openssl 从内存直接加载CA证书

参考链接

openssl 从内存加载ca证书 - Zzz...y - 博客园 (cnblogs.com)

C ++ / OpenSSL：使用根CA从缓冲区而不是文件（SSL_CTX_load_verify_locations） - IT屋-程序员软件开发技术分享社区 (it1352.com)

poha.mqtt.c 库使用tls连接时，默认是通过文件方式加载证书的。使用SSL_CTX_load_verify_locations接口加载CA文件。想要改成从内存直接加载ca证书，将证书硬编码进程序中，防止证书被恶意篡改。需要修改库源码，位于文件SSLSocket.c的SSLSocket_createContext接口中。 修改下面代码。

	if (opts->trustStore || opts->CApath)
	{
		if ((rc = SSL_CTX_load_verify_locations(net->ctx, opts->trustStore, opts->CApath)) != 1)
		{
			if (opts->struct_version >= 3)
				SSLSocket_error("SSL_CTX_load_verify_locations", NULL, net->socket, rc, opts->ssl_error_cb, opts->ssl_error_context);
			else
				SSLSocket_error("SSL_CTX_load_verify_locations", NULL, net->socket, rc, NULL, NULL);
			goto free_ctx;
		}
	}

char *cacrt="-----BEGIN CERTIFICATE-----\n\
MIIDmzCCAoOgAwIBAgIJAPDSM1KhTBCVMA0GCSqGSIb3DQEBCwUAMGQxCzAJBgNV\n\
BAYTAm1nMRAwDgYDVQQIDAdtb29yZ2VuMQ0wCwYxVQQHDAR0ZXN0MRAwDgYDVQQK\n\
DAdtb29yZ2VuMRAwDgYDVQQLDAdtb29yZ2VuMRAwDgYDVQQDDAdtb29yZ2VuMB4X\n\
DTIxMDkyOTA1MjU0OFoXDTMxMDkyNzA1MjU0OdowZDELMAkGA1UEBhMCbWcxEDAO\n\
BgNVBAgMB21vb3JnZW4xDTALBgNVBAcMBHRlc3QxEDAOBgNVBAoMB21vb3JnZW4x\n\
EDAOBgNVBAsMB21vb3JnZW4xEDAOBgNVBAMMB21vb3JnZW4wggEiMA0GCSqGSIb3\n\
DQEBAQUAA4IBDwAwggEKAoIBAQDZPtIfZMYm4zecCugaW2UyzwR29Eydm4cUVQw2\n\
Mv3r3PR082eWKEVJuE8imq4pBX8iVFQPxz+0R2fSzc7sMlWYhWazgWX7r9uYFO8y\n\
HHjIjnE/U+uECw3Nk3O8OKYCEJ98ox8RkswjJ4cDP/Cboi1/kx7UykUXbvkxttqc\n\
Th0uBHf7BjQ7KH8ezlI4qJafBhJzNS7ae+YfdwSAFv3zh99eurL4DZjCj+uUGcQf\n\
ZOmRKvEeWazcxLH7mBeErF6r+lnGPjYRS8PbQ9zqiwszXAdTBzHpD6G3mSBsT3ZI\n\
CTARrlSjL17aj4FcH7NlHQmH6jE+lf0m3ktzXo2y+V0aeX+zAgMBAAGjUDBOMB0G\n\
A1UdDgQWBBTmqUNbzJumi92sMLzQBXVie0+APTAfBgNVHSMEGDAWgBTmqUNbzJum\n\
i92sMLzQBXVie0+APTAMBgNVHRMEBTADAQH/mA0GCSqGSIb3DQEBCwUAA4IBAQDC\n\
6UBadJxukIsSQMKCA5J2SOGzQp28IkVOmD+xoKp7ewp8GW6m4GVZg1Jnoi1FfC3R\n\
MCjVFgXHsDY8rAAhlIt9aMSeElquN/9R/y7WzYzRQflf6Pz8RcPDIepz113DFCXk\n\
jmIXedBWHJBkN6WuK5UMcMhUYfTqy/jbD3ZsbfF//zNsJrLOhHOVOn+oXkDZVbWX\n\
P5E5LI7B+cYMNRHusqyWPX1J78dgM+xikKZere7iY0Y38muOiPlcLmEty4uYgB4M\n\
xrqau3x80HvzhBzmdXfmAIpLLwQpCeUe105EAfewYPUDstwyOy00THTzZdAqFw8v\n\
/gQNfYEUcxYWky4bgFwQ\n\
-----END CERTIFICATE-----\n";




 BIO * cbio = BIO_new_mem_buf(cacrt, strlen(cacrt));
 X509 * cert = PEM_read_bio_X509(cbio, NULL, 0, NULL); //PEM格式
 X509_STORE_add_cert(net->ctx->cert_store, cert);
 X509_free(cert);
 BIO_free(cbio);