Merge pull request #526 from julek-wolfssl/ocsp-stapling
Adds OCSP stapling example and TLS 1.3 supportpull/529/head
David Garske
GitHub
commit
015bf653d7
|
|
@ -301,6 +301,8 @@ hash/sha3-256-hash-string
|
|||
hash/sha512-hash
|
||||
|
||||
ocsp/ocsp_nonblock/ocsp_nonblock
|
||||
ocsp/stapling/ocsp-client
|
||||
ocsp/stapling/ocsp-server
|
||||
|
||||
sslkeylog.log
|
||||
|
||||
|
|
@ -381,3 +383,8 @@ tpm/evp_tpm
|
|||
/Arduino/sketches/output.log
|
||||
/**/*.bak
|
||||
|
||||
# Eclipse
|
||||
\.settings/
|
||||
\.cproject
|
||||
\.project
|
||||
\.autotools
|
||||
|
|
|
|||
|
|
@ -0,0 +1,42 @@
|
|||
# Examples Makefile
|
||||
CC = gcc
|
||||
WOLFSSL_INSTALL_DIR = /usr/local
|
||||
CFLAGS = -Wall -I$(WOLFSSL_INSTALL_DIR)/include
|
||||
LIBS = -L$(WOLFSSL_INSTALL_DIR)/lib
|
||||
|
||||
# option variables
|
||||
DYN_LIB = -lwolfssl
|
||||
STATIC_LIB = $(WOLFSSL_INSTALL_DIR)/lib/libwolfssl.a
|
||||
DEBUG_FLAGS = -g3 -O0 -DDEBUG
|
||||
DEBUG_INC_PATHS = -MD
|
||||
OPTIMIZE = -O2
|
||||
|
||||
# Options
|
||||
CFLAGS+=$(DEBUG_FLAGS)
|
||||
#CFLAGS+=$(OPTIMIZE)
|
||||
#LIBS+=$(STATIC_LIB)
|
||||
LIBS+=$(DYN_LIB)
|
||||
|
||||
# build targets
|
||||
SRC=$(wildcard *.c)
|
||||
TARGETS=$(patsubst %.c, %, $(SRC))
|
||||
|
||||
.PHONY: clean all
|
||||
|
||||
all: $(TARGETS)
|
||||
|
||||
debug: CFLAGS+=$(DEBUG_FLAGS)
|
||||
debug: all
|
||||
|
||||
# build template
|
||||
%: %.c
|
||||
$(CC) -o $@ $< $(CFLAGS) $(LIBS)
|
||||
|
||||
responder:
|
||||
openssl ocsp -index responder-certs/index.txt -port 22221 \
|
||||
-rsigner responder-certs/ocsp-responder-cert.pem \
|
||||
-rkey responder-certs/ocsp-responder-key.pem \
|
||||
-CA client-certs/intermediate1-ca-cert.pem
|
||||
|
||||
clean:
|
||||
rm -f $(TARGETS)
|
||||
|
|
@ -0,0 +1,71 @@
|
|||
# OCSP Stapling Example with wolfSSL
|
||||
|
||||
This directory contains a standalone example demonstrating OCSP stapling with dynamic certificate selection and verification. Both a client and a server are provided, along with the necessary certificates and a Makefile for building the example. The certificates are taken from the wolfSSL test suite.
|
||||
|
||||
## Directory Structure
|
||||
|
||||
- `ocsp-server.c` — Example TLS server with OCSP stapling support.
|
||||
- `ocsp-client.c` — Example TLS client that verifies OCSP staples.
|
||||
- `Makefile` — Build instructions for the example programs.
|
||||
- `client-certs/` — CA and intermediate certificates for client verification.
|
||||
- `server-certs/` — Server certificate and private key.
|
||||
- `responder-certs/` — OCSP responder certificate, key, and index file.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- wolfSSL library installed (headers and libraries in `/usr/local` by default).
|
||||
- OpenSSL (for running a local OCSP responder).
|
||||
- GNU Make and GCC.
|
||||
|
||||
## Building
|
||||
|
||||
For this example, you need to build wolfSSL with OCSP and session certificate support. The following configuration options are required:
|
||||
|
||||
```sh
|
||||
./configure --enable-ocsp --enable-ocspstapling --enable-ocspstapling2 --enable-cert-setup-cb --enable-sessioncerts
|
||||
make
|
||||
make install
|
||||
```
|
||||
|
||||
To build both the server and client, simply run:
|
||||
|
||||
```sh
|
||||
make
|
||||
```
|
||||
|
||||
This will produce two binaries: `ocsp-server` and `ocsp-client`.
