在Windows上使用带有OpenSSL的受信任证书

Question

I'm using OpenSSL on Windows and would like to use a certificate in Windows Certificate Storage as a trusted CA container with CASSL_CTX_load_verify_locations() . Unfortunately, OpenSSL only supports PEM files and don't allow direct access to the Windows Certificate Storage. How can I make this work on Windows, do I have to use the Windows CryptoAPI and dump the certificate as a PEM file to disk or is there a better way of doing this?

Answer 1

OpenSSL also supports DER format or PKCS #8 format. You can get certificate in PKCS #8 or DER format using CryptoAPI and then load them into the certificate store given by OpenSSL. So, there is better way of doing it. Once you have certificate in DER format, you can used d2i functions to get certificate into X509 certificate.