Boost.Asio SSL context load_verify_paths not loading certificate(s)

I have code to retrieve all root certificates in the Windows certificate store for the current user:

#include <windows.h>
#include <Wincrypt.h>

inline std::vector<std::string> system_root_certificates()
{
    std::vector<std::string> certs;

    HCERTSTORE hStore;
    PCCERT_CONTEXT pCertContext = NULL;

    if (!(hStore = ::CertOpenStore(
              CERT_STORE_PROV_SYSTEM_A,
              0,
              NULL,
              CERT_SYSTEM_STORE_CURRENT_USER,
              "Root")))
        return certs;

    do
    {
        if (pCertContext = ::CertFindCertificateInStore(
                  hStore,
                  X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
                  0,
                  CERT_FIND_ANY,
                  NULL,
                  pCertContext))
        {
            certs.push_back("-----BEGIN CERTIFICATE-----\n" +
                            Base64::encode_copy(std::string((char *) pCertContext->pbCertEncoded, (size_t) pCertContext->cbCertEncoded), true) +
                            "\n-----END CERTIFICATE-----\n");
        }
    } while (pCertContext);

    if (!pCertContext)
        ::CertFreeCertificateContext(pCertContext);

    ::CertCloseStore(
              hStore,
              CERT_CLOSE_STORE_FORCE_FLAG);

    return certs;
}

Then I write the certificates out to a file:

...
for (size_t i = 0; i < certs.size(); ++i)
    certFile << certs[i];
...

I have verified that the file is being written correctly.

A sample of the first two certificates from the file:

I then close the file, and call

sslContext->load_verify_file(filename);

The load_verify_file function fails with error too long. The function also fails if I only write one certificate to the file, with the same error code.

openssl verify <cert_filename> returns the following (complete) output:

unable to load certificate
2404:error:0D07209B:asn1 encoding routines:ASN1_get_object:too long:.\crypto\asn1\asn1_lib.c:142:
2404:error:0D068066:asn1 encoding routines:ASN1_CHECK_TLEN:bad object header:.\crypto\asn1\tasn_dec.c:1303:
2404:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:.\crypto\asn1\tasn_dec.c:380:Type=X509
2404:error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib:.\crypto\pem\pem_oth.c:83:

Is the error caused by the format that I am writing to the file in? What else could cause this error?

Use base64 -d to decode the certificate, it shows der formatted binary, but the length is not correct, e.g. the first certificate's der format indicates 0x0530 + 4 bytes. The der file shall have 1332 bytes, but actually it's only 1078 bytes.

So it indicates that the certificate is corrupted.

Google this topic, it's found that CryptBinaryToString() is a better option to convert the pbCertEncoded, instead of directly calling Base64 function to get the string.

来源：https://stackoverflow.com/questions/40198728/boost-asio-ssl-context-load-verify-paths-not-loading-certificates

标签

c++

windows

boost

OpenSSL

boost-asio