verify client certificate

[yongw]

When I use verifycallback lik this:




int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
        {
        char buf[256];
        X509 *err_cert;
        int err,depth;

        err_cert=X509_STORE_CTX_get_current_cert(ctx);
        err=    X509_STORE_CTX_get_error(ctx);
        depth=  X509_STORE_CTX_get_error_depth(ctx);

        X509_NAME_oneline(X509_get_subject_name(err_cert),buf,256);

     printf("depth=%d %s\n",depth,buf);
        if (!ok)
                {
            printf("verify error:num=%d:%s\n",err,
                        X509_verify_cert_error_string(err));
                if (verify_depth >= depth)
                        {
                        ok=1;
                        verify_error=X509_V_OK;
                        }
                else
                        {
                        ok=0;
                        verify_error=X509_V_ERR_CERT_CHAIN_TOO_LONG;
                        }
                }

        switch (ctx->error)
                {
        case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
        
X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert),buf,256);
                printf("issuer= %s\n",buf);
                break;
        case X509_V_ERR_CERT_NOT_YET_VALID:
        case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
                printf("notBefore=");
     // printf(X509_get_notBefore(ctx->current_cert));
//              BIO_printf(bio_err,"\n");
                break;
        case X509_V_ERR_CERT_HAS_EXPIRED:
        case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
                printf("notAfter=");
//
ASN1_TIME_print(bio_err,X509_get_notAfter(ctx->current_cert));
//              BIO_printf(bio_err,"\n");
                break;
                }
            printf("verify return:%d\n",ok);
        return(ok);
        }








but I got these message:


verify error:num=20:unable to get local issuer certificate

verify error:num=27:certificate not trusted

verify error:num=21:unable to verify the first certificate



How can I verify the client certificate?

______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
User Support Mailing List                    [EMAIL PROTECTED]
Automated List Manager                           [EMAIL PROTECTED]