|
||||
|
||||
## Running the Example
|
||||
|
||||
### 1. Start the OCSP Responder
|
||||
|
||||
From the `stapling` directory, run:
|
||||
|
||||
```sh
|
||||
make responder
|
||||
```
|
||||
|
||||
### 2. Start the Server
|
||||
|
||||
```sh
|
||||
./ocsp-server
|
||||
```
|
||||
|
||||
### 3. Run the Client
|
||||
|
||||
In a separate terminal, run either:
|
||||
|
||||
```sh
|
||||
./ocsp-client --tls12
|
||||
```
|
||||
or
|
||||
```sh
|
||||
./ocsp-client --tls13
|
||||
```
|
||||
|
||||
## Notes
|
||||
|
||||
- The server listens on `127.0.0.1:11111`.
|
||||
- The OCSP responder listens on `127.0.0.1:22221`.
|
||||
- Certificates are pre-generated for demonstration purposes.
|
||||
- The client and server demonstrate both automatic and manual OCSP staple verification.
|
||||
|
|
@ -0,0 +1,184 @@
|
|||
Certificate:
|
||||
Data:
|
||||
Version: 3 (0x2)
|
||||
Serial Number: 1 (0x1)
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Issuer: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com
|
||||
Validity
|
||||
Not Before: Dec 18 21:25:31 2024 GMT
|
||||
Not After : Sep 14 21:25:31 2027 GMT
|
||||
Subject: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL intermediate CA 1, emailAddress = info@wolfssl.com
|
||||
Subject Public Key Info:
|
||||
Public Key Algorithm: rsaEncryption
|
||||
Public-Key: (2048 bit)
|
||||
Modulus:
|
||||
00:de:b4:c8:5c:77:e0:2d:b1:f5:b9:ad:16:47:35:
|
||||
a0:35:65:65:c6:e1:40:ab:1e:b4:b9:13:b7:cb:8c:
|
||||
bb:77:a5:76:da:6d:87:87:f6:4a:4d:13:e4:26:3e:
|
||||
27:87:ee:5b:c7:6a:3f:45:30:61:55:5c:f6:35:d1:
|
||||
65:fa:98:11:a3:a7:55:d5:be:91:82:4b:fc:be:90:
|
||||
d6:50:53:63:9a:2c:22:e1:35:11:dc:78:02:97:8a:
|
||||
e4:46:92:9c:53:08:76:de:1f:53:b6:b8:ca:77:3e:
|
||||
79:6e:bc:d0:e3:0d:30:5b:4c:f6:94:0d:30:29:64:
|
||||
9f:04:e5:db:fb:89:60:67:bb:af:26:83:51:77:24:
|
||||
2f:2b:0b:a1:94:81:10:98:e8:eb:26:a8:1e:7c:e4:
|
||||
c4:6c:67:06:95:55:4a:dd:52:f4:f2:60:6d:01:2b:
|
||||
19:91:35:6d:a4:08:47:06:71:24:00:d9:de:c6:56:
|
||||
f3:8b:53:2c:e2:9a:96:a5:f3:62:e5:c4:e3:23:f2:
|
||||
d2:fc:21:ea:0f:62:76:8d:d5:99:48:ce:dc:58:c4:
|
||||
bb:7f:da:94:2c:80:74:83:c5:e0:b0:15:7e:41:fd:
|
||||
0e:f2:f4:f0:78:76:7b:ad:26:0d:aa:48:96:17:2f:
|
||||
21:e3:95:2b:26:37:f9:aa:80:2f:fe:de:f6:5e:bc:
|
||||
97:7f
|
||||
Exponent: 65537 (0x10001)
|
||||
X509v3 extensions:
|
||||
X509v3 Basic Constraints:
|
||||
CA:TRUE
|
||||
X509v3 Subject Key Identifier:
|
||||
83:C6:3A:89:2C:81:F4:02:D7:9D:4C:E2:2A:C0:71:82:64:44:DA:0E
|
||||
X509v3 Authority Key Identifier:
|
||||
keyid:73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21
|
||||
DirName:/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=wolfSSL root CA/emailAddress=info@wolfssl.com
|
||||
serial:63
|
||||
X509v3 Key Usage:
|
||||
Certificate Sign, CRL Sign
|
||||
Authority Information Access:
|
||||
OCSP - URI:http://127.0.0.1:22220
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Signature Value:
|
||||
75:57:f1:0c:87:8f:a2:70:3c:ce:e4:70:0e:99:6a:da:c4:80:
|
||||
94:2c:25:0c:de:0d:7b:f3:94:f1:e8:ad:6f:d0:de:9a:9d:f5:
|
||||
64:31:65:3f:18:e6:c3:f5:b5:1d:a2:be:5b:97:79:41:78:15:
|
||||
1c:b3:83:de:d0:00:ea:d2:70:43:c5:60:60:07:72:e5:76:59:
|
