASN1_mbstring_copy(&str, cbuf, 2*wslen, MBSTRING_BMP, B_ASN1_UTF8STRING);

X509_NAME_add_entry_by_NID(x509name,type,V_ASN1_UTF8STRING,stmp.data,stmp.length, -1, 0);

delete ws;

return true;

}

bool mkRoot(stuSUBJECT * rootInfo,X509 **x509p/*out公钥*/, EVP_PKEY **pkeyp/*out私钥*/,

int bits/*位数*/, int serial/*序列号*/, int days/*有效期*/,char * out/*操作结果*/)

{

X509 *x;

EVP_PKEY *pk;

RSA *rsa;

X509_NAME *name=NULL;

int i=0,len=0;

if ((pkeyp == NULL) || (*pkeyp == NULL))

{

if ((pk=EVP_PKEY_new()) == NULL)

{

abort();

return false;

}

else

pk= *pkeyp;

if ((x509p == NULL) || (*x509p == NULL))

{

if ((x=X509_new()) == NULL)

goto err;

}

else

x= *x509p;

Rand(NULL,1,out);//产生随机数种子

rsa=RSA_generate_key(bits,RSA_F4,0/*回调函数callback*/,NULL);//产生密钥对,//RSA存储了公钥私钥

if (!EVP_PKEY_assign_RSA(pk,rsa))//完成RSA密钥的pkey结构初始工作,当pk不为NULL的时候，返回1，否则返回0

{

abort();

goto err;

}

rsa=NULL;

X509_set_version(x,2);//版本号，显示+1

ASN1_INTEGER_set(X509_get_serialNumber(x),serial);//序列号

X509_gmtime_adj(X509_get_notBefore(x),0);//起始时间

X509_gmtime_adj(X509_get_notAfter(x),(long)60*60*24*days);//结束时间

X509_set_pubkey(x,pk);//公钥

name=X509_get_subject_name(x);

/* This function creates and adds the entry, working out the

* correct string type and performing checks on its length.

* Normally we'd check the return value for errors

//C-国家,ST-省,L-城市,O-组织,OU-部门,CN-个体,T-title,D-description,G-givenName,I-initials,

//Email-emailAddress,S-surname,SN-serialNumber,dnQualifier-dnQualifier,unstructuredName,challengePassword,unstructuredAddress,

setlocale(LC_CTYPE, "");

Add_Name(name,NID_countryName,(char *)rootInfo->C,sizeof(rootInfo->C),out);

Add_Name(name,NID_stateOrProvinceName,(char *)rootInfo->ST,sizeof(rootInfo->ST),out);

Add_Name(name,NID_localityName,(char *)rootInfo->L,sizeof(rootInfo->L),out);

Add_Name(name,NID_organizationName,(char *)rootInfo->O,sizeof(rootInfo->O),out);

Add_Name(name,NID_organizationalUnitName,(char *)rootInfo->OU,sizeof(rootInfo->OU),out);

Add_Name(name,NID_commonName,(char *)rootInfo->CN,sizeof(rootInfo->CN),out);

Add_Name(name,NID_pkcs9_emailAddress,(char *)rootInfo->MAIL,sizeof(rootInfo->MAIL),out);

Add_Name(name,NID_email_protect,(char *)rootInfo->PMAIL,sizeof(rootInfo->PMAIL),out);

Add_Name(name,NID_title,(char *)rootInfo->T,sizeof(rootInfo->T),out);

Add_Name(name,NID_description,(char *)rootInfo->D,sizeof(rootInfo->D),out);

Add_Name(name,NID_givenName,(char *)rootInfo->G,sizeof(rootInfo->G),out);

Add_Name(name,NID_initials,(char *)rootInfo->I,sizeof(rootInfo->I),out);

Add_Name(name,NID_name,(char *)rootInfo->NAME,sizeof(rootInfo->NAME),out);

Add_Name(name,NID_surname,(char *)rootInfo->S,sizeof(rootInfo->S),out);

Add_Name(name,NID_dnQualifier,(char *)rootInfo->QUAL,sizeof(rootInfo->QUAL),out);

Add_Name(name,NID_pkcs9_unstructuredName,(char *)rootInfo->STN,sizeof(rootInfo->STN),out);

Add_Name(name,NID_pkcs9_challengePassword,(char *)rootInfo->PW,sizeof(rootInfo->PW),out);

Add_Name(name,NID_pkcs9_unstructuredAddress,(char *)rootInfo->ADD,sizeof(rootInfo->ADD),out);

/* Its self signed so set the issuer name to be the same as the

* subject.

X509_set_issuer_name(x,name);//设置发行者名称等同于上面的

//加入扩展信息

/* Add various extensions: standard extensions */

Add_ExtCert(x,x,NID_basic_constraints, "critical,CA:TRUE");

//主题密钥标示符---当发行者有多个签名密钥时

Add_ExtCert(x,x,NID_subject_key_identifier, "hash");

//颁发机构密钥标示符

Add_ExtCert(x,x,NID_authority_key_identifier, "keyid:always");

//密钥用法

Add_ExtCert(x,x,NID_key_usage, "nonRepudiation,digitalSignature,keyEncipherment");

Add_ExtCert(x,x,NID_domainComponent, "no");

Add_ExtCert(x,x,NID_Domain, "no");

/* Some Netscape specific extensions */

// Add_ExtCert(x, NID_netscape_cert_type, "sslCA");

// Add_ExtCert(x, NID_netscape_comment, "example comment extension");//netscape_comment

/* Maybe even add our own extension based on existing */

//加入自定义信息begin

// int nid;

// nid = OBJ_create("1.2.3.4.9", "Hpxs", "I love you!");

// X509V3_EXT_add_alias(nid, NID_netscape_comment);

// Add_ExtCert(x, nid, "I love you");

//加入自定义信息end

X509V3_EXT_cleanup();//cleanup the extension code if any custom extensions have been added

if (!X509_sign(x,pk,EVP_sha1()))//签名算法EVP_sha1,EVP_md5,用私钥签名公钥

{

strcpy(out,"证书签名失败");

goto err;

}

*x509p=x;

*pkeyp=pk;

return true;

err:

return false;

}

BOOL MakeRoot(stuSUBJECT * rootInfo,/*信息*/int bits/*位数*/, int serial/*序列号*/,

int days/*有效期*/,char * certFile/*证书文件*/,char * priFile/*私钥文件*/,

char * outMsg/*操作结果*/,int type/*类型pem-der*/)

{

X509 *x509=NULL;

EVP_PKEY *pkey=NULL;

