c - 如何通过 openssl 检索 ssl 证书的颁发者替代名称

Question

我可以获得主题替代名称，例如

 X509_NAME_get_text_by_NID(X509_get_subject_name(x), NID_subject_alt_name, hc->https_domain_name, 256)

通过将 2. 参数更改为NID_issuer_alt_name使用相同的方法，我期望获得颁发者名称，例如；

X509_NAME_get_text_by_NID(X509_get_subject_name(x), NID_issuer_alt_name, hc->https_ca_name, 256);

但相反，我得到一个空字符串。如何正确检索发行人替代名称？

Answer 1

您可以按照https://github.com/iSECPartners/ssl-conservatory中的建议尝试以下解决方案：

static HostnameValidationResult matches_subject_alternative_name (const char *hostname, const X509 *server_cert) {
    HostnameValidationResult result = MatchNotFound;
    int i;
    int san_names_nb = -1;
    STACK_OF(GENERAL_NAME) *san_names = NULL;

    // Try to extract the names within the SAN extension from the certificate
    san_names = X509_get_ext_d2i((X509 *) server_cert, NID_subject_alt_name, NULL, NULL);
    if (san_names == NULL) {
        return NoSANPresent;
    }
    san_names_nb = sk_GENERAL_NAME_num(san_names);

    // Check each name within the extension
    for (i=0; i<san_names_nb; i++) {
        const GENERAL_NAME *current_name = sk_GENERAL_NAME_value(san_names, i);

        if (current_name->type == GEN_DNS) {
            // Current name is a DNS name, let's check it
            char *dns_name = (char *) ASN1_STRING_data(current_name->d.dNSName);

            // Make sure there isn't an embedded NUL character in the DNS name
            if (ASN1_STRING_length(current_name->d.dNSName) != strlen(dns_name)) {
                result = MalformedCertificate;
                break;
            }
            else { // Compare expected hostname with the DNS name
                if (strcasecmp(hostname, dns_name) == 0) {
                    result = MatchFound;
                    break;
                }
            }
        }
    }
    sk_GENERAL_NAME_pop_free(san_names, GENERAL_NAME_free);

    return result;
}

希望能帮助到你 ！

Answer 2

在您使用 NID_issuer_alt_name 常量调用 X509_NAME_get_text_by_NID 时，我会将 X509_get_subject_name(x) 替换为 X509_get_issuer_name(x)。我认为这应该可以解决您的问题。