OpenSSL如何以DER格式加载CA证书

Question

I am new to OpenSSL, so forgive me if I ask anything stupid.

I need to convert an existing server project which uses axTLS to OpenSSL. As the server requires client authentication, I need to load the server cert file, private key file and the CA cert file. All 3 files are in DER format.

For server cert file and private key file, I can use SSL_CTX_use_certificate_file() and SSL_CTX_use_PrivateKey_file() to load a DER format file (ASN1 format). However, I couldn't find any API that loads the CA cert in DER format. SSL_CTX_load_verify_locations() and SSL_load_client_CA_file() seem only work for PEM format.

Any other API/method I can use to work around this issue?

Thank you.

Answer 1

I will answer my own question. As what Yu Hao said, there seems to be no API available in OpenSSL to load a CA cert in DER(ANS1) format. I had to get the PEM format version of CA cert to use in the end.

Answer 2

First of all, DER files can have .crt , .cer , and .der endings.

As for your question it may be one of many issues. Does your existing server project already work, and to what extent?

Could you first try and convert the DER file to PEM and tell us how it went?

openssl x509 -inform der -in certificate.cer -out certificate.pem