SSL_CTX_use_PrivateKey_file

[Julian Onions]

Hi,
I've been attempting to use the SSL_CTX_use_PrivateKey_file to load
in private keys for SSL/TLS usage. It states in the documentation that
"SSL_CTX_use_PrivateKey_file() adds the first private key found in file
to ctx. The formatting type of the certificate must be specified from
the known types SSL_FILETYPE_PEM, SSL_FILETYPE_ASN1."

However after some experimentation and tracing the code it seems that
actually you can only use PEM format. I was hoping that I could use P12
files for the private key. Is there something similar I can use?

Julian.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List openssl-users-MCmKBN63+***@public.gmane.org
Automated List Manager majordomo-MCmKBN63+***@public.gmane.org

[Lutz Jaenicke]

Post by Julian Onions
Hi,
I've been attempting to use the SSL_CTX_use_PrivateKey_file to load
in private keys for SSL/TLS usage. It states in the documentation that
"SSL_CTX_use_PrivateKey_file() adds the first private key found in file
to ctx. The formatting type of the certificate must be specified from
the known types SSL_FILETYPE_PEM, SSL_FILETYPE_ASN1."
However after some experimentation and tracing the code it seems that
actually you can only use PEM format. I was hoping that I could use P12
files for the private key. Is there something similar I can use?

Hmm. PEM is base64 encoded ASN1(=DER).

P12 is a completely different beast. You can however use OpenSSL's PKCS12
support routines to extract the EVP_PKEY private key from it and then
enable it using SSL_CTX_use_PrivateKey().
Sorry, it seems that there is no documentation about the PKCS12_* family
of functions available at this time.

Best regards,
Lutz

[Michael Voucko]

Post by Julian Onions
Hi,
I've been attempting to use the SSL_CTX_use_PrivateKey_file to load
in private keys for SSL/TLS usage. It states in the documentation that
"SSL_CTX_use_PrivateKey_file() adds the first private key found in file
to ctx. The formatting type of the certificate must be specified from
the known types SSL_FILETYPE_PEM, SSL_FILETYPE_ASN1."
However after some experimentation and tracing the code it seems that
actually you can only use PEM format. I was hoping that I could use P12
files for the private key. Is there something similar I can use?
Julian.
______________________________________________________________________
OpenSSL Project http://www.openssl.org

Sure, try something like

<<<

FILE *PKCS12File;
PKCS12 *pkcs12;
X509 *Cert;
EVP_PKEY *PrivateKey;
STACK_OF(X509) *CertChain;

PKCS12File = fopen(FileUrl, "rb");
if (!PKCS12File)
handle error ...

P12 = d2i_PKCS12_fp(PKCS12File, NULL);
fclose(PKCS12File);
if (!P12)
handle error ...

if (!PKCS12_parse(P12, Password, &PrivateKey, &Cert, CertChain))
handle error ...
Now all information contained in the P12 is at hand, do what ever you've
planned to do.

Michael
--
Fillmore Labs GmbH
Michael Voucko
Triforum C2
Frankfurter Str. 233
63263 Neu-Isenburg
Germany
Phone [phone]
Fax [phone]
mailto:voucko-0244YT3jnxrMn+dqGv/MrAC/***@public.gmane.org

______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List openssl-users-MCmKBN63+***@public.gmane.org
Automated List Manager majordomo-MCmKBN63+***@public.gmane.org

[Julian Onions]

Thanks for the info on private keys and P12 files. I think the documentation
should be updated though - as really you can only pass in the SSL_FILETYPE_PEM
to the operation.

My next question - there seems to be support in the code for dealing
with CRL's - but as far as I can tell, it will only load in a CRL if
you tell it too. The default certificate validation routines will not check
for CRLs at least as far as I can see.

How do you tempt the verifcation routines to check for the presence of
CRLs?

Julian.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List openssl-users-MCmKBN63+***@public.gmane.org
Automated List Manager majordomo-MCmKBN63+***@public.gmane.org