X.509 certificate based authentication with OpenSSL (without using sockets)

Question

Hi,

Is there an alternative in OpenSSL to SSL_set_connect_state()/SSL_set_accept_state() for X.509 certificate based authentication?

The problem is that in my application the client and server do not communicate using sockets, and the establishment of direct connection between them is not possible. So what I want from OpenSSL is to 'expose' the intermediate SSL context establishment messages which I would then convey to the party at the other end.

Thanks for your help!

Answer 1

The OpenSSL BIO interface can be used for this.

1. Use BIO_new_bio_pair() to create a connected BIO pair. One BIO will be read from and written to by the SSL routines, and the other BIO will be read from and written to by your application (allowing it to pass the data to the other end by whatever method it desires).

2. Use SSL_set_bio() on a new SSL object to set both the read and write BIO to one of the BIOs in the pair generated.

3. Use BIO_read() and BIO_write() on the other BIO in the pair to read and write the SSL protocol data.

4. Use SSL_accept(), SSL_connect(), SSL_read() and SSL_write() as normal on the SSL object.

Answer 2

Yes, you can use the same X.509 verification routines that the SSL socket layer stuff would.

http://openssl.org/docs/crypto/x509.html

The documentation seems to be a bit lacking here... (you'd think they'd have finished it all for 1.0). I can't say I'm familiar with this aspect of the library, but openssl comes with a command line x509 verification tool. You should be able to peek in it's source code for how to do it.

http://openssl.org/docs/apps/verify.html