BIO * bcert=NULL,* bkey=NULL;

bool ret=true;

int i=0,j=0;

if(((bcert=BIO_new_file(certFile, "w"))== NULL)||((bkey=BIO_new_file(priFile, "w")) == NULL))

{

strcpy(outMsg,"Create File Error");

return false;

}

if(mkRoot(rootInfo,&x509,&pkey,bits,serial,days,outMsg))

{

if (type==DER)

{

i=i2d_X509_bio(bcert,x509);//returns 1 for success

j=i2d_PrivateKey_bio(bkey,pkey);

}

else if(type==PEM)

{

i=PEM_write_bio_X509(bcert,x509);

j=PEM_write_bio_PrivateKey(bkey,pkey,NULL,NULL,0,NULL, NULL);

}

if(!i||!j)

{

ret=false;

strcpy(outMsg,"Save Cert or Key File Error");

}

else

ret=false;

BIO_free(bcert);

BIO_free(bkey);

X509_free(x509);

EVP_PKEY_free(pkey);

return ret;

}

/ end

/ begin //

/* Add extension using V3 code: we can set the config file as NULL

* because we wont reference any other sections.

int Add_ExtReq(STACK_OF(X509_REQUEST) *sk, int nid, char *value)

{

X509_EXTENSION *ex;

ex = X509V3_EXT_conf_nid(NULL, NULL, nid, value);

if (!ex)

return 0;

sk_X509_EXTENSION_push(sk, ex);

return 1;

}

int mkReq(stuSUBJECT * reqInfo,X509_REQ **req, EVP_PKEY **pkeyp, int bits,char * out)

{

X509_REQ *x;

EVP_PKEY *pk;

RSA *rsa;

X509_NAME *name=NULL;

ASN1_STRING stmp, *str = &stmp;

STACK_OF(X509_EXTENSION) *exts = NULL;

if ((pk=EVP_PKEY_new()) == NULL)

goto err;

if ((x=X509_REQ_new()) == NULL)

goto err;

Rand(NULL,1,out);//产生随机数种子

rsa=RSA_generate_key(bits,RSA_F4,0/*回调函数callback*/,NULL);//产生密钥对

//PEM_write_bio_RSAPrivateKey

if (!EVP_PKEY_assign_RSA(pk,rsa))

goto err;

rsa=NULL;

X509_REQ_set_pubkey(x,pk);

name=X509_REQ_get_subject_name(x);

/* This function creates and adds the entry, working out the

* correct string type and performing checks on its length.

* Normally we'd check the return value for errors

setlocale(LC_CTYPE, "");

Add_Name(name,NID_countryName,(char *)reqInfo->C,sizeof(reqInfo->C),out);

Add_Name(name,NID_stateOrProvinceName,(char *)reqInfo->ST,sizeof(reqInfo->ST),out);

Add_Name(name,NID_localityName,(char *)reqInfo->L,sizeof(reqInfo->L),out);

Add_Name(name,NID_organizationName,(char *)reqInfo->O,sizeof(reqInfo->O),out);

Add_Name(name,NID_organizationalUnitName,(char *)reqInfo->OU,sizeof(reqInfo->OU),out);

Add_Name(name,NID_commonName,(char *)reqInfo->CN,sizeof(reqInfo->CN),out);

Add_Name(name,NID_pkcs9_emailAddress,(char *)reqInfo->MAIL,sizeof(reqInfo->MAIL),out);

Add_Name(name,NID_email_protect,(char *)reqInfo->PMAIL,sizeof(reqInfo->PMAIL),out);

Add_Name(name,NID_title,(char *)reqInfo->T,sizeof(reqInfo->T),out);

Add_Name(name,NID_description,(char *)reqInfo->D,sizeof(reqInfo->D),out);

Add_Name(name,NID_givenName,(char *)reqInfo->G,sizeof(reqInfo->G),out);

Add_Name(name,NID_initials,(char *)reqInfo->I,sizeof(reqInfo->I),out);

Add_Name(name,NID_name,(char *)reqInfo->NAME,sizeof(reqInfo->NAME),out);

Add_Name(name,NID_surname,(char *)reqInfo->S,sizeof(reqInfo->S),out);

Add_Name(name,NID_dnQualifier,(char *)reqInfo->QUAL,sizeof(reqInfo->QUAL),out);

Add_Name(name,NID_pkcs9_unstructuredName,(char *)reqInfo->STN,sizeof(reqInfo->STN),out);

Add_Name(name,NID_pkcs9_challengePassword,(char *)reqInfo->PW,sizeof(reqInfo->PW),out);

Add_Name(name,NID_pkcs9_unstructuredAddress,(char *)reqInfo->ADD,sizeof(reqInfo->ADD),out);

/* Certificate requests can contain extensions, which can be used

* to indicate the extensions the requestor would like added to

* their certificate. CAs might ignore them however or even choke

* if they are present.

/* For request extensions they are all packed in a single attribute.

* We save them in a STACK and add them all at once later

exts = sk_X509_EXTENSION_new_null();

/* Standard extenions */

//主题备用名称,URL:http://my.url.here/、支持email copy

Add_ExtReq(exts, NID_subject_alt_name, "DNS:localhost,email:hpxs@hotmail.com,RID:1.2.3.4,URI:192.168.2.22,IP:C0A80216");

//加入自定义扩展

int nid;

nid = OBJ_create("1.3.6.1.4.1.5315.100.2.5", "UserID", "User ID Number");

X509V3_EXT_add_alias(nid, NID_netscape_comment);

Add_ExtReq(exts, nid, "ID130203197703060618");

/* Now we've created the extensions we add them to the request */

X509_REQ_add_extensions(x, exts);

sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);

X509V3_EXT_cleanup();//cleanup the extension code if any custom extensions have been added

if (!X509_REQ_sign(x,pk,EVP_sha1()))//用自己的公钥签名私钥

goto err;

*req=x;

*pkeyp=pk;

return(1);

err:

return(0);

}

BOOL MakeReq(stuSUBJECT * reqInfo,/*请求信息*/int bits/*位数*/,char * reqFile/*证书请求文件*/,

char * priFile/*私钥文件*/,char * outMsg/*操作结果*/,int type)

{

X509_REQ *req=NULL;

EVP_PKEY *pkey=NULL;

BIO * breq=NULL,* bkey=NULL;

int i=0,j=0;

if(((breq=BIO_new_file(reqFile, "w"))== NULL)||((bkey=BIO_new_file(priFile, "w")) == NULL))

{

strcpy(outMsg,"Create File Error");

return false;

}

if(!mkReq(reqInfo,&req,&pkey,bits,outMsg))

{

strcpy(outMsg,"Make CertReq Error");

return false;

}

if(type==PEM)

