Re: pkcs#12 in openssl

Kaushalye Kapuruge Tue, 21 Nov 2006 22:37:34 -0800

Hi Steve,
Thanks a lot for the reply.

Attached herewith are sample code, pkcs12 key store, and two sample self-signed certificates exported (x, y). Both were exported with password "1234" to the keystore "store.pfx". BTW, I don't really know about the local key ID attribute you mentioned. Is it the unique key to identify a key/cert pair in a key store?

Besides there is no way to give such in the parse() function.

Giving the same password might appear as a rare case. But that doesn't mean it'll never happen.

Cheers,
Kaushalye


Dr. Stephen Henson wrote:

On Tue, Nov 21, 2006, Kaushalye Kapuruge wrote:
Hi list,
I'm still waiting for an answer for above questions. I did this little experiment.
1. I created a pkcs#12 store and created two self signed certificates(say x and y).
2. Both were exported "with the same password" to the store(y after x).
3. Then I wrote a program to extract these certificates from the key store.
4. The program uses d2i_PKCS12_bio() and PKCS12_parse(p12, pass, pkey, cert, ca) to load certificates.
Since we give only the password and the PKCS12 * to get the certificate and the pkey, it always returns the last certificate that we exported with the same password. So in this way if someone has exported a certificate with a password, that's being used before the latter certificate will override the former without any warnings. Is my conclusion valid? Or is there any other way to extract a certificate rather than PKCS12_parse? Moreover I expected that the method signature would take a fingerprint of a certificate but it is not.
It isn't clear form your description which key corresponds to which
certificate. The PKCS12_parse() function will only retrieve a single matching
certificate and key pair based on the local key ID attribute.

Some PKCS#12 code adds local key ID to all certificates whether they have a
key or not.
It isn't really possible to say what is going on without seeing a sample
PKCS#12 file or printing out the attributes with the pkcs12 utility.

You can manually parse a PKCS#12 file using the same technique as the pkcs12
utility but that is rather messy.

Steve.
--
Dr Stephen N. Henson. Email, S/MIME and PGP keys: see homepage
OpenSSL project core developer and freelance consultant.
Funding needed! Details on homepage.
Homepage: http://www.drh-consultancy.demon.co.uk
______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
User Support Mailing List                    openssl-users@openssl.org
Automated List Manager                           [EMAIL PROTECTED]

/* pkread.c */

#include <stdio.h>
#include <stdlib.h>
#include <openssl/pem.h>
#include <openssl/err.h>
#include <openssl/pkcs12.h>
#include <openssl/bio.h>
#include <openssl/rand.h>
#include <openssl/x509.h>
#include <string.h>
#include <openssl/evp.h>
/* Simple PKCS#12 file reader */

int main(int argc, char **argv)
{
	FILE *fp;
	EVP_PKEY *pkey;
	X509 *cert;
	STACK_OF(X509) *ca = NULL;
	PKCS12 *p12;
	int i;
    char issuer_name[256];
    char subject[256];
    X509_NAME *name = NULL;

	if (argc != 4) {
		fprintf(stderr, "Usage: pkread p12file password opfile\n");
		exit (1);
	}
	SSLeay_add_all_algorithms();
	ERR_load_crypto_strings();
	if (!(fp = fopen(argv[1], "rb"))) {
		fprintf(stderr, "Error opening file %s\n", argv[1]);
		exit(1);
	}
	p12 = d2i_PKCS12_fp(fp, NULL);
	fclose (fp);
	if (!p12) {
		fprintf(stderr, "Error reading PKCS#12 file\n");
		ERR_print_errors_fp(stderr);
		exit (1);
	}
	if (!PKCS12_parse(p12, argv[2], &pkey, &cert, &ca)) {
		fprintf(stderr, "Error parsing PKCS#12 file\n");
		ERR_print_errors_fp(stderr);
		exit (1);
	}
	PKCS12_free(p12);
	if (!(fp = fopen(argv[3], "w"))) {
		fprintf(stderr, "Error opening file %s\n", argv[1]);
		exit(1);
	}
	if (pkey) {
		fprintf(fp, "***Private Key***\n");
		PEM_write_PrivateKey(fp, pkey, NULL, NULL, 0, NULL, NULL);
	}
	if (cert) {
		fprintf(fp, "***User Certificate***\n");
		PEM_write_X509_AUX(fp, cert);
	}

    X509_NAME_oneline(X509_get_issuer_name(cert), issuer_name, sizeof(issuer_name));
    X509_NAME_oneline(X509_get_subject_name(cert), subject, sizeof (subject));

    if(issuer_name)
        printf("Issuer Name : %s\n",issuer_name);
    if(subject)
        printf("Subject : %s\n",subject);
    
    ASN1_INTEGER *ai = X509_get_serialNumber(cert);
    char *rep=NULL;
    if(ai)
    { 
        rep = (char*)i2s_ASN1_INTEGER(NULL, ai);
        printf("Serial Number :%s\n",rep);
    }
    if (ca && sk_num(ca)) {
	fprintf(fp, "***Other Certificates***\n");
	for (i = 0; i < sk_X509_num(ca); i++) 
	    PEM_write_X509_AUX(fp, sk_X509_value(ca, i));
	}
	fclose(fp);
	return 0;
}

store.pfx
Description: Binary data

Re: pkcs#12 in openssl

Reply via email to