||||
b8:0e:2f:47:c9:8d:a4:4c:f1:20:b0:40:3b:ed:e9:de:b2:46:
|
||||
10:90:1b:0f:96:16:e6:97:bc:d5:9a:93:aa:3c:e3:b3:6b:5f:
|
||||
db:2c:af:2b:da:7c:36:36:aa:86:a1:65:70:c8:f1:34:d1:1f:
|
||||
10:96:71:e6:cf:69:5c:bf:0e:15:33:97:fe:40:42:be:30:48:
|
||||
ad:fb:d7:0e:7b:73:dd:64:30:7e:10:81:ac:3b:0b:3c:e4:12:
|
||||
9f:31:8b:3d:f0:9b:84:dc:5b:32:33:39:de:eb:1a:17:89:d8:
|
||||
1b:00:33:2d:50:a4:1a:2c:11:a2:60:ac:c1:9a:0f:44:90:00:
|
||||
cf:8d:6c:af:5b:71:23:7a:a7:4f:df:f5:3f:5c:ae:93:ca:4e:
|
||||
ec:f0:1b:f4:fa:53:7d:d9:36:af:5e:4c:54:c7:3a:d5:e3:68:
|
||||
ca:78:e5:1f:55:44:65:eb:00:2d:c3:c8:ba:0e:1f:47:1c:67:
|
||||
2e:a9:c1:6e
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIE8DCCA9igAwIBAgIBATANBgkqhkiG9w0BAQsFADCBlzELMAkGA1UEBhMCVVMx
|
||||
EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoM
|
||||
B3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NM
|
||||
IHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjQx
|
||||
MjE4MjEyNTMxWhcNMjcwOTE0MjEyNTMxWjCBoTELMAkGA1UEBhMCVVMxEzARBgNV
|
||||
BAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dvbGZT
|
||||
U0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMSIwIAYDVQQDDBl3b2xmU1NMIGludGVy
|
||||
bWVkaWF0ZSBDQSAxMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMIIB
|
||||
IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3rTIXHfgLbH1ua0WRzWgNWVl
|
||||
xuFAqx60uRO3y4y7d6V22m2Hh/ZKTRPkJj4nh+5bx2o/RTBhVVz2NdFl+pgRo6dV
|
||||
1b6Rgkv8vpDWUFNjmiwi4TUR3HgCl4rkRpKcUwh23h9TtrjKdz55brzQ4w0wW0z2
|
||||
lA0wKWSfBOXb+4lgZ7uvJoNRdyQvKwuhlIEQmOjrJqgefOTEbGcGlVVK3VL08mBt
|
||||
ASsZkTVtpAhHBnEkANnexlbzi1Ms4pqWpfNi5cTjI/LS/CHqD2J2jdWZSM7cWMS7
|
||||
f9qULIB0g8XgsBV+Qf0O8vTweHZ7rSYNqkiWFy8h45UrJjf5qoAv/t72XryXfwID
|
||||
AQABo4IBOTCCATUwDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQUg8Y6iSyB9ALXnUzi
|
||||
KsBxgmRE2g4wgcQGA1UdIwSBvDCBuYAUc7AcpC+Cy89HpTjXsASCOn5yFSGhgZ2k
|
||||
gZowgZcxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQH
|
||||
DAdTZWF0dGxlMRAwDgYDVQQKDAd3b2xmU1NMMRQwEgYDVQQLDAtFbmdpbmVlcmlu
|
||||
ZzEYMBYGA1UEAwwPd29sZlNTTCByb290IENBMR8wHQYJKoZIhvcNAQkBFhBpbmZv
|
||||
QHdvbGZzc2wuY29tggFjMAsGA1UdDwQEAwIBBjAyBggrBgEFBQcBAQQmMCQwIgYI
|
||||
KwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6MjIyMjAwDQYJKoZIhvcNAQELBQAD
|
||||
ggEBAHVX8QyHj6JwPM7kcA6ZatrEgJQsJQzeDXvzlPHorW/Q3pqd9WQxZT8Y5sP1
|
||||
tR2ivluXeUF4FRyzg97QAOrScEPFYGAHcuV2WbgOL0fJjaRM8SCwQDvt6d6yRhCQ
|
||||
Gw+WFuaXvNWak6o847NrX9ssryvafDY2qoahZXDI8TTRHxCWcebPaVy/DhUzl/5A
|
||||
Qr4wSK371w57c91kMH4Qgaw7CzzkEp8xiz3wm4TcWzIzOd7rGheJ2BsAMy1QpBos
|
||||
EaJgrMGaD0SQAM+NbK9bcSN6p0/f9T9crpPKTuzwG/T6U33ZNq9eTFTHOtXjaMp4
|
||||
5R9VRGXrAC3DyLoOH0ccZy6pwW4=
|
||||
-----END CERTIFICATE-----
|
||||
Certificate:
|
||||
Data:
|
||||
Version: 3 (0x2)
|
||||
Serial Number: 99 (0x63)
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Issuer: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com
|
||||
Validity
|
||||
Not Before: Dec 18 21:25:31 2024 GMT
|
||||
Not After : Sep 14 21:25:31 2027 GMT
|
||||
Subject: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com
|
||||
Subject Public Key Info:
|
||||
Public Key Algorithm: rsaEncryption
|
||||
Public-Key: (2048 bit)
|
||||
Modulus:
|
||||
00:ab:2c:b4:2f:1d:06:09:ef:4e:29:86:84:7e:cc:
|
||||
bf:a6:79:7c:f0:c0:c1:64:25:8c:75:b7:10:05:ca:
|
||||
48:27:0c:0e:32:1c:b0:fe:99:85:39:b6:b9:a2:f7:
|
||||
27:ff:6d:3c:8c:16:73:29:21:7f:8b:a6:54:71:90:
|
||||
ad:cc:05:b9:9f:15:c7:0a:3f:5f:69:f4:0a:5f:8c:
|
||||
71:b5:2c:bf:66:e2:03:9a:32:f4:d2:ec:2a:89:4b:
|
||||
f9:35:88:14:33:47:4e:2e:05:79:01:ed:64:36:76:
|
||||
b9:f8:85:cd:01:88:ac:c5:b2:b1:59:b8:cd:5a:f4:
|
||||
09:09:38:9b:da:5a:cf:ce:78:99:1f:49:3d:41:d6:
|
||||
06:7c:52:99:c8:97:d1:b3:80:3a:a2:4f:36:c4:c5:
|
||||
96:30:77:31:38:c8:70:cc:e1:67:06:b3:2b:2f:93:
|
||||
b5:69:cf:83:7e:88:53:9b:0f:46:21:4c:d6:05:36:
|
||||
44:99:60:68:47:e5:32:01:12:d4:10:73:ae:9a:34:
|
||||
94:fa:6e:b8:58:4f:7b:5b:8a:92:97:ad:fd:97:b9:
|
||||
75:ca:c2:d4:45:7d:17:6b:cd:2f:f3:63:7a:0e:30:
|
||||
b5:0b:a9:d9:a6:7c:74:60:9d:cc:09:03:43:f1:0f:
|
||||
90:d3:b7:fe:6c:9f:d9:cd:78:4b:15:ae:8c:5b:f9:
|
||||
99:81
|
||||
Exponent: 65537 (0x10001)
|
||||
X509v3 extensions:
|
||||
X509v3 Basic Constraints:
|
||||
CA:TRUE
|
||||
X509v3 Subject Key Identifier:
|
||||
73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21
|
||||
X509v3 Authority Key Identifier:
|
||||
keyid:73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21
|
||||
DirName:/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=wolfSSL root CA/emailAddress=info@wolfssl.com
|
||||
serial:63
|
||||
X509v3 Key Usage:
|
||||
Certificate Sign, CRL Sign
|
||||
Authority Information Access:
|
||||
OCSP - URI:http://127.0.0.1:22220
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Signature Value:
|
||||
76:e8:fa:f6:1e:5b:0e:ff:24:43:e0:cb:19:26:38:d9:df:18:
|
||||
5d:66:e1:4b:ac:e4:8e:b0:49:2c:d6:04:20:eb:4a:a8:06:d7:
|
||||
55:ec:6b:38:f8:0f:8c:e6:c9:ec:42:f0:ca:07:9f:88:7a:ee:
|
||||
bf:af:3f:7d:d3:45:67:20:84:bb:c7:c5:32:69:ab:59:e1:e3:
|
||||
38:4b:ed:18:2e:de:da:88:ec:a0:b7:ff:c1:50:96:73:e3:03:
|
||||
df:a1:e7:47:93:13:1d:fb:e6:6b:37:3e:50:a3:eb:5b:24:26:
|
||||
d2:43:2e:6e:9c:83:9c:fb:79:ba:cd:fd:3b:e5:87:87:a7:0f:
|
||||
5f:f9:64:34:56:5e:8b:13:e2:c4:41:e3:9d:3e:36:2d:cb:d3:
|
||||
5f:d3:12:90:bf:78:c1:4c:df:eb:7b:99:e6:1e:ee:52:78:6f:
|
||||
0c:82:e1:59:d4:25:40:e5:24:95:3e:0f:cc:08:60:fe:b4:8c:
|
||||
48:42:bf:29:74:92:71:1a:85:00:a7:4c:f0:c0:32:47:f3:be:
|
||||
f4:08:5c:f2:43:e0:b9:76:86:60:9a:3b:af:d6:32:41:5f:b0:
|
||||
04:12:44:2a:44:19:d4:27:d3:ce:71:7e:5b:16:1a:f5:0c:db:
|
||||
43:b0:a6:bb:76:02:f6:e0:30:4e:04:f4:f3:9b:cd:d4:ae:45:
|
||||
94:c5:8c:bb
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIE5jCCA86gAwIBAgIBYzANBgkqhkiG9w0BAQsFADCBlzELMAkGA1UEBhMCVVMx
|
||||
EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoM
|
||||
B3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NM
|
||||
IHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjQx
|
||||
MjE4MjEyNTMxWhcNMjcwOTE0MjEyNTMxWjCBlzELMAkGA1UEBhMCVVMxEzARBgNV
|
||||
BAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dvbGZT
|
||||
U0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NMIHJvb3Qg
|
||||
Q0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wggEiMA0GCSqGSIb3
|
||||
DQEBAQUAA4IBDwAwggEKAoIBAQCrLLQvHQYJ704phoR+zL+meXzwwMFkJYx1txAF
|
||||
ykgnDA4yHLD+mYU5trmi9yf/bTyMFnMpIX+LplRxkK3MBbmfFccKP19p9ApfjHG1