{

i=PEM_write_bio_X509_REQ(breq,req);

j=PEM_write_bio_PrivateKey(bkey,pkey,NULL,NULL,0,NULL, NULL);

}

else if(type==DER)

{

i=i2d_X509_REQ_bio(breq,req);

j=i2d_PrivateKey_bio(bkey,pkey);

}

BIO_free(breq);

BIO_free(bkey);

X509_REQ_free(req);

EVP_PKEY_free(pkey);

if(!i||!j)

{

strcpy(outMsg,"Save Cert or Key File Error");

return false;

}

return true;

}

// end //

/// begin

int copy_extensions(X509 *x, X509_REQ *req, int copy_type)//在证书中加入req自带扩展信息

{

STACK_OF(X509_EXTENSION) *exts = NULL;

X509_EXTENSION *ext, *tmpext;

ASN1_OBJECT *obj;

int i, idx, ret = 0;

if (!x || !req || (copy_type == EXT_COPY_NONE))

return 1;

exts = X509_REQ_get_extensions(req);

for(i = 0; i < sk_X509_EXTENSION_num(exts); i++)

{

ext = sk_X509_EXTENSION_value(exts, i);

obj = X509_EXTENSION_get_object(ext);

idx = X509_get_ext_by_OBJ(x, obj, -1);

/* Does extension exist? */

if (idx != -1)

{

/* If normal copy don't override existing extension */

if (copy_type == EXT_COPY_ADD)

continue;

/* Delete all extensions of same type */

{

tmpext = X509_get_ext(x, idx);

X509_delete_ext(x, idx);

X509_EXTENSION_free(tmpext);

idx = X509_get_ext_by_OBJ(x, obj, -1);

} while (idx != -1);

}

if (!X509_add_ext(x, ext, -1))

goto end;

}

ret = 1;

end:

sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);

return ret;

}

int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,int serial,

char *startdate, char *enddate, int days,X509_REQ * req,stuKEYUSAGE * KUSAGE,

stuEKEYUSAGE * EKUSAGE,char * outMsg)

{

X509_NAME *name=NULL,*CAname=NULL;

X509 *ret=NULL;

X509_CINF *ci;

EVP_PKEY *pktmp;

int ok= -1,i=0;

// STACK_OF (X509_EXTENSION) * req_exts;//如何释放??

char kusage[160]={0};

char ekusage[360]={0};

name=X509_REQ_get_subject_name(req);

if ((ret=X509_new()) == NULL)

{

ok=0;

goto err;

}

ci=ret->cert_info;

/* Make it an X509 v3 certificate. 版本1扩展*/

if (!X509_set_version(ret,2L)) //版本

{

ok=0;

goto err;

}

ASN1_INTEGER_set(X509_get_serialNumber(ret),serial);//序列号

if (!X509_set_issuer_name(ret,X509_get_subject_name(x509)))//发行者

{

ok=0;

goto err;

}

if (strcmp(startdate,"today") == 0)

X509_gmtime_adj(X509_get_notBefore(ret),0);//开始日期

else ASN1_UTCTIME_set_string(X509_get_notBefore(ret),startdate);

if (enddate == NULL)

X509_gmtime_adj(X509_get_notAfter(ret),(long)60*60*24*days);//结束日期

else ASN1_UTCTIME_set_string(X509_get_notAfter(ret),enddate);

if (!X509_set_subject_name(ret,name)) //主体 ---所有者

{

ok=0;

goto err;

}

pktmp=X509_REQ_get_pubkey(req);

i = X509_set_pubkey(ret,pktmp);//公钥

EVP_PKEY_free(pktmp);

if (!i)

{

ok=0;

goto err;

}

//加入req自带扩展信息，生成REQ文件时候加入的

if (!copy_extensions(ret, req, EXT_COPY_ALL))

{

strcpy("加入自带扩展信息失败",outMsg);

goto err;

}

/* Lets add the extensions, if there are any 加入标准扩展*/

//基本限制Note if the CA option is false the pathlen option should be omitted.

Add_ExtCert(ret,ret,NID_basic_constraints, "critical,CA:FALSE,pathlen:1");

//主题密钥标示符--------区分拥有者多对密钥

Add_ExtCert(ret,ret,NID_subject_key_identifier, "hash");

//Authority密钥标示符----区分发行者有多个签名密钥时

Add_ExtCert(ret,x509, NID_authority_key_identifier, "keyid,issuer:always");

//密钥用法 ----数字签名、不可否认性、密钥加密、数据加密、密钥协商、证书签名、

//CRL签名、仅仅加密、仅仅解密

if(KUSAGE->DS)

strcpy(kusage,"digitalSignature");

if(KUSAGE->NR)

if(strlen(kusage))//添加

strcat(kusage, ",nonRepudiation");

else

strcpy(kusage,"nonRepudiation");

if(KUSAGE->KE)

if(strlen(kusage))//添加

strcat(kusage, ",keyEncipherment");

else

strcpy(kusage,"keyEncipherment");

if(KUSAGE->DE)

if(strlen(kusage))//添加

strcat(kusage, ",dataEncipherment");

else

strcpy(kusage,"dataEncipherment");

if(KUSAGE->KA)

if(strlen(kusage))//添加

strcat(kusage, ",keyAgreement");

else

strcpy(kusage,"keyAgreement");

if(KUSAGE->KC)

if(strlen(kusage))//添加

strcat(kusage, ",keyCertSign");

else

strcpy(kusage,"keyCertSign");

if(KUSAGE->CS)

if(strlen(kusage))//添加

strcat(kusage, ",cRLSign");

else

strcpy(kusage,"cRLSign");

if(KUSAGE->EO)

if(strlen(kusage))//添加

strcat(kusage, ",encipherOnly");

else

strcpy(kusage,"encipherOnly");

if(KUSAGE->DO)

if(strlen(kusage))//添加

strcat(kusage, ",decipherOnly");

else

strcpy(kusage,"decipherOnly");

if(strlen(kusage))

Add_ExtCert(ret,ret, NID_key_usage, kusage);

//增强型密钥用法--一般只用于末端证书RFC3280

//增强用法证书目的

//--------------------------------------------------------------------------------------------------------------

//服务器验证保证远程计算机的身份

//客户端验证向远程计算机证明您的身份

//代码签名确保软件来自软件发行商

//安全电子邮件保护软件在发行后不被改动

//时间戳保护电子邮件消息

//--------------------------------------------------------------------------------------------------------------

