<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif;font-size:16px"><div id="yui_3_16_0_1_1437507453899_54909"><span>Shoot, I need that functionality. Can I perhaps use the </span>X509 *load_cert(BIO *err, const char *file, int format, const char *pass, ENGINE *e, const char *cert_descrip) function then? If yes, then can someone elaborate on how to use this function? Thanks</div> <br><div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif; font-size: 16px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif; font-size: 16px;"> <div dir="ltr"> <font size="2" face="Arial"> On Tuesday, 21 July 2015 8:19 PM, Victor Wagner <vitus@wagner.pp.ru> wrote:<br> </font> </div> <br><br> <div class="y_msg_container">On Tue, 21 Jul 2015 13:58:21 +0000 (UTC)<br clear="none">Anirudh Raghunath <<a shape="rect" ymailto="mailto:anirudhraghunath@rocketmail.com" href="mailto:anirudhraghunath@rocketmail.com">anirudhraghunath@rocketmail.com</a>> wrote:<br clear="none"><br clear="none">> Ah okay, that clears up quite a lot of doubts. But the certificate I<br clear="none">> want to load is a self signed certificate which has a private key<br clear="none">> attached to it. I used the XCA application to export the<br clear="none">> certificate-private key pair as a p12 file to the smart card. What<br clear="none">> should I do to get the certificate in this case? Thanks.<br clear="none">> <br clear="none"><br clear="none">It doesn't matter how you've installed certificate into smart card.<br clear="none">Once it, and its corresponding private key is installed on the card,<br clear="none">you can access them separately, using PKCS#11 API (and command-line<br clear="none">pkcs11-tool utility). So, you can extract just certificate from<br clear="none">certificate-private key pair and put it into the file (but typically<br clear="none">you cannot extract private key. You can only use PKCS11 API or OpenSSL<br clear="none">ENGINE API on top of it to perform cryptographic operations with this<br clear="none">private key. This is what smartcards are for). <br clear="none"><br clear="none">If you have opensc pkcs11 engine, you also should have pkcs11-tool from<br clear="none">opensc project.<br clear="none"><br clear="none">Use <br clear="none"><br clear="none">pkcs11-tool --module <your pkcs11 module> --list-objects<br clear="none"><br clear="none">to find out which certificate-private key pairs are available on your<br clear="none">card (you probably already know ID of your key pair, because you've used<br clear="none">ENGINE_load_private_key, and it requires key id as argument).<br clear="none"><br clear="none">Then use<br clear="none"><br clear="none">pkcs11-tool --module <your pkcs11 module> --write-object <id> <br clear="none"> --type cert --output-file filename.der<br clear="none"><br clear="none">to extract certificate from card. You can then convert it to pem<br clear="none">format using <br clear="none"><br clear="none">openssl x509 -in filename.der -inform DER -out filename.pem<br clear="none"><br clear="none">or can just use function SSL_CTX_use_certificate_file passing<br clear="none">SSL_FILETYPE_ASN1 as its argument.<br clear="none"><br clear="none">Personally I consider it ugly that one need to extract certificate from<br clear="none">token before it can be used in openssl-based applications for any<br clear="none">purpose except SSL-client authentication.<br clear="none"><br clear="none">Function<br clear="none"><br clear="none">int ENGINE_load_certificate(ENGINE *e, const char *key id,<br clear="none"> UI_METHOD *ui_method, void *callback_data)<br clear="none"><br clear="none">is clearly missing from API.<br clear="none"><br clear="none">Existence of such function would allow to use smartcards and other<br clear="none">hardware tokens to be used<br clear="none"><br clear="none">1. In the server applications<br clear="none">2. In the non-SSL (i.e. CMS signing) applications<br clear="none">3. For secondary protocols like OCSP or timestamping authority.<div class="yqt9399236307" id="yqtfd16746"><br clear="none">_______________________________________________<br clear="none">openssl-users mailing list<br clear="none">To unsubscribe: <a shape="rect" href="https://mta.openssl.org/mailman/listinfo/openssl-users" target="_blank">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>