|
||||
LL9m4gOaMvTS7CqJS/k1iBQzR04uBXkB7WQ2drn4hc0BiKzFsrFZuM1a9AkJOJva
|
||||
Ws/OeJkfST1B1gZ8UpnIl9GzgDqiTzbExZYwdzE4yHDM4WcGsysvk7Vpz4N+iFOb
|
||||
D0YhTNYFNkSZYGhH5TIBEtQQc66aNJT6brhYT3tbipKXrf2XuXXKwtRFfRdrzS/z
|
||||
Y3oOMLULqdmmfHRgncwJA0PxD5DTt/5sn9nNeEsVroxb+ZmBAgMBAAGjggE5MIIB
|
||||
NTAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRzsBykL4LLz0elONewBII6fnIVITCB
|
||||
xAYDVR0jBIG8MIG5gBRzsBykL4LLz0elONewBII6fnIVIaGBnaSBmjCBlzELMAkG
|
||||
A1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUx
|
||||
EDAOBgNVBAoMB3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQD
|
||||
DA93b2xmU1NMIHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5j
|
||||
b22CAWMwCwYDVR0PBAQDAgEGMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAYYW
|
||||
aHR0cDovLzEyNy4wLjAuMToyMjIyMDANBgkqhkiG9w0BAQsFAAOCAQEAduj69h5b
|
||||
Dv8kQ+DLGSY42d8YXWbhS6zkjrBJLNYEIOtKqAbXVexrOPgPjObJ7ELwygefiHru
|
||||
v68/fdNFZyCEu8fFMmmrWeHjOEvtGC7e2ojsoLf/wVCWc+MD36HnR5MTHfvmazc+
|
||||
UKPrWyQm0kMubpyDnPt5us39O+WHh6cPX/lkNFZeixPixEHjnT42LcvTX9MSkL94
|
||||
wUzf63uZ5h7uUnhvDILhWdQlQOUklT4PzAhg/rSMSEK/KXSScRqFAKdM8MAyR/O+
|
||||
9Ahc8kPguXaGYJo7r9YyQV+wBBJEKkQZ1CfTznF+WxYa9QzbQ7Cmu3YC9uAwTgT0
|
||||
85vN1K5FlMWMuw==
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,92 @@
|
|||
Certificate:
|
||||
Data:
|
||||
Version: 3 (0x2)
|
||||
Serial Number: 99 (0x63)
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Issuer: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com
|
||||
Validity
|
||||
Not Before: Dec 18 21:25:31 2024 GMT
|
||||
Not After : Sep 14 21:25:31 2027 GMT
|
||||
Subject: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com
|
||||
Subject Public Key Info:
|
||||
Public Key Algorithm: rsaEncryption
|
||||
Public-Key: (2048 bit)
|
||||
Modulus:
|
||||
00:ab:2c:b4:2f:1d:06:09:ef:4e:29:86:84:7e:cc:
|
||||
bf:a6:79:7c:f0:c0:c1:64:25:8c:75:b7:10:05:ca:
|
||||
48:27:0c:0e:32:1c:b0:fe:99:85:39:b6:b9:a2:f7:
|
||||
27:ff:6d:3c:8c:16:73:29:21:7f:8b:a6:54:71:90:
|
||||
ad:cc:05:b9:9f:15:c7:0a:3f:5f:69:f4:0a:5f:8c:
|
||||
71:b5:2c:bf:66:e2:03:9a:32:f4:d2:ec:2a:89:4b:
|
||||
f9:35:88:14:33:47:4e:2e:05:79:01:ed:64:36:76:
|
||||
b9:f8:85:cd:01:88:ac:c5:b2:b1:59:b8:cd:5a:f4:
|
||||
09:09:38:9b:da:5a:cf:ce:78:99:1f:49:3d:41:d6:
|
||||
06:7c:52:99:c8:97:d1:b3:80:3a:a2:4f:36:c4:c5:
|
||||
96:30:77:31:38:c8:70:cc:e1:67:06:b3:2b:2f:93:
|
||||
b5:69:cf:83:7e:88:53:9b:0f:46:21:4c:d6:05:36:
|
||||
44:99:60:68:47:e5:32:01:12:d4:10:73:ae:9a:34:
|
||||
94:fa:6e:b8:58:4f:7b:5b:8a:92:97:ad:fd:97:b9:
|
||||
75:ca:c2:d4:45:7d:17:6b:cd:2f:f3:63:7a:0e:30:
|
||||
b5:0b:a9:d9:a6:7c:74:60:9d:cc:09:03:43:f1:0f:
|
||||
90:d3:b7:fe:6c:9f:d9:cd:78:4b:15:ae:8c:5b:f9:
|
||||
99:81
|
||||
Exponent: 65537 (0x10001)
|
||||
X509v3 extensions:
|
||||
X509v3 Basic Constraints:
|
||||
CA:TRUE
|
||||
X509v3 Subject Key Identifier:
|
||||
73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21
|
||||
X509v3 Authority Key Identifier:
|
||||
keyid:73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21
|
||||
DirName:/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=wolfSSL root CA/emailAddress=info@wolfssl.com
|
||||
serial:63
|
||||
