如何使用 openSSL 从 const char* 加载证书？ [复制]

Question

这个问题在这里已经有了答案：

从字符串而不是从文件加载 SSL CA 2 个答案

C++/OpenSSL：使用来自缓冲区而不是文件的根 CA（SSL_CTX_load_verify_locations） （1 个答案）

从 memory 读取证书文件，而不是使用 OpenSSL 的文件（4个答案）

2 小时前关闭。

我开始使用 SSL 并尝试加载在我的应用程序中硬编码的证书，而不是从我的文件系统上的文件中加载它，因为 endtarget 将没有文件系统。

在读取外部认证文件时，我设法使其工作，即通过引用我笔记本电脑上的文件，如下所示：

SSL_CTX_load_verify_locations(ctx, "cert.pem", NULL) 

但是由于我在我的客户端中删除了它并在我的程序中对证书的内容进行了硬编码，所以我无法再连接到我的服务器了。 服务器仍然从文件系统加载其证书（为了不一次修改所有内容）。 我在这里做错了吗？ 运行时会显示以下错误：

$./sslServer 140680272634496:error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca:../ssl/record/rec_layer_s3.c:1543:SSL alert number 48 Failed to accept ssl connection from client

$./sslClient 连接服务器失败。 139637226889856：错误：1416F086：SSL 例程：tls_process_server_certificate：证书验证失败：../ssl/statem/statem_clnt.Z4A8A08F09D37B73795649038408B5F3:1913

我根据 openSSL 本身提供的演示编写了这些示例，即他们的 echoserver： https://github.com/openssl/openssl/tree/master/demos/sslecho

适用的演示代码：

服务器：

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <errno.h>
#include <string.h>

#include <openssl/bio.h>
#include <openssl/ssl.h>
#include <openssl/err.h>

int main(void)
{
    /* SSL. */
    //InitializeSSL();
    SSL_CTX *ctx = SSL_CTX_new(TLS_server_method());

    /* Set the key and cert */
    if (SSL_CTX_use_certificate_chain_file(ctx, "cert.pem") <= 0) 
    {
         //ERR_print_errors_fp(stderr);
        fprintf(stderr, "Certification file failure: %s.\n", strerror(errno));
    return -1;
    }

    if (SSL_CTX_use_PrivateKey_file(ctx, "key.pem", SSL_FILETYPE_PEM) <= 0) 
    {
        //ERR_print_errors_fp(stderr);
        fprintf(stderr, "Key failure: %s.\n", strerror(errno));
    return -1;
    }    

    /* Socket. */
    const int sockFd = socket(AF_INET, SOCK_STREAM, 0);
    if (sockFd< 0)
    {
        fprintf(stdout, "Failed to create socket.\n");
        return -1;
    }

    struct sockaddr_in serv_addr = {0};
    serv_addr.sin_family = AF_INET;
    serv_addr.sin_addr.s_addr = htonl(INADDR_ANY);
    serv_addr.sin_port = htons(8080);

    if (bind(sockFd, (struct sockaddr*)&serv_addr, sizeof(serv_addr)) < 0)
    {
        fprintf(stderr, "Failed to bind: %s.\n", strerror(errno));
    return -1;
    }

    if (listen(sockFd, 10) < 0)
    {
        fprintf(stderr, "Failed to listen: %s.\n", strerror(errno));
        return -1;
    } 

    int peerFd = accept(sockFd, (struct sockaddr*)NULL, NULL);
    if (peerFd < 0)
    {
        fprintf(stderr, "Failed to accept: %s.\n", strerror(errno));
    return -1;
    }

    /* Transform TCP to SSL. */
    SSL* ssl = SSL_new(ctx);
    SSL_set_fd(ssl, peerFd);

    if (SSL_accept(ssl) < 0)
    {
        ERR_print_errors_fp(stderr);
        fprintf(stderr, "Failed to accept ssl connection from client: %s.\n", strerror(errno));
        return -1;
    }

    char rxBuff[50]={0};

    SSL_read(ssl, rxBuff, sizeof rxBuff);
    fprintf(stdout, "rxbuff: %s\n", rxBuff);

    return 0;
}

客户：

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <errno.h>
#include <string.h>

