2

我正在尝试发送以 base 64 编码的 WSSE DSA 公钥。我一直在尝试使用 Open SSL 库将公钥与证书文件分开，但似乎 OpenSSL 使用我的整个证书文件而不是提取只是公钥。

File.open("path/certificate.cer", 'rb') do |file|
  cert_file = file.read()
  cert = OpenSSL::X509::Certificate.new cert_file
end
cert_string = (cert.public_key.to_s+"").delete("\n") #it was formatting itself with newlines
cert_string = cert_string[26..-25] #the start/end messages aren't sent
puts cert_string
4

1 回答 1

2

这是我用来从证书中提取公钥的代码。我将它用于公钥固定，因此它使用SSL*来自连接的 a。

本质上，您调用len1 = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), NULL)一次以获取长度，然后调用len2 = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), buffer)第二次以检索证书。您可以使用len1andlen2作为基本的健全性检查，以确保您获得了预期的字节数。

int pin_peer_pubkey(SSL* ssl)
{
    if(NULL == ssl) return FALSE;
    
    X509* cert = NULL;
    
    /* Scratch */
    int len1 = 0, len2 = 0;
    unsigned char *buff1 = NULL;
    
    /* Result is returned to caller */
    int ret = 0, result = FALSE;
    
    do
    {
        /* http://www.openssl.org/docs/ssl/SSL_get_peer_certificate.html */
        cert = SSL_get_peer_certificate(ssl);
        if(!(cert != NULL))
            break; /* failed */
        
        /* Begin Gyrations to get the subjectPublicKeyInfo       */
        /* Thanks to Viktor Dukhovni on the OpenSSL mailing list */
        
        /* http://groups.google.com/group/mailing.openssl.users/browse_thread/thread/d61858dae102c6c7 */
        len1 = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), NULL);
        if(!(len1 > 0))
            break; /* failed */
        
        /* scratch */
        unsigned char* temp = NULL;
        
        /* http://www.openssl.org/docs/crypto/buffer.html */
        buff1 = temp = OPENSSL_malloc(len1);
        if(!(buff1 != NULL))
            break; /* failed */
        
        /* http://www.openssl.org/docs/crypto/d2i_X509.html */
        len2 = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), &temp);

        /* These checks are verifying we got back the same values as when we sized the buffer.      */
        /* Its pretty weak since they should always be the same. But it gives us something to test. */
        if(!((len1 == len2) && (temp != NULL) && ((temp - buff1) == len1)))
            break; /* failed */
        
        /* End Gyrations */
        
        /* Do something with the public key */
        ...

        ret = TRUE;
        
    } while(0);          
    
    /* http://www.openssl.org/docs/crypto/buffer.html */
    if(NULL != buff1)
        OPENSSL_free(buff1);
    
    /* http://www.openssl.org/docs/crypto/X509_new.html */
    if(NULL != cert)
        X509_free(cert);
    
    return result;
}

在 SOAP 中使用 WSSE 在 Ruby 中发送以 Base 64 编码的公钥...

好吧，这是您可以解决的协议细节。您可以将其作为原始字节、Base64 编码（RFC 4648，第 4 节）或 Base64URL 编码（RFC 4648，第 5 节）发送并发送。由你决定。

于 2014-06-09T20:54:27.590 回答