// 保证软件来自一个软件发行商

// 保护软件在发行后不被改动。

// 保证软件来自商业软件发行商

// 允许您用数字签名证书信任列表

// 允许联机事务处理/通讯的严格加密

// 允许加密磁盘上的数据

// 智能卡登录

//IP安全终端系统允许 Internet 上的安全通讯

//IP安全隧道终止

//IP 安全用户

//--------------------------------------------------------------------------------------------------------------

if(EKUSAGE->SA)

strcpy(ekusage,"serverAuth");

if(EKUSAGE->CA)

if(strlen(ekusage))//添加

strcat(ekusage,",clientAuth");

else

strcpy(ekusage,"clientAuth");

if(EKUSAGE->CS)

if(strlen(ekusage))//添加

strcat(ekusage,",codeSigning");

else

strcpy(ekusage,"codeSigning");

if(EKUSAGE->EP)

if(strlen(ekusage))//添加

strcat(ekusage,",emailProtection");

else

strcpy(ekusage,"emailProtection");

if(EKUSAGE->TS)

if(strlen(ekusage))//添加

strcat(ekusage,",timeStamping");

else

strcpy(ekusage,"timeStamping");

if(EKUSAGE->msCC)

if(strlen(ekusage))//添加

strcat(ekusage,",msCodeCom");

else

strcpy(ekusage,"msCodeCom");

if(EKUSAGE->msCTLS)

if(strlen(ekusage))//添加

strcat(ekusage,",msCTLSign");

else

strcpy(ekusage,"msCTLSign");

if(EKUSAGE->msSGC)

if(strlen(ekusage))//添加

strcat(ekusage,",msSGC");

else

strcpy(ekusage,"msSGC");

if(EKUSAGE->msEFS)

if(strlen(ekusage))//添加

strcat(ekusage,",msEFS");

else

strcpy(ekusage,"msEFS");

if(EKUSAGE->msSC)

if(strlen(ekusage))//添加

strcat(ekusage,",msSmartcardLogin");

else

strcpy(ekusage,"msSmartcardLogin");

if(EKUSAGE->IP)

if(strlen(ekusage))//添加

strcat(ekusage,",ipsecEndSystem,ipsecTunnel,ipsecUser");

else

strcpy(ekusage,"ipsecEndSystem,ipsecTunnel,ipsecUser");

if(strlen(ekusage))

Add_ExtCert(ret,ret,NID_ext_key_usage,ekusage);

Application keyUsage Values

SSL Client digitalSignature

SSL Server keyEncipherment

S/MIME Signing digitalSignature

S/MIME Encryption keyEncipherment

Certificate Signing keyCertSign

Object Signing digitalSignature */

//颁发者备用名称,URL:http://my.url.here/、不支持email copy

Add_ExtCert(ret,ret, NID_issuer_alt_name, "DNS:hpxs,email:hpxs@hotmail.com,RID:1.2.3.4,URI:https://hpxs,IP:192.168.0.22");

//证书策略

Add_ExtCert(ret,ret,NID_certificate_policies,"OK");

//颁发机构信息访问

Add_ExtCert(ret,ret,NID_info_access,"OCSP;URI:https://hpxs");//或者caIssuers;URI:http://my.ca/ca.html

//CRL分发点

Add_ExtCert(ret,x509, NID_crl_distribution_points, "URI:https://hpxs/hpxs.crl");

/* Some Netscape specific extensions */

// Add_ExtCert(ret,ret, NID_crl_number, "sslCA");

// Add_ExtCert(ret,x509, NID_netscape_comment, "See http://cert.umd.edu/root for details.");

/* In each case the 'value' of the extension is placed directly in the

extension. Currently supported extensions in this category are: nsBaseUrl,

nsRevocationUrl, nsCaRevocationUrl, nsRenewalUrl, nsCaPolicyUrl,

nsSslServerName and nsComment */

// Add_ExtCert(ret,x509, NID_netscape_cert_type, "client, server, email,objsign, reserved, sslCA,emailCA, objCA");

/*nsCertType (netscape certificate type) takes the flags: client, server, email,

objsign, reserved, sslCA, emailCA, objCA.*/

/* Maybe even add our own extension based on existing */

//加入自定义信息begin

int nid;

nid = OBJ_create("1.2.3.4.9", "Hpxs", "I love OpenSSL!");

X509V3_EXT_add_alias(nid, NID_netscape_comment);

Add_ExtCert(ret,ret, nid, "I love OpenSSL");

//加入自定义信息end

X509V3_EXT_cleanup();//cleanup the extension code if any custom extensions have been added

if (!X509_sign(ret,pkey,dgst))//加入签名，签名算法

{

ok=0;

goto err;

}

ok=1;

err:

if (CAname != NULL)

X509_NAME_free(CAname);

if (ok <= 0)

{

if (ret != NULL) X509_free(ret);

ret=NULL;

}

else

*xret=ret;

return(ok);

}

int certify(X509 **xret, X509_REQ *req, EVP_PKEY *pkey, X509 *x509,const EVP_MD *dgst,

int serial, char *startdate, char *enddate, int days,stuKEYUSAGE * KUSAGE,

stuEKEYUSAGE * EKUSAGE,char * outMsg)

{//返回公钥证书，请求文件，根私钥，根公钥，

EVP_PKEY *pktmp=NULL;

int ok= -1,i=0;

if ((pktmp=X509_REQ_get_pubkey(req)) == NULL)//得到公钥

{

sprintf(outMsg,"error unpacking public key\n");

ok=0;

goto err;

}

i=X509_REQ_verify(req,pktmp);//证书请求里面有私要签名，这里验证一下，看此公钥主人是否持有私钥

EVP_PKEY_free(pktmp);

if (i < 0)

{

ok=0;

sprintf(outMsg,"Signature verification problems.\n");

goto err;

}

if (i == 0)

{

ok=0;

sprintf(outMsg,"Signature did not match the certificate request\n");

goto err;

}

ok=do_body(xret,pkey,x509,dgst,serial,startdate, enddate,

days,req,KUSAGE,EKUSAGE,outMsg);

err:

return(ok);

}

BOOL MakeCert(char *certfile/*根证书公钥*/,int certlen,/*为0则certfile为磁盘文件，否则为内存区域*/

char *keyfile/*根证书私钥*/,int keylen,int serial/*序列号*/,char *enddate/*作废日期*/,

int days/*有效期*/, char *reqfile/*请求文件*/,stuKEYUSAGE * KUSAGE/*密钥用法*/,

stuEKEYUSAGE * EKUSAGE/*增强密钥用法*/,char *outfile/*结果文件*/,

char * outMsg/*操作结果*/,int type/*结果类型DER,PEM*/)//通过证书请求，得到证书

{

int ret=1;

char * md=NULL;

EVP_PKEY *pkey=NULL;

X509 * x509=NULL;

