x509

Creating an x509 v3 user certificate by signing CSR

由 笑着哭i 提交于 2019-11-27 12:49:58
问题 I know how to sign a CSR using openssl , but the result certificate is an x509 v1, and not v3. I'm using the following commands: x509 -req -days 365 -in myCSR.csr -CA myCA.crt -CAkey myCA.key -CAcreateserial -out userCertificate.crt I've searched but have not been able to find a solution. Is there another way to do this programmatically? 回答1: You need to specify an extensions file. For example: openssl x509 -days 365 -in myCSR.csr -extfile v3.ext -CA myCA.crt -CAkey myCA.key -CAcreateserial

Programmatically verify certificate chain using OpenSSL API

由 旧时模样 提交于 2019-11-27 12:46:25
This is very similar to other questions but the ones I've looked at either don't have an answer or don't quite ask the same question. I have a self-signed CA certificate, and two other certificates that are signed with that CA certificate. I'm fairly sure the certificates are correct, because 'openssl verify' works: $ openssl verify -CAfile ca.pem server.pem server.pem: OK (The above is from memory, I don't have them in front of me, so it may be slightly off). Now I want to verify the certificates programatically. I have a utility function with pseudocode below: int verify_cert(X509 *cert,

Sign JAX-WS SOAP request

由 筅森魡賤 提交于 2019-11-27 12:14:27
问题 I would like to write a JAX-WS web service that signs my SOAP messages using the http://www.w3.org/TR/xmldsig-core/ recommendation. With what I found on the internet I wrote a JAX-WS handler ( SOAPHandler<SOAPMessageContext> ) that manages to change a copy of the SOAP request: @Override public boolean handleMessage(SOAPMessageContext smc) { Boolean outboundProperty = (Boolean) smc.get(MessageContext.MESSAGE_OUTBOUND_PROPERTY); SOAPMessage message = smc.getMessage(); if (outboundProperty) {

How do I do TLS with BouncyCastle?

由 三世轮回 提交于 2019-11-27 11:57:10
Does anybody know about examples of TLS with BouncyCastle? I was surprised by the lack of them on Internet. If there are really none, let's collect them as answers. This is a very basic example, with server-only authentication and self-signed cert. The code is based on BC 1.49, mostly leightweight API: ServerSocket serverSocket = new ServerSocket(SERVER_PORT); final KeyPair keyPair = ... final Certificate bcCert = new Certificate(new org.spongycastle.asn1.x509.Certificate[] { new X509V3CertificateStrategy().selfSignedCertificateHolder(keyPair).toASN1Structure()}); while (true) { Socket socket

C# How can I validate a Root-CA-Cert certificate (x509) chain?

由 爱⌒轻易说出口 提交于 2019-11-27 10:50:35
问题 Let's say I have three certificates (in Base64 format) Root | --- CA | --- Cert (client/signing/whatever) How can I validate the certs and certificate path/chain in C#? (All those three certs may not be in my computer cert store) Edit : BouncyCastle has the function to verify. But I'm trying not to use any third-party library. byte[] b1 = Convert.FromBase64String(x509Str1); byte[] b2 = Convert.FromBase64String(x509Str2); X509Certificate cer1 = new X509CertificateParser().ReadCertificate(b1);

SecCertificateRef: How to get the certificate information?

由 僤鯓⒐⒋嵵緔 提交于 2019-11-27 10:41:51
I have a certificate (SecCertificateRef), I can check if it's valid and I can extract a "summary" using SecCertificateCopySubjectSummary. What is the "summary" exactly? I don't understand the term "A string that contains a human-readable summary of the contents of the certificate." in the Apple documentation. I think, they mean the "CN" in the certificate, correct? Is there any method to get the clear X509-information out of SecCertificateRef? Does a cast to a keychain-object help? I want to have something like this and I am especially focussed on the "CN" to compare it with the URL I

X.509: Private / Public Key

由 ￡可爱￡侵袭症＋ 提交于 2019-11-27 10:08:51
问题 We're trying to implement some functionality of a Web-Service from one of our partners. Now, the content which is beeing transmitted, should be encrypted with a public key, which we have to provide. The security-specification says that the public-certificate has to be X.509 standard. Doesn't X.509 rely on the private / public key method? Because I only get one .pem file, containing a private key, and a certificate, but no public key, using the following command: openssl req -new -x509 -days

Self signed X509 Certificate with Bouncy Castle in Java

由 半世苍凉 提交于 2019-11-27 08:24:49
I need to create a self signed X509 Certificate with Bouncy Castle in Java, but every class I try to include is deprecated. How can I solve this? Is there some other class to include? Thanks Using Bouncycastle latest version - 1.55 Update to the answer by @Bewusstsein. The bouncycastle classes are deprecated in the latest version as of this answer (5/11/2017). If you are using the latest version (1.55) or relatively latest version: public static Certificate selfSign(KeyPair keyPair, String subjectDN) throws OperatorCreationException, CertificateException, IOException { Provider bcProvider =

How do I use m2crypto to validate a X509 certificate chain in a non-SSL setting

由 白昼怎懂夜的黑 提交于 2019-11-27 07:00:50
问题 I'm trying to figure out how to, using m2crypto, validate the chain of trust from a public key version of a X509 certificate back to one of a set of known root CA's when the chain may be arbitrarily long. The SSL.Context module looks promising except that I'm not doing this in the context of a SSL connection and I can't see how the information passed to load_verify_locations is used. Essentially, I'm looking for the interface that's equivalent to: openssl verify pub_key_x509_cert Is there

Using HTTPS with REST in Java

由 a 夏天 提交于 2019-11-27 05:57:15
I have a REST server made in Grizzly that uses HTTPS and works wonderfully with Firefox. Here's the code: //Build a new Servlet Adapter. ServletAdapter adapter=new ServletAdapter(); adapter.addInitParameter("com.sun.jersey.config.property.packages", "My.services"); adapter.addInitParameter(ResourceConfig.PROPERTY_CONTAINER_REQUEST_FILTERS, SecurityFilter.class.getName()); adapter.setContextPath("/"); adapter.setServletInstance(new ServletContainer()); //Configure SSL (See instructions at the top of this file on how these files are generated.) SSLConfig ssl=new SSLConfig(); String keystoreFile
订阅 x509