使用 OpenSSL 进行基于 X.509 证书的身份验证（不使用套接字）
OpenSSL 中是否有 SSL_set_connect_state()/SSL_set_accept_state() 的替代方案用于基于 X.509 证书的身份验证？
问题是在我的应用程序中，客户端和服务器不使用套接字进行通信，并且不可能在它们之间建立直接连接。因此，我希望 OpenSSL 能够“公开”中间 SSL 上下文建立消息，然后将其传达给另一端的一方。
感谢您的帮助！
Is there an alternative in OpenSSL to SSL_set_connect_state()/SSL_set_accept_state() for X.509 certificate based authentication?
The problem is that in my application the client and server do not communicate using sockets, and the establishment of direct connection between them is not possible. So what I want from OpenSSL is to 'expose' the intermediate SSL context establishment messages which I would then convey to the party at the other end.
Thanks for your help!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
OpenSSL
BIO接口可用于此目的。使用
BIO_new_bio_pair()创建一个连接的 BIO 对。 SSL 例程将读取和写入一个 BIO，您的应用程序将读取和写入另一个 BIO（允许它通过所需的任何方法将数据传递到另一端）。使用
SSL_set_bio()一个新的 SSL 对象，用于将读取和写入 BIO 设置为生成的一对 BIO 之一。在该对中的另一个 BIO 上使用
BIO_read()和BIO_write()来读取和写入 SSL 协议数据。照常使用
SSL_accept()、SSL_connect()、SSL_read()和SSL_write()SSL 对象。The OpenSSL
BIOinterface can be used for this.Use
BIO_new_bio_pair()to create a connected BIO pair. One BIO will be read from and written to by the SSL routines, and the other BIO will be read from and written to by your application (allowing it to pass the data to the other end by whatever method it desires).Use
SSL_set_bio()on a new SSL object to set both the read and write BIO to one of the BIOs in the pair generated.Use
BIO_read()andBIO_write()on the other BIO in the pair to read and write the SSL protocol data.Use
SSL_accept(),SSL_connect(),SSL_read()andSSL_write()as normal on the SSL object.是的，您可以使用与 SSL 套接字层内容相同的 X.509 验证例程。
http://openssl.org/docs/crypto/x509.html
文档似乎这里有点欠缺......（你会认为他们已经完成了 1.0 的所有工作）。我不能说我熟悉该库的这方面，但 openssl 附带了一个命令行 x509 验证工具。您应该能够查看其源代码以了解如何执行此操作。
http://openssl.org/docs/apps/verify.html
Yes, you can use the same X.509 verification routines that the SSL socket layer stuff would.
http://openssl.org/docs/crypto/x509.html
The documentation seems to be a bit lacking here... (you'd think they'd have finished it all for 1.0). I can't say I'm familiar with this aspect of the library, but openssl comes with a command line x509 verification tool. You should be able to peek in it's source code for how to do it.
http://openssl.org/docs/apps/verify.html