X509_REQ *req=NULL;

X509 * x=NULL;

BIO * bcert=NULL,* reqbio=NULL;

int j;

const EVP_MD *dgst=NULL;

OpenSSL_add_all_digests();//加入签名算法

if((reqbio=BIO_new_file(reqfile, "r")) == NULL)

{

ret=0;

goto err;

}

if ((req=PEM_read_bio_X509_REQ(reqbio,NULL,NULL,NULL)) == NULL)//PEM_read_X509_REQ

{

BIO_reset(reqbio);

if ((req=d2i_X509_REQ_bio(reqbio,NULL)) == NULL)

{

sprintf(outMsg,"Error get certificate request");

ret=0;

goto err;

}

pkey=LoadKey(keyfile,keylen,NULL,outMsg);

if (pkey == NULL)

{

ret = 0;

goto err;

}

x509=LoadCert(certfile,certlen,outMsg);

if (x509 == NULL)

{

ret = 0;

goto err;

}

if (!X509_check_private_key(x509,pkey))

{

sprintf(outMsg,"CA certificate and CA private key do not match\n");

ret = 0;

goto err;

}

md="sha1";//!!!!!!!!!!!!!!!!!

if ((dgst=EVP_get_digestbyname(md)) == NULL)//return an EVP_MD structure when passed a digest name

{

sprintf(outMsg,"%s is an unsupported message digest type\n",md);

ret = 0;

goto err;

}

j=certify(&x,req,pkey,x509,dgst,//公钥证书out，请求文件，根私钥，根公钥，

serial,"today",enddate,days,KUSAGE,EKUSAGE,outMsg);

if (j <= 0)

{

ret=0;

goto err;

}

if(((bcert=BIO_new_file(outfile, "w"))== NULL))

{

strcpy(outMsg,"Create File Error");

goto err;

}

if (type==DER)

{

i2d_X509_bio(bcert,x);

}

else if(type==PEM)

{

PEM_write_bio_X509(bcert,x);

}

err:

if (reqbio != NULL) BIO_free(reqbio);

BIO_free_all(bcert);

EVP_PKEY_free(pkey);

X509_free(x509);

X509_free(x);

if (req != NULL) X509_REQ_free(req);

EVP_cleanup();//frees all three stacks and sets their pointers to NULL ---- EVP_CIPHER

return ret;

}

/ end

BOOL DirectCert(char *certfile/*根证书公钥*/,int certlen,/*为0则certfile为磁盘文件，否则为内存区域*/

char *keyfile/*根证书私钥*/,int keylen,int serial/*序列号*/,char *enddate/*作废日期*/,

int days/*有效期*/,stuCERT * sCERT/*用户信息与密钥用法*/,int bits,char * cert/*输出证书公钥*/,int * certl/*长度*/,

char * key/*输出证书私钥*/,int * keyl/*长度*/,char * outMsg/*,int type结果类型DER,PEM*/)//直接生成公私钥

{

X509_REQ * req=NULL;

EVP_PKEY * pkey=NULL, * prkey=NULL;//证书私钥,//根私钥

X509 * x509=NULL,* x=NULL;//根公钥，证书公钥

BIO * memcert=NULL, * memkey=NULL;//输出证书公私钥

BUF_MEM *bptrcert=NULL,*bptrkey=NULL;

int ret=1;

char * md=NULL;

int i=0,j=0,ok=0;

const EVP_MD *dgst=NULL;

OpenSSL_add_all_digests();//加入签名算法

memcert= BIO_new(BIO_s_mem());

memkey= BIO_new(BIO_s_mem());

BIO_set_close(memcert, BIO_CLOSE); /* BIO_free() free BUF_MEM */

BIO_set_close(memkey, BIO_CLOSE); /* BIO_free() free BUF_MEM */

prkey=LoadKey(keyfile,keylen,NULL,outMsg);//RAND_bytes

if (prkey == NULL)

{

ret = 0;

goto err;

}

x509=LoadCert(certfile,certlen,outMsg);

if (x509 == NULL)

{

ret = 0;

goto err;

}

if (!X509_check_private_key(x509,prkey))

{

sprintf(outMsg,"CA certificate and CA private key do not match\n");

ret = 0;

goto err;

}

if(!mkReq(&(sCERT->SUBJECT),&req,&pkey, bits,outMsg))

{

sprintf(outMsg,"Make CertReq error");

ret = 0;

goto err;

}

md="sha1";//!!!!!!!!!!!!!!!!!

if ((dgst=EVP_get_digestbyname(md)) == NULL)//return an EVP_MD structure when passed a digest name

{

sprintf(outMsg,"%s is an unsupported message digest type\n",md);

ret = 0;

goto err;

}

ok=certify(&x,req,prkey,x509,dgst,//公钥证书out，请求，根私钥，根公钥，

serial,"today",enddate,days,&(sCERT->KUSAGE),&(sCERT->EKUSAGE),outMsg);

if (ok <= 0)

{

ret=0;

goto err;

}

/* if (type==DER)

{

i=i2d_X509_bio(memcert,x);

j=i2d_PrivateKey_bio(memkey,pkey);//生成的结果错误！？？？？？？？？？？？？？

}

else if(type==PEM)

*/ {

i=PEM_write_bio_X509(memcert,x);

j=PEM_write_bio_PrivateKey(memkey,pkey,NULL,NULL,0,NULL, NULL);

}

if(!i||!j)

{

strcpy(outMsg,"Get Mem Cert or Key File Error");

ret=0;

goto err;

}

BIO_get_mem_ptr(memcert, &bptrcert);

*certl=bptrcert->length;

memcpy(cert,bptrcert->data,*certl);

BIO_get_mem_ptr(memkey, &bptrkey);

*keyl=bptrkey->length;

memcpy(key,bptrkey->data,*keyl);

err:

BIO_free_all(memcert);

BIO_free_all(memkey);

EVP_PKEY_free(pkey);

EVP_PKEY_free(prkey);

X509_free(x509);

X509_free(x);

if (req != NULL) X509_REQ_free(req);

EVP_cleanup();//frees all three stacks and sets their pointers to NULL ---- EVP_CIPHER

return ret;

}

/ begin //

/*添加链表节点*/

void AddRevoke(stuREVOKE *& Head,int index,time_t time)

{

stuREVOKE * End=new stuREVOKE(index,time);//钥增加的节点

if(Head==NULL)

{

Head=End;

}

else

{

stuREVOKE * p=Head;

while(p->Link!=NULL)

p=p->Link;

p->Link=End;

}

return;

}

int Add_ExtCrl(X509_CRL *crl/*正被添加的证书*/,X509 * root/*根证书（从中得到信息)*/,

int nid, char *value)

