| Subject: | Please export X509_get_X509_PUBKEY to return certificate SPKIs |
Openssl X509_get_pubkey's is already available. But as Victor Duchovni puts it [0],
"This is not the subjectPublicKeyInfo. It is just the key bits, sans
algorithm and parameters. A common pitfall is to mistake this for
the subjectPublicKeyInfo or to assume that X509_pubkey_digest()
returns the digest of the subjectPublicKeyInfo."
The full certificate digest (SPKI), including algorithm and parameters, is
accessible by Openssl X509_get_X509_PUBKEY's instead, which is currently not
available in Net::SSLeay. In another message to OpenSSL-users mailing list,
Victor Duchovni wrote [1]:
"The full certificate digest, with a suitably second-preimage
resistant hash can be used a compact proxy for the full certificate,
and some applications (e.g. RFC 6698 DANE TLSA) encourage or at least
support the use of digests as secure replacements for the underlying
certificate.
The same can be said of the digest of the full public key (algorithm,
parameters and key data), when one wants to trust the holder of
the private key rather than any particular CA's name binding to
that key. And indeed RFC 6698 also supports public-key fingerprint
security bindings."
This hopefully justifies the need of a function returning the Subject Public
Key Info (SPKI) in Net::SSLeay. Here is some code to export
X509_get_X509_PUBKEY.
--8<----------------------------------------------------------------------8>--
void
X509_get_X509_PUBKEY(x)
const X509 *x
PPCODE:
X509_PUBKEY *pkey;
STRLEN len;
unsigned char *pc, *pi;
if (!(pkey = X509_get_X509_PUBKEY(x))) croak("invalid certificate");
if (!(len = i2d_X509_PUBKEY(pkey, NULL))) croak("invalid certificate public key");
Newx(pc,len,unsigned char);
if (!pc) croak("out of memory");
pi = pc;
i2d_X509_PUBKEY(pkey, &pi);
if (pi-pc != len) croak("invalid encoded length");
XPUSHs(sv_2mortal(newSVpv((char*)pc,len)));
Safefree(pc);
--8<----------------------------------------------------------------------8>--
[0] http://openssl.6102.n7.nabble.com/X509-and-Extract-Public-Key-td43623.html#a43626
[1] http://openssl.6102.n7.nabble.com/X509-digest-and-X509-pubkey-digest-tp43302.html