About certificate sha1 thumbprint

This is a multi-part message in MIME format.

------_=_NextPart_001_01C8580C.DCCAF216
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi, all,

Sorry to interrupt. I had put this thread to [email]openssl-users@openssl.org[/email]
but it seemed that I could not get this ticket from
[email]openssl-users@openssl.org[/email]. So there may be something wrong with it. So I
am trying this mailing list instead and hope some of you can help me.

I am trying to define my own certificate verification function through
the API "SSL_CTX_set_cert_verify_callback". This own certificate
verification callback will

check the thumbprint of the peer certificate. In this callback the
thumbprint of certificate is calculated through the API=20

"X509_digest(const X509 *data, const EVP_MD *type, unsigned char *md,
unsigned int *len)". And the param of "data" to pass in is
X509_STORE_CTX::cert.=20

I found the calculated result digest was different from what was
calculated by openssl command line tool. Is there something wrong with
my code? It looks like the following.

=20

static int ssl_certificate_thumbprint_verify_callback(X509_STORE_CTX
*ctx, void *arg)

{

unsigned char *thumbprint =3D (unsigned char *)arg;

X509 *cert =3D ctx->cert;

EVP_MD *tempDigest;

unsigned char tempFingerprint[EVP_MAX_MD_SIZE];

unsigned int tempFingerprintLen;

tempDigest =3D (EVP_MD*)EVP_sha1( );

if ( X509_digest(cert, tempDigest, tempFingerprint,
&tempFingerprintLen ) <=3D 0)

return 0;

if(!memcmp(tempFingerprint, thumbprint, tempFingerprintLen))

return 1;

return 0;

}

=20

Thanks.

=20

Liang

------_=_NextPart_001_01C8580C.DCCAF216
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered medium)">
<style>

</style>

</head>

<body lang=3DZH-CN link=3Dblue vlink=3Dpurple =
style=3D'text-justify-trim:punctuation'>

<div class=3DSection1 style=3D'layout-grid:15.6pt'>

Hi, =
all,<o:p></o:p>

 Sorry to =
interrupt.
I had put this thread to <a =
href=3D"mailto:openssl-users@openssl.org">openssl-users@openssl.org</a>
but it seemed that I could not get this ticket from <a
href=3D"mailto:openssl-users@openssl.org">openssl-users@openssl.org</a>. =
So there
may be something wrong with it. So I am trying this mailing list instead =
and
hope some of you can help me.<o:p></o:p>

  I =
am trying to
define my own certificate verification function through the API
“SSL_CTX_set_cert_verify_callback”. This own certificate =
verification callback
will<o:p></o:p>

check the =
thumbprint of
the peer certificate. In this callback the thumbprint of certificate is
calculated through the API <o:p></o:p>

“X509_digest(const =
X509
*data, const EVP_MD *type, unsigned char *md, unsigned int *len)”. =
And the
param of “data” to pass in is X509_STORE_CTX::cert. =
<o:p></o:p>

I found the =
calculated
result digest was different from what was calculated by openssl command =
line
tool. Is there something wrong with my code? It looks like the =
following.<o:p></o:p>

<o:p> </o:p></fon=
t>

static int
ssl_certificate_thumbprint_verify_callback(X509_STORE_CTX *ctx, void =
*arg)<o:p></o:p>

{<o:p></o:p></p=[color=blue]
>[/color]

    &nbsp=
;   
unsigned char *thumbprint =3D (unsigned char =
*)arg;<o:p></o:p>

    &nbsp=
;   
X509 *cert =3D ctx->cert;<o:p></o:p>

    &nbsp=
;   
EVP_MD           &=
nbsp;           &n=
bsp;   
      *tempDigest;<o:p></o:p>=


    &nbsp=
;   
unsigned char   =
tempFingerprint[EVP_MAX_MD_SIZE];<o:p></o:p>

    &nbsp=
;   
unsigned int      =
tempFingerprintLen;<o:p></o:p>

    &nbsp=
;   
tempDigest =3D (EVP_MD*)EVP_sha1( );<o:p></o:p>

    &nbsp=
;   
if ( X509_digest(cert, tempDigest, tempFingerprint, =
&tempFingerprintLen )
<=3D 0)<o:p></o:p>

    &nbsp=
;            =
 
return 0;<o:p></o:p>

    &nbsp=
;   
if(!memcmp(tempFingerprint, thumbprint, =
tempFingerprintLen))<o:p></o:p>

    &nbsp=
;            =
 
return 1;<o:p></o:p>

    &nbsp=
;   
return 0;<o:p></o:p>

}<o:p></o:p></p=[color=blue]
>[/color]

<o:p> </o:p></fon=
t>

Thanks.<o:p></o:p></fo=
nt>

<o:p> </o:p></fon=
t>

Liang<o:p></o:p></font=[color=blue]
>[/color]

</div>

</body>

</html>

------_=_NextPart_001_01C8580C.DCCAF216--
______________________________________________________________________
OpenSSL Project [url]http://www.openssl.org[/url]
Development Mailing List [email]openssl-dev@openssl.org[/email]
Automated List Manager [email]majordomo@openssl.org[/email]