X509v3 Key Usage:
|
||||
Certificate Sign, CRL Sign
|
||||
Authority Information Access:
|
||||
OCSP - URI:http://127.0.0.1:22220
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Signature Value:
|
||||
76:e8:fa:f6:1e:5b:0e:ff:24:43:e0:cb:19:26:38:d9:df:18:
|
||||
5d:66:e1:4b:ac:e4:8e:b0:49:2c:d6:04:20:eb:4a:a8:06:d7:
|
||||
55:ec:6b:38:f8:0f:8c:e6:c9:ec:42:f0:ca:07:9f:88:7a:ee:
|
||||
bf:af:3f:7d:d3:45:67:20:84:bb:c7:c5:32:69:ab:59:e1:e3:
|
||||
38:4b:ed:18:2e:de:da:88:ec:a0:b7:ff:c1:50:96:73:e3:03:
|
||||
df:a1:e7:47:93:13:1d:fb:e6:6b:37:3e:50:a3:eb:5b:24:26:
|
||||
d2:43:2e:6e:9c:83:9c:fb:79:ba:cd:fd:3b:e5:87:87:a7:0f:
|
||||
5f:f9:64:34:56:5e:8b:13:e2:c4:41:e3:9d:3e:36:2d:cb:d3:
|
||||
5f:d3:12:90:bf:78:c1:4c:df:eb:7b:99:e6:1e:ee:52:78:6f:
|
||||
0c:82:e1:59:d4:25:40:e5:24:95:3e:0f:cc:08:60:fe:b4:8c:
|
||||
48:42:bf:29:74:92:71:1a:85:00:a7:4c:f0:c0:32:47:f3:be:
|
||||
f4:08:5c:f2:43:e0:b9:76:86:60:9a:3b:af:d6:32:41:5f:b0:
|
||||
04:12:44:2a:44:19:d4:27:d3:ce:71:7e:5b:16:1a:f5:0c:db:
|
||||
43:b0:a6:bb:76:02:f6:e0:30:4e:04:f4:f3:9b:cd:d4:ae:45:
|
||||
94:c5:8c:bb
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIE5jCCA86gAwIBAgIBYzANBgkqhkiG9w0BAQsFADCBlzELMAkGA1UEBhMCVVMx
|
||||
EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoM
|
||||
B3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NM
|
||||
IHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjQx
|
||||
MjE4MjEyNTMxWhcNMjcwOTE0MjEyNTMxWjCBlzELMAkGA1UEBhMCVVMxEzARBgNV
|
||||
BAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dvbGZT
|
||||
U0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NMIHJvb3Qg
|
||||
Q0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wggEiMA0GCSqGSIb3
|
||||
DQEBAQUAA4IBDwAwggEKAoIBAQCrLLQvHQYJ704phoR+zL+meXzwwMFkJYx1txAF
|
||||
ykgnDA4yHLD+mYU5trmi9yf/bTyMFnMpIX+LplRxkK3MBbmfFccKP19p9ApfjHG1
|
||||
LL9m4gOaMvTS7CqJS/k1iBQzR04uBXkB7WQ2drn4hc0BiKzFsrFZuM1a9AkJOJva
|
||||
Ws/OeJkfST1B1gZ8UpnIl9GzgDqiTzbExZYwdzE4yHDM4WcGsysvk7Vpz4N+iFOb
|
||||
D0YhTNYFNkSZYGhH5TIBEtQQc66aNJT6brhYT3tbipKXrf2XuXXKwtRFfRdrzS/z
|
||||
Y3oOMLULqdmmfHRgncwJA0PxD5DTt/5sn9nNeEsVroxb+ZmBAgMBAAGjggE5MIIB
|
||||
NTAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRzsBykL4LLz0elONewBII6fnIVITCB
|
||||
xAYDVR0jBIG8MIG5gBRzsBykL4LLz0elONewBII6fnIVIaGBnaSBmjCBlzELMAkG
|
||||
A1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUx
|
||||
EDAOBgNVBAoMB3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQD
|
||||
DA93b2xmU1NMIHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5j
|
||||
b22CAWMwCwYDVR0PBAQDAgEGMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAYYW
|
||||
aHR0cDovLzEyNy4wLjAuMToyMjIyMDANBgkqhkiG9w0BAQsFAAOCAQEAduj69h5b
|
||||
Dv8kQ+DLGSY42d8YXWbhS6zkjrBJLNYEIOtKqAbXVexrOPgPjObJ7ELwygefiHru
|
||||
v68/fdNFZyCEu8fFMmmrWeHjOEvtGC7e2ojsoLf/wVCWc+MD36HnR5MTHfvmazc+
|
||||
UKPrWyQm0kMubpyDnPt5us39O+WHh6cPX/lkNFZeixPixEHjnT42LcvTX9MSkL94
|
||||
wUzf63uZ5h7uUnhvDILhWdQlQOUklT4PzAhg/rSMSEK/KXSScRqFAKdM8MAyR/O+
|
||||
9Ahc8kPguXaGYJo7r9YyQV+wBBJEKkQZ1CfTznF+WxYa9QzbQ7Cmu3YC9uAwTgT0
|
||||
85vN1K5FlMWMuw==
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,265 @@
|
|||
/* ocsp-client.c
|
||||
*
|
||||
* Standalone OCSP stapling client example.
