<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Victor-</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks for the info. I think I'm going to use:</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
X509 *SSL_CTX_get0_certificate(const SSL_CTX *ctx)<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:15px;background-color:rgb(255, 255, 255);display:inline !important">EVP_PKEY
pkey = X509_get_pubkey(cert);</span><br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:15px;background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:15px;background-color:rgb(255, 255, 255);display:inline !important">(also
suggested by Selva) The reason is, and to answer some of your questions, all of this is taking place well before any handshakes, so the SSL object doesn't come into play at this point. We do allow users to specify both an RSA and EC cert/key pair, but the
order in which we set them up will work since these functions operate on the last one to load. If the certificate loads, that's great, but we also tell our users if they specified an RSA cert if it's really a EC cert, etc. We also do some checks on the certificate,
like if it's expired, or not valid yet; that's why I chose SSL_CTX_get0_certificate() above, so I have the X509 certificate object to make those checks, with X509_get0_notBefore(), etc.</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:15px;background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:15px;background-color:rgb(255, 255, 255);display:inline !important">In any
case, things appear to be working now, but I'm hitting an issue later on when calling SSL_CTX_build_cert_chain(). I working on debugging that, I may have to start yet another thread later.</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:15px;background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:15px;background-color:rgb(255, 255, 255);display:inline !important">Thanks,</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:15px;background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:15px;background-color:rgb(255, 255, 255);display:inline !important">Jason</span></div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> openssl-users <openssl-users-bounces@openssl.org> on behalf of Viktor Dukhovni <openssl-users@dukhovni.org><br>
<b>Sent:</b> Tuesday, November 2, 2021 9:01 PM<br>
<b>To:</b> openssl-users@openssl.org <openssl-users@openssl.org><br>
<b>Subject:</b> Re: X509_get_pubkey() in OpenSSL 3.0?</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">On Tue, Nov 02, 2021 at 08:28:01PM +0000, Jason Schultz wrote:<br>
> Victor-<br>
> <br>
> I can't seem to find any documentation on SSL_CTX_get0_privatekey(),<br>
> but by the name of it, it sounds like it's getting the private key;<br>
> I'm trying to get the public key.<br>
<br>
It does appear to be "under-documented" (i.e. not at all), perhaps<br>
that could be addressed. Note that you can get a public key from<br>
the private key.<br>
<br>
> That said, I should probably explain more of why I'm doing what I'm<br>
> doing, because there may be an easier way all together. Basically, we<br>
> allow configuring RSA or EC certificates/keys, and I want to get the<br>
> public key so I can check the type of key with a call to:<br>
> <br>
> EVP_PKEY_base_id(pubkey);<br>
<br>
Which you can equally get from the private key, but there's also:<br>
<br>
SSL_CTX_get0_certificate (sadly also "under-documented")<br>
<br>
which means that you certainly don't need to read the PEM file again.<br>
<br>
> So maybe there's a better way? After I call:<br>
> <br>
> SSL_CTX_use_certificate_file(ctx,<certfile>,SSL_FILETYPE_PEM);<br>
> <br>
> Is there an API I can call passing the ctx that will tell me what type<br>
> of certificate is in use for that ctx? Or something else along those<br>
> lines?<br>
<br>
Also once you have an (SSL *) handle you can call SSL_get_certificate(3)<br>
which is documented, and proceed from there.<br>
<br>
> It's very possible I'm overcomplicating things with the fopen(),<br>
> PEM_read_X509(), X509_get_pubkey() sequence, so any suggestions on how<br>
> to better accomplish this verification are welcome.<br>
<br>
Yes. Query the data you already have in memory.<br>
<br>
Note that a context can be configured with *both* an RSA certificate<br>
chain *and* an EC certificate chain. The above functions return the one<br>
most recently loaded, but a handshake with a peer may select one of<br>
the other chains.<br>
<br>
Most applications only load keys for just one algorithm, but in general<br>
more may be present.<br>
<br>
It is surprising that you care which algorithm is in cert/keys. So<br>
long as it loads, why does it matter?<br>
<br>
If you want to log data for each handshake, at that point you can use<br>
SSL_get_certificate(3) for the cert actually selected by this handshake<br>
on the local end:<br>
<br>
<a href="https://github.com/vdukhovni/postfix/blob/master/postfix/src/tls/tls_misc.c#L950-L953">
https://github.com/vdukhovni/postfix/blob/master/postfix/src/tls/tls_misc.c#L950-L953</a><br>
<br>
-- <br>
Viktor.<br>
</div>
</span></font></div>
</div>
</body>
</html>