{

X509V3_CTX ctx;

X509_EXTENSION *ex;

/* This sets the 'context' of the extensions. */

/* No configuration database */

// X509V3_set_ctx_nodb(&ctx);

X509V3_set_ctx(&ctx, root, NULL, NULL, crl, 0);

// issuerAltName authorityKeyIdentifier

ex = X509V3_EXT_conf_nid(NULL, &ctx, nid, value);

if (!ex)

return 0;

X509_CRL_add_ext(crl,ex,-1);

X509_EXTENSION_free(ex);

return 1;

}

BOOL MakeCrl(char *certfile/*根证书公钥*/,int certlen,/*为0则certfile为磁盘文件，否则为内存区域*/

char *keyfile/*根证书私钥*/,int keylen,

stuREVOKE * Head/*作废链表*/,PNewCrlMem NewCrlMem/*回调函数*/,char *& outCrl,int * crll,char * outfile/*crl文件*/,

char * outMsg/*操作结果*/)

{

X509_CRL_INFO *ci = NULL;

X509_CRL *crl = NULL;

int ret=1,i=0;

char *key=NULL;

char *md=NULL;

EVP_PKEY *pkey=NULL;

X509 *x509=NULL;

BIO *in=NULL,*out=NULL;

const EVP_MD *dgst=NULL;

X509_REVOKED *r=NULL;

long crldays=30;

long crlhours=0;

stuREVOKE * temp =NULL;

BIO * memcrl=NULL;

BUF_MEM *bptrcrl=NULL;

OpenSSL_add_all_algorithms();

pkey=LoadKey(keyfile,keylen,NULL,outMsg);

if (pkey == NULL)

{

ret = 0;

goto err;

}

x509=LoadCert(certfile,certlen,outMsg);

if (x509 == NULL)

{

ret = 0;

goto err;

}

if (!X509_check_private_key(x509,pkey))

{

sprintf(outMsg,"CA certificate and CA private key do not match\n");

ret = 0;

goto err;

}

md="md5";//!!!!!!!!!!!!!!!!!

if ((dgst=EVP_get_digestbyname(md)) == NULL)//return an EVP_MD structure when passed a digest name

{

sprintf(outMsg,"%s is an unsupported message digest type\n",md);

ret = 0;

goto err;

}

if ((crl=X509_CRL_new()) == NULL)

{

ret = 0;

goto err;

}

ci=crl->crl;

X509_NAME_free(ci->issuer);

ci->issuer=X509_NAME_dup(x509->cert_info->subject);

if (ci->issuer == NULL)

{

ret = 0;

goto err;

}

X509_gmtime_adj(ci->lastUpdate,0);

if (ci->nextUpdate == NULL)

ci->nextUpdate=ASN1_UTCTIME_new();

X509_gmtime_adj(ci->nextUpdate,(crldays*24+crlhours)*60*60);

if(!ci->revoked)

ci->revoked = sk_X509_REVOKED_new_null();

while(Head!=NULL)//遍历链表

{

temp=Head;

X509_REVOKED *r = NULL;

BIGNUM *serial_bn = NULL;

r = X509_REVOKED_new();

ASN1_TIME_set(r->revocationDate,Head->time);//时间

char index[100];

BN_hex2bn(&serial_bn,itoa(Head->Index,index,10));//序号

BN_to_ASN1_INTEGER(serial_bn,r->serialNumber);

sk_X509_REVOKED_push(ci->revoked,r);

Head=Head->Link;

delete temp;

}

// sk_X509_REVOKED_sort(ci->revoked);

for (i=0; i<SK_X509_REVOKED_NUM(CI->revoked); i++)

{

r=sk_X509_REVOKED_value(ci->revoked,i);

r->sequence=i;

}

if (ci->version == NULL)

if ((ci->version=ASN1_INTEGER_new()) == NULL)

{

ret = 0;

goto err;

}

ASN1_INTEGER_set(ci->version,1);

// issuerAltName authorityKeyIdentifier

// Add_ExtCrl(crl,x509,NID_subject_alt_name,"DNS:hpxs,email:hpxs@hotmail.com,RID:1.2.3.4,URI:https://hpxs,IP:192.168.0.22");

Add_ExtCrl(crl,x509,NID_issuer_alt_name, "DNS:hpxs,email:hpxs@hotmail.com,RID:1.2.3.4,URI:https://hpxs,IP:192.168.0.22");

Add_ExtCrl(crl,x509,NID_authority_key_identifier, "keyid,issuer:always");

if (!X509_CRL_sign(crl,pkey,dgst))

{

ret = 0;

goto err;

}

if(NewCrlMem)//输出内存

{

memcrl= BIO_new(BIO_s_mem());

BIO_set_close(memcrl, BIO_CLOSE); /* BIO_free() free BUF_MEM */

PEM_write_bio_X509_CRL(memcrl,crl);

BIO_get_mem_ptr(memcrl, &bptrcrl);

*crll=bptrcrl->length;

outCrl=NewCrlMem(*crll);

memcpy(outCrl,bptrcrl->data,*crll);

}

if(outfile)//输出文件

{

out=BIO_new_file(outfile, "w");

if(out==NULL)

{

sprintf(outMsg,"%s is error",outfile);

ret = 0;

goto err;

}

PEM_write_bio_X509_CRL(out,crl);

}

X509V3_EXT_cleanup();//cleanup the extension code if any custom extensions have been added

err:

if(out)

BIO_free_all(out);

if(memcrl)

BIO_free_all(memcrl);

BIO_free(in);

EVP_PKEY_free(pkey);

X509_CRL_free(crl);

X509_free(x509);

EVP_cleanup();//frees all three stacks and sets their pointers to NULL ---- EVP_CIPHER

if(ret==1)

strcpy(outMsg,"CRL制作成功");

return ret;

}

BOOL CertFormatConver(char * buf/*文件内容或文件名称*/,int len/*内存长度为0则buf为文件名*/,

char * pwd/*p12文件密码*/,char * pem/*输出文件*/,

int outformat,char * out/*操作结果*/)

{

EVP_PKEY *key=NULL;

X509 *cert=NULL;

BIO *biout=NULL;

int i=0;

//输出文件

if ((biout=BIO_new_file(pem, "w")) == NULL)

{

return false;

}

cert = LoadCert(buf,len,out);//首先尝试公钥,bio被改写

if(cert)//输入文件为公钥文件

{

if (outformat == DER)

i=i2d_X509_bio(biout,cert);

else if (outformat == PEM)

{

// if (trustout) i=PEM_write_bio_X509_AUX(biout,x);

i=PEM_write_bio_X509(biout,cert);