|
||||
*
|
||||
* Copyright (C) 2006-2025 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL. (formerly known as CyaSSL)
|
||||
*
|
||||
* wolfSSL is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* wolfSSL is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
|
||||
*/
|
||||
|
||||
#include <wolfssl/options.h>
|
||||
#include <wolfssl/ssl.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <unistd.h>
|
||||
#include <arpa/inet.h>
|
||||
#include <sys/socket.h>
|
||||
#include <wolfssl/wolfcrypt/asn.h>
|
||||
#include <wolfssl/wolfcrypt/types.h>
|
||||
#include <wolfssl/ocsp.h>
|
||||
|
||||
#define CA_CERT "client-certs/root-ca-cert.pem"
|
||||
#define INTERMEDIATE_CA_CERT "client-certs/intermediate1-ca-cert.pem"
|
||||
#define SERVER_PORT 11111
|
||||
|
||||
/* Certificate verify callback for wolfSSL */
|
||||
static int cert_verify_cb(int preverify, WOLFSSL_X509_STORE_CTX* store)
|
||||
{
|
||||
int err = wolfSSL_X509_STORE_CTX_get_error(store);
|
||||
int depth = wolfSSL_X509_STORE_CTX_get_error_depth(store);
|
||||
|
||||
printf("Client: cert_verify_cb called. preverify=%d, err=%d, depth=%d\n", preverify, err, depth);
|
||||
|
||||
/* If CA not found, try manual validation using CertManager */
|
||||
/* Error codes: ASN_NO_SIGNER_E, ASN_SELF_SIGNED_E, and similar */
|
||||
/* These are typically negative values, but may depend on wolfSSL build */
|
||||
if (preverify == 0) {
|
||||
int ret = 1;
|
||||
if (err == ASN_NO_SIGNER_E ||
|
||||
err == ASN_SELF_SIGNED_E
|
||||
#ifdef OPENSSL_EXTRA
|
||||
|| err == WOLFSSL_X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY
|
||||
|| err == WOLFSSL_X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT
|
||||
#endif
|
||||
) {
|
||||
int i;
|
||||
WOLFSSL_BUFFER_INFO* bInfo = &store->certs[depth];
|
||||
WOLFSSL_CERT_MANAGER* cm = NULL;
|
||||
DecodedCert cert;
|
||||
byte certInit = 0;
|
||||
|
||||
cm = wolfSSL_CertManagerNew();
|
||||
if (cm == NULL)
|
||||
ret = 0;
|
||||
if (ret == 1 &&
|
||||
wolfSSL_CertManagerLoadCA(cm, CA_CERT, NULL) != WOLFSSL_SUCCESS)
|
||||
ret = 0;
|
||||
|
||||
/* Certs are verified top down so we can load the remainder of the chain */
|
||||
for (i = depth + 1; i < store->totalCerts && ret == 1; i++) {
|
||||
if (wolfSSL_CertManagerLoadCABuffer(cm, store->certs[i].buffer, store->certs[i].length,
|
||||
WOLFSSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS)
|
||||
ret = 0;
|
||||
}
|
||||
|
||||
/* Verify cert with CA */
|
||||
if (ret == 1) {
|
||||
wc_InitDecodedCert(&cert, bInfo->buffer, bInfo->length, NULL);
|
||||
certInit = 1;
|
||||
}
|
||||
if (ret == 1 && wc_ParseCert(&cert, CERT_TYPE, VERIFY, cm) != 0)
|
||||
ret = 0;
|
||||
|
||||
if (certInit)
|
||||
wc_FreeDecodedCert(&cert);
|
||||
wolfSSL_CertManagerFree(cm);
|
||||
|
||||
if (ret == 1) {
|
||||
printf("Client: Manual certificate validation succeeded at depth %d\n", depth);
|
||||
return 1;
|
||||
} else {
|
||||
printf("Client: Manual certificate validation failed at depth %d\n", depth);
|
||||
return 0;
|
||||
}
|