#include <openssl/bio.h>
#include <openssl/ssl.h>
#include <openssl/err.h>

const char* localCert = 
{"-----BEGIN CERTIFICATE-----\r\n"
"MIIFkzCCA3ugAwIBAgIUAJYoj5pfMy0ULg2Ea/HjT4VD2gMwDQYJKoZIhvcNAQEL\r\n"
"BQAwWTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM\r\n"
"GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDESMBAGA1UEAwwJbG9jYWxob3N0MB4X\r\n"
"DTIyMDkyNTE4MTE1NFoXDTMyMDkyMjE4MTE1NFowWTELMAkGA1UEBhMCQVUxEzAR\r\n"
"BgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5\r\n"
"IEx0ZDESMBAGA1UEAwwJbG9jYWxob3N0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8A\r\n"
"MIICCgKCAgEAwRwh/qVPRTQ8JhngUWAbLo2BQu29WDR50Hx/DZjhvTg+CzLkJ1PN\r\n"
"LW5mk9r/2DBU1Pe76iYdeQOJ179ulC1wDPfVrd5FkjNPtAOW5FYU8RQCOdYhOFyu\r\n"
"cXrdsW6+talyEqqxVEb0gAZ/TncEG0ur/oYg+Z2+pahFBxL1TTiVrM2yGYoc4SU7\r\n"
"rsrP7Kt9PtXTObo4Sw6yQzCIBYinvqOeGrf8aId8M/FyRLOppfw9Duk57oCw8+WW\r\n"
"huM3pPC1yjtjLR/yMEDzmmuAWcBfUB1wlvGwiNprTuPzYqoEfy/4d1O6v7DE0Zsi\r\n"
"MzzegKTaw3nw/oQb6fDcTYJX8izx6MGGvbm4UsMgc5Ijwlw1TqG/8NyZYjUUo2AM\r\n"
"ykfzuveVcym9mQmhsUnpb8hcAFOLR+Ce+3i57j/VuVczLjp7LnzRdMBShasgpeqL\r\n"
"LcC7IB83Yh+jdInf0PhXebLzEJ92sp9OhBW2qo+ebsQ+uBrKZFhapk3Hnrcuws/4\r\n"
"aF1kBu1L3ldWaPdvjLBWhXFWs2Xt6YoINu76Mx9lWTtjZ8WbbMEpi/wJ7bWGoo1l\r\n"
"QYi5UrHq7Vv+3AxXAFNg7yHFb7TMt0BycvZwxvgiyR4M2vW5jimgr+RIb7pxcYQB\r\n"
"RGhNmPltK8c8wTcVJngWK/c3o7DCGXa1iBwA889QYjg27rl2jW5/Z30CAwEAAaNT\r\n"
"MFEwHQYDVR0OBBYEFEmY7//80Gr0EW0pjckwy8KQbEZlMB8GA1UdIwQYMBaAFEmY\r\n"
"7//80Gr0EW0pjckwy8KQbEZlMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL\r\n"
"BQADggIBAK7LkoEh3HYIvOuzEGtaKbGhcq/LnETFYlrwuCM/y5rU+15C5Puhs9jy\r\n"
"zlRBK4IkkxV+YGgyMZXllNxQpkXY3MzRBXt2lEjrZEw6YgaLU9YMRDAXPEzTmBKo\r\n"
"4AOZDtorFBYy6xqc86fBBv9psvK1EDMlk5dDOhl0sCtnwwC4cgS9qkBz7vfSfq50\r\n"
"6H8oCx3fdvPv6DcEcB5UMjrbjoUi+TCXufeNhp0U1YSFIy/SICpXHKFjF1WJWsdz\r\n"
"jweLv19HfY7UBucsj088L6Les0f2AFQeodPE+AE1MdGxsIxTewqu7jf/LvkW0X3S\r\n"
"Lr4loUEvvoxUjsJjT81iJqIodqyIBnQAM+ocHQWpUXrQk/eA2WlHXluIY8FCxYdn\r\n"
"DroziNWPr1C5za9NjDMP/eomHHlX52z+bly11x57LSfsRWKyq9YrRL8i0rRj1vf6\r\n"
"QanEifGpGGNE6cdrP1LnW7sO9ipA+8UK79LPPNGAuq9+R1Yzjdl94InPnQ8wEbPx\r\n"
"zkWGf4pW1rWBDHV7mng6eem5yLQBQP51ARqgD78m7HgbyyTgCYLgrnYHBXtqwS0u\r\n"
"sCgAGlULZVqdW4eiDLMauTko/LxSQp8gd9g4I1H6b8s3DXkyFsYeBqvb1VAmdoGR\r\n"
"ja7ShQrXMW+p/JXzOmx8TKSuyzw1FJImGGwpnP664wr/pK3/SNRo\r\n"
"-----END CERTIFICATE-----\r\n"};

int main(void)
{
    /* SSL. */
    //InitializeSSL();
    SSL_CTX *ctx = SSL_CTX_new(TLS_client_method());

    /* Set the key and cert */
    SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);

    //TODO: remove this in final app. Cf echo server example of openssl to see why.
    //if (!SSL_CTX_load_verify_locations(ctx, "cert.pem", NULL))  //<--- this works fine, ie referring to the certificate file on my laptop instead of using the localCert global variable above
    BIO* cbio = BIO_new(BIO_s_mem());  
    BIO_puts(cbio, (const char*)localCert);
    if (cbio == NULL)
    {
        fprintf(stdout, "BIO new failed.\n");
        return -1;
    }

    X509 *cert = PEM_read_bio_X509(cbio, NULL, NULL, NULL);
    if (cert == NULL)
    {
        fprintf(stderr, "Failed to load certificate: %s.\n", strerror(errno));
        return -1;
    }

    SSL_CTX_use_certificate(ctx, cert);

    /* Socket. */
    const int sockFd = socket(AF_INET, SOCK_STREAM, 0);
    if (sockFd< 0)
    {
    fprintf(stdout, "Failed to create socket.\n");
        return -1;
    }

    struct sockaddr_in serv_addr = {0};
    serv_addr.sin_family = AF_INET;
    serv_addr.sin_port = htons(8080);

    if(inet_pton(AF_INET, "127.0.0.1", &serv_addr.sin_addr)<=0)
    {
        fprintf(stderr, "\n inet_pton error occured\n");
        return 1;
    }

    if (connect(sockFd, (struct sockaddr*) &serv_addr, sizeof serv_addr) < 0)
    {
        fprintf(stderr, "Failed to connect:%s.\n", strerror(errno));
    return -1;
    }

    /* Transform TCP to SSL. */
    SSL* ssl = SSL_new(ctx);
    SSL_set_fd(ssl, sockFd);

    SSL_set_tlsext_host_name(ssl, "localhost");
    /* Configure server hostname check */
    SSL_set1_host(ssl, "localhost");

    /* Now do SSL connect with server */
    if (SSL_connect(ssl) == 1) 
    {
        char txBuff[50]= "Hello world";

        SSL_write(ssl, txBuff, sizeof txBuff);
        fprintf(stdout, "data sent to server.\n");
    }
    else
    {
        fprintf(stderr, "Failed to connect to server.\n");
        ERR_print_errors_fp(stderr);
    return -1;
    }

    return 0;
}