自从我更新到 openssl 1.0.1 以来,我的应用程序中的吊销检查功能已损坏。在“apps/verfiy.c”的帮助下,我发现 CRL 文件的加载发生了变化,到目前为止我已经完成了以下操作:
X509_LOOKUP *lookup;
const char *crl_path = "/path/to/crls"
X509_VERIFY_PARAM *param = X509_VERIFY_PARAM_new();
X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CRL_CHECK);
SSL_CTX_set1_param(ctx, param);
lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_hash_dir());
if (lookup == NULL) {
return "CRL path initialization error: X509 lookup initialization failed.";
}
if(!X509_LOOKUP_add_dir(lookup, crl_path, X509_FILETYPE_PEM)) {
return "CRL path initialization error: path addition failed.";
}
X509_VERIFY_PARAM_free(param);
现在这样做我总是收到错误“无法加载证书 CRL”。
然而,在“apps/verify.c”中,最近通过以下代码一次加载一个 CRL 文件:
STACK_OF(X509_CRL) *crls;
char *crlfile = "/path/to/single/crl"
crls = load_crls(bio_err, crlfile, FORMAT_PEM, NULL, e, "other CRLs");
X509_STORE_CTX_set0_crls(csc, crls);
有谁知道如何仍然可以通过使用查找例程(例如 X509_LOOKUP_add_dir)并通过 CRL 路径的规范一次性加载 CRL 文件?