<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif;font-size:16px"><div class="" id="yui_3_16_0_1_1437481194242_8895" dir="ltr">Ah
okay, that clears up quite a lot of doubts. But the certificate I want
to load is a self signed certificate which has a private key attached to
it. I used the XCA application to export the certificate-private key
pair as a p12 file to the smart card. What should I do to get the
certificate in this case? Thanks.<br class=""></div><div class="" dir="ltr" id="yui_3_16_0_1_1437481194242_8540"><span class=""><br class=""></span></div> <br><div class="qtdSeparateBR"><br><br></div><div style="display: block;" class="yahoo_quoted"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif; font-size: 16px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif; font-size: 16px;"> <div dir="ltr"> <font face="Arial" size="2"> On Tuesday, 21 July 2015 2:40 PM, Dr. Stephen Henson <steve@openssl.org> wrote:<br> </font> </div> <br><br> <div class="y_msg_container">On Tue, Jul 21, 2015, Victor Wagner wrote:<br clear="none"><br clear="none">> On Tue, 21 Jul 2015 06:58:24 +0000 (UTC)<br clear="none">> Anirudh Raghunath <<a shape="rect" ymailto="mailto:anirudhraghunath@rocketmail.com" href="mailto:anirudhraghunath@rocketmail.com">anirudhraghunath@rocketmail.com</a>> wrote:<br clear="none">> <br clear="none">> As far as I can understand, this function is designed to be called from<br clear="none">> the client certificate callback, set with function<br clear="none">> SSL_CTX_set_client_cert_cb. This callback gets pointer to SSL structure<br clear="none">> (which should be passed to ENGINE_load_ssl_client_cert) and can use<br clear="none">> SSL_get_client_CA_list to obtain list of CAs, which server would trust.<br clear="none">> (SSL protocol allows to send this list to client).<br clear="none">> <br clear="none"><br clear="none">It's intended to be called automatically when SSL_CTX_set_client_cert_engine<br clear="none">sets up a "client authentication ENGINE".<br clear="none"><br clear="none">> So, you would pass to the ENGINE_load_ssl_client_certs<br clear="none">> <br clear="none">> 1. reference to engine to use<br clear="none">> 2. pointer to SSL object of your client connection (don't know why it<br clear="none">> might be needed), <br clear="none"><br clear="none">This is there so the ENGINE can query other properties of the connection which<br clear="none">might decide which chain to use. For example the supported signature<br clear="none">algorithms.<br clear="none"><br clear="none">> <br clear="none">> Unfortunately, I do not know any engine which does all the things above.<br clear="none">> I've looked into source of OpenSC pkcs11 engine version 0.1.8 and found<br clear="none">> out that it doesn't support this function.<br clear="none">> <br clear="none"><br clear="none">The CrytpoAPI ENGINE performs some of these tasks but so far it is the only<br clear="none">one I'm aware of.<br clear="none"><br clear="none">Steve.<br clear="none">--<br clear="none">Dr Stephen N. Henson. OpenSSL project core developer.<br clear="none">Commercial tech support now available see: <a shape="rect" href="http://www.openssl.org/" target="_blank">http://www.openssl.org</a><div class="yqt4837645562" id="yqtfd11226"><br clear="none">_______________________________________________<br clear="none">openssl-users mailing list<br clear="none">To unsubscribe: <a shape="rect" href="https://mta.openssl.org/mailman/listinfo/openssl-users" target="_blank">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>