||||
} else {
|
||||
printf("Client: Certificate verification failed at depth %d, error %d\n", depth, err);
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int ocsp_verify_cb(WOLFSSL* ssl, int err, unsigned char* staple, unsigned int stapleSz, unsigned int idx, void* arg)
|
||||
{
|
||||
(void)arg;
|
||||
if (err == 0 && staple && stapleSz > 0) {
|
||||
printf("Client: OCSP staple received, size=%u\n", stapleSz);
|
||||
return 0;
|
||||
}
|
||||
/* Manual OCSP staple verification if err != 0 */
|
||||
if (err != 0 && staple && stapleSz > 0) {
|
||||
WOLFSSL_CERT_MANAGER* cm = NULL;
|
||||
DecodedCert cert;
|
||||
byte certInit = 0;
|
||||
WOLFSSL_OCSP* ocsp = NULL;
|
||||
WOLFSSL_X509_CHAIN* peerCerts;
|
||||
int i;
|
||||
|
||||
cm = wolfSSL_CertManagerNew();
|
||||
if (cm == NULL)
|
||||
goto cleanup;
|
||||
if (wolfSSL_CertManagerLoadCA(cm, CA_CERT, NULL) != WOLFSSL_SUCCESS)
|
||||
goto cleanup;
|
||||
|
||||
peerCerts = wolfSSL_get_peer_chain(ssl);
|
||||
if (peerCerts == NULL || wolfSSL_get_chain_count(peerCerts) <= (int)idx)
|
||||
goto cleanup;
|
||||
|
||||
for (i = idx + 1; i < wolfSSL_get_chain_count(peerCerts); i++) {
|
||||
if (wolfSSL_CertManagerLoadCABuffer(cm, wolfSSL_get_chain_cert(peerCerts, i),
|
||||
wolfSSL_get_chain_length(peerCerts, i), WOLFSSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS)
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
wc_InitDecodedCert(&cert, wolfSSL_get_chain_cert(peerCerts, idx), wolfSSL_get_chain_length(peerCerts, idx), NULL);
|
||||
certInit = 1;
|
||||
if (wc_ParseCert(&cert, CERT_TYPE, VERIFY, cm) != 0)
|
||||
goto cleanup;
|
||||
if ((ocsp = wc_NewOCSP(cm)) == NULL)
|
||||
goto cleanup;
|
||||
if (wc_CheckCertOcspResponse(ocsp, &cert, staple, stapleSz, NULL) != 0)
|
||||
goto cleanup;
|
||||
|
||||
printf("Client: Manual OCSP staple verification succeeded for idx=%u\n", idx);
|
||||
err = 0;
|
||||
cleanup:
|
||||
wc_FreeOCSP(ocsp);
|
||||
if (certInit)
|
||||
wc_FreeDecodedCert(&cert);
|
||||
wolfSSL_CertManagerFree(cm);
|
||||
if (err == 0)
|
||||
return 0;
|
||||
printf("Client: Manual OCSP staple verification failed for idx=%u\n", idx);
|
||||
}
|
||||
printf("Client: OCSP staple verify error=%d\n", err);
|
||||
return err;
|
||||
}
|
||||
|
||||
int main(int argc, char** argv)
|
||||
{
|
||||
int sockfd = -1;
|
||||
struct sockaddr_in serv_addr;
|
||||
WOLFSSL_CTX* ctx = NULL;
|
||||
WOLFSSL* ssl = NULL;
|
||||
char buf[32];
|
||||
int use_tls13 = 0;
|
||||
int ret = 1;
|
||||
|
||||
if (argc != 2) {
|
||||
printf("Usage: %s [--tls12|--tls13]\n", argv[0]);
|
||||
return 0;
|
||||
}
|
||||
if (strcmp(argv[1], "--tls13") == 0) {
|
||||
use_tls13 = 1;
|
||||
} else if (strcmp(argv[1], "--tls12") == 0) {
|
||||
use_tls13 = 0;
|
||||
} else {
|
||||
printf("Usage: %s [--tls12|--tls13]\n", argv[0]);
|
||||
return 0;
|
||||
}
|
||||
|
||||
wolfSSL_Init();
|
||||
ctx = wolfSSL_CTX_new(use_tls13 ? wolfTLSv1_3_client_method() : wolfTLSv1_2_client_method());
|
||||
if (!ctx) {
|
||||
fprintf(stderr, "wolfSSL_CTX_new (client