}

if(!i)//失败

strcpy(out,"保存公钥失败");

else

strcpy(out,"公钥证书格式转换成功");

}

else//输入文件为私钥文件

{

key=LoadKey(buf,len,pwd,out);

if(!key)

{

strcpy(out,"不能识别的文件格式");

return false;

}

if(outformat==PEM)

{

PEM_write_bio_PrivateKey(biout, key, NULL, NULL, 0, 0, NULL);

}

if(outformat==DER)

{

i2d_PrivateKey_bio(biout,key);//得到解密后的私钥

}

strcpy(out,"私钥证书格式转换成功");

}

if (biout != NULL) BIO_free(biout);

X509_free(cert);

EVP_PKEY_free(key);

return true;

}

//分解p12包

BOOL ParseDB(char * strP12/*包文件*/,char * strPwd/*私钥密码*/,char * strCert/*公钥存放*/,

char * strkey/*私钥存放*/,int outformat/*输出格式*/,char * out/*返回结果*/)

{

EVP_PKEY *key=NULL;

X509 *cert=NULL;

STACK_OF(X509) *ca = NULL;

BIO * bio=NULL,*bioCert=NULL,*bioKey=NULL;

PKCS12 *p12=NULL;

int i=0,j=0;

if((bio=BIO_new_file(strP12, "r")) == NULL)

{

strcpy(out,"打开文件错误");

return false;

}

SSLeay_add_all_algorithms();

p12 = d2i_PKCS12_bio(bio, NULL);

if (!PKCS12_parse(p12, strPwd, &key, &cert/*PEM*/, &ca))

{

strcpy(out,"解包失败");

return false;

}

PKCS12_free(p12);

//输出文件

if ((bioCert=BIO_new_file(strCert, "w")) == NULL)

{

return false;

}

if ((bioKey=BIO_new_file(strkey, "w")) == NULL)

{

return false;

}

if(outformat == DER)

{

i=i2d_X509_bio(bioCert,cert);

j=i2d_PrivateKey_bio(bioKey,key);

}

else if (outformat == PEM)

{

i=PEM_write_bio_X509(bioCert,cert);

j=PEM_write_bio_PrivateKey(bioKey, key, NULL, NULL, 0, 0, NULL);

}

if (bio != NULL) BIO_free(bio);

if (bioCert != NULL) BIO_free(bioCert);

if (bioKey != NULL) BIO_free(bioKey);

X509_free(cert);

EVP_PKEY_free(key);

EVP_cleanup();//frees all three stacks and sets their pointers to NULL ---- EVP_CIPHER

if(i!=0&&j!=0)

{

strcpy(out,"分解P12成功");

return true;

}

return false;

}

//组合p12包

BOOL CreateDB(char * strP12/*OUT包文件*/,char * strPwd/*IN密码*/,char * strCert/*IN公钥*/,

char * strkey/*IN私钥*/,char * out/*返回结果*/)

{

FILE *fp=NULL;

EVP_PKEY *key=NULL;

X509 *cert=NULL;

PKCS12 *p12;

cert =LoadCert(strCert,0,out);

if(!cert)

{

strcpy(out,"读取公钥文件失败");

return false;

}

key=LoadKey(strkey,0,NULL,out);//解密后私钥

if(!key)

{

strcpy(out,"读取私钥文件失败");

return false;

}

SSLeay_add_all_algorithms();

p12 = PKCS12_create(strPwd,"(hpxs)", key, cert, NULL, 0,0,0,0,0);

if(!p12)

{

strcpy(out,"创建p12结构失败");

return false;

}

if (!(fp = fopen(strP12, "wb")))

{

strcpy(out,"保存p12文件失败");

}

i2d_PKCS12_fp(fp, p12);

PKCS12_free(p12);

fclose(fp);

strcpy(out,"合并P12成功");

X509_free(cert);

EVP_PKEY_free(key);

EVP_cleanup();//frees all three stacks and sets their pointers to NULL ---- EVP_CIPHER

return true;

}

//修改p12包密码

BOOL ChangePB(char * strP12/*in包文件*/,char * strPwd/*IN原密码*/,char * strPwd2/*IN新密码*/,

char * strOutP12/*in包文件*/,char * out/*返回结果*/)

{

FILE *fp=NULL;

EVP_PKEY *key=NULL;

X509 *cert=NULL;

STACK_OF(X509) *ca = NULL;

PKCS12 *p12=NULL;

int len=0,wlen=0;

SSLeay_add_all_algorithms();

if (!(fp = fopen(strP12, "rb")))

{

strcpy(out,"打开文件错误");

return false;

}

p12 = d2i_PKCS12_fp(fp, NULL);

fclose (fp);

if (!p12)

{

strcpy(out,"读取包文件错误");

return false;

}

if (!PKCS12_parse(p12, strPwd, &key, &cert, &ca))

{

strcpy(out,"解包失败");

return false;

}

PKCS12_free(p12);

fclose(fp);

p12=NULL;

///

p12 = PKCS12_create(strPwd2,"(null)", key, cert, NULL, 0,0,0,0,0);

if(!p12)

{

strcpy(out,"创建p12结构失败");

return false;

}

if (!(fp = fopen(strOutP12, "wb")))

{

strcpy(out,"保存p12文件失败");

}

i2d_PKCS12_fp(fp, p12);

PKCS12_free(p12);

fclose(fp);

strcpy(out,"转换P12密码成功");

X509_free(cert);

EVP_PKEY_free(key);

return true;

}

BOOL CertPairCheck(char * cert,char * key,char * out)//检验公钥、私钥是否配对

{

EVP_PKEY *pkey=NULL;

X509 *x509=NULL;

x509=LoadCert(cert,0,out);

if(x509==NULL)

{

strcpy(out,"不能打开公钥文件");

return FALSE;

}

pkey=LoadKey(key,0,NULL,out);

if(pkey==NULL)

{

strcpy(out,"不能打开私钥文件");

X509_free(x509);

return FALSE;

}

if(X509_check_private_key(x509,pkey))//匹配

{

X509_free(x509);

EVP_PKEY_free(pkey);

return TRUE;

}

else

{

strcpy(out,"公私钥对不匹配");

X509_free(x509);

EVP_PKEY_free(pkey);

return FALSE;

