<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<div class="moz-cite-prefix">On 12/26/2017 13:14, Salz, Rich via
openssl-users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:E7D22FD2-598B-4D62-9346-4703F770391B@akamai.com">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
<div class="WordSection1">
<p class="MsoNormal">So if you put locks around the SSL_CTX
object when it’s used, then you can use the set private key
call to update the key; and then all SSL_new objects
afterwards will use the new credentials. Does that meet your
need?</p>
</div>
</blockquote>
Yes, that I already know how to do. The issue is how to get the key
from a PEM file into a format that I can feed it with set private
key. There doesn't appear to be a means to "un-file-ify" the set
private key functions.<br>
<blockquote type="cite"
cite="mid:E7D22FD2-598B-4D62-9346-4703F770391B@akamai.com">
<div class="WordSection1">
<p class="MsoNormal"><o:p></o:p></p>
<p>> "is there a decent way to convert a PEM or DER private
key file into ASN.1" using OpenSSL calls (from a "C" program,
not from the command line; we'll assume I have the key and
cert files already.)</p>
<p>I assume you mean “native C structure” and not ASN1? Because
DER is just the ASN1 serialized, and PEM is base64 encoded DER
with marker lines. …<o:p></o:p></p>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
So if I take a PEM private key file, strip the markers, and turn the
actual key's base64 into binary (assuming an RSA key, so there's no
"EC parameter" block in front) I now have an "opaque" unsigned
character array of length "len" (the decoded Base64) which
SSL_CTX_use_privateKey_ASN1 will accept? (Assuming the key file is
unencrypted, of course.)<br>
<br>
What is the parameter "pk" passed to the call in that instance (it's
not in the man page)<br>
<pre class="code" style="font-family: monospace; padding: 0px 2em 0px 0px; color: rgb(68, 68, 68); font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial;">int SSL_CTX_use_PrivateKey_ASN1(int pk, SSL_CTX *ctx, unsigned char *d, long len);</pre>
And likewise, I can just bytewise load a DER file (e.g. read() it
into a memory buffer) and then pass that as it's simply a binary
copy of the Base64 contained within the markers (plus the EC
parameters if it's an ECDSA key)?<br>
<br>
If so that makes it materially easier than I thought it would be....<br>
<br>
<div class="moz-signature">-- <br>
Karl Denninger<br>
<a href="mailto:karl@denninger.net">karl@denninger.net</a><br>
<i>The Market Ticker</i><br>
<font size="-2"><i>[S/MIME encrypted email preferred]</i></font>
</div>
</body>
</html>