}

#include

#define DER 1 //FORMAT_ASN1

#define PEM 3 /*定义格式*/

#define NET 4

#define P12 5

typedef char * (* PNewCrlMem)(UINT len);

struct stuSUBJECT//个体信息

{

UCHAR C[4];//国家

UCHAR ST[4];//省份

UCHAR L[12];//城市

UCHAR O[48];//组织

UCHAR OU[24];//组织部门

UCHAR CN[12];//个人信息

UCHAR MAIL[24];//电子邮件

UCHAR PMAIL[24];//安全电子邮件

UCHAR T[12];//头衔

UCHAR D[12];//描述

UCHAR G[12];//曾用名

UCHAR I[12];//描述

UCHAR NAME[12];//描述

UCHAR S[12];//描述

UCHAR QUAL[12];//描述

UCHAR STN[12];//没有结构的名称

UCHAR PW[12];//挑战密码

UCHAR ADD[12];//无结构地址

stuSUBJECT()

{

memset(this,0,sizeof(stuSUBJECT));

}

};

struct stuKEYUSAGE//密钥用途

{

BOOL DS;//Digital Signature

BOOL NR;//Non-Repudiation

BOOL KE;//Key Encipherment

BOOL DE;//Data Encipherment

BOOL KA;//keyAgreement

BOOL KC;//keyCertSign

BOOL CS;//cRLSign

BOOL EO;//Encipher Only

BOOL DO;//Decipher Only

stuKEYUSAGE()

{

memset(this,0,sizeof(stuKEYUSAGE));

}

};

struct stuEKEYUSAGE//增强型密钥用途

{

BOOL SA;//服务器验证

BOOL CA;//客户端验证

BOOL CS;//代码签名

BOOL EP;//安全电子邮件

BOOL TS;//时间戳

BOOL msCC;//代码完整

BOOL msCTLS;//可签名信任列表

BOOL msSGC;//联机事务处理

BOOL msEFS;//加密磁盘上的数据

BOOL msSC;//智能卡登录

BOOL IP;//Internet

stuEKEYUSAGE()

{

memset(this,0,sizeof(stuEKEYUSAGE));

}

};

struct stuCERT//三者之和

{

stuSUBJECT SUBJECT;

stuKEYUSAGE KUSAGE;

stuEKEYUSAGE EKUSAGE;

stuCERT()

{

memset(this,0,sizeof(stuCERT));

}

};

struct stuREVOKE//证书作废结构链表

{

int Index;//证书序号

time_t time;//吊销时间

stuREVOKE * Link;

stuREVOKE()

{

memset(this,0,sizeof(stuREVOKE));

}

stuREVOKE(int index,time_t t)

{

Index=index;

time=t;;

Link=NULL;

}

};

/*添加链表节点*/

void AddRevoke(stuREVOKE *& Head,int index,time_t time);

/*证书格式转换函数*/

BOOL CertFormatConver(char * buf/*内存区域，存储文件内容或文件名称*/,int len/*内存长度==0则buf为文件名*/,

char * pwd/*p12文件密码*/,char * pem/*输出文件*/,int outformat,char * out/*操作结果*/);

/*根证书生成函数，根据rootInfo信息，生成根证书公、私钥文件*/

BOOL MakeRoot(stuSUBJECT * rootInfo,/*请求信息IN*/int bits/*位数IN*/, int serial/*序列号IN*/,

int days/*有效期IN*/,char * certFile/*证书请求文件OUT*/,char * priFile/*私钥文件OUT*/,

char * out/*操作结果OUT*/,int type=PEM/*类型pem-der*/);

/*证书请求生成函数，根据reqInfo信息，生成用户证书私钥文件、证书请求文件*/

BOOL MakeReq(stuSUBJECT * reqInfo,/*请求信息IN*/int bits/*位数IN*/, char * reqFile/*证书请求文件OUT*/,

char * priFile/*私钥文件OUT*/,char * out/*操作结果OUT*/,int type=PEM/*类型pem-der*/);

/*证书生成函数，通过证书请求，生成用户证书公钥文件*/

BOOL MakeCert(char *certfile/*根证书公钥*/,int certlen,/*为0则certfile为磁盘文件，否则为内存区域*/

char *keyfile/*根证书私钥*/,int keylen,int serial/*序列号*/,char *enddate/*作废日期*/,

int days/*有效期*/, char *reqfile/*请求文件*/,stuKEYUSAGE * KUSAGE/*密钥用法*/,

stuEKEYUSAGE * EKUSAGE/*增强密钥用法*/,char *outfile/*结果文件*/,

char * outMsg/*操作结果*/,int type/*结果类型DER,PEM*/);//通过证书请求，得到证书

//直接生成公私钥

BOOL DirectCert(char *certfile/*根证书公钥*/,int certlen,/*为0则certfile为磁盘文件，否则为内存区域*/

char *keyfile/*根证书私钥*/,int keylen,int serial/*序列号*/,char *enddate/*作废日期*/,

int days/*有效期*/,stuCERT * sCERT/*用户信息与密钥用法*/,int bits,char * cert/*输出证书公钥*/,int * certl/*长度*/,

char * key/*输出证书私钥*/,int * keyl/*长度*/,char * outMsg/*,int type结果类型DER,PEM*/);//直接生成公私钥

/*黑名单生成函数*/

BOOL MakeCrl(char *certfile/*根证书公钥*/,int certlen,/*为0则certfile为磁盘文件，否则为内存区域*/

char *keyfile/*根证书私钥*/,int keylen,

stuREVOKE * Head/*作废链表*/,PNewCrlMem NewCrlMem/*回调函数*/,char *& outCrl,int * crll,char * outfile/*crl文件*/,

char * outMsg/*操作结果*/);

/*分解p12包*/

BOOL ParseDB(char * strP12/*包文件*/,char * strPwd/*解包密码*/,char * strCert/*公钥存放*/,

char * strkey/*私钥存放*/,int outformat/*输出格式*/,char * out/*返回结果*/);

/*组合p12包*/

BOOL CreateDB(char * strP12/*包文件IN*/,char * strPwd/*密码IN*/,char * strCert/*公钥存放IN*/,

char * strkey/*私钥存放IN*/,char * out/*返回结果OUT*/);

BOOL ChangePB(char * strP12/*IN包文件*/,char * strPwd/*IN原密码*/,char * strPwd2/*IN新密码*/,

char * strOutP12/*OUT包文件*/,char * out/*返回结果OUT*/);

//检验公钥、私钥是否配对

BOOL CertPairCheck(char * cert,char * key,char * out);//检验公钥、私钥是否配对

大头石

关注

0
点赞
踩
1

收藏

觉得还不错? 一键收藏
0
评论
openssl demo1

#define sprintf_s sprintf #include "stdafx.h" #include &lt;LOCALE.H&gt; #include "ca.h" #include &lt;OPENSSL pem.h&gt; #include &lt;OPENSSL x509.h&gt; #include &lt...
复制链接

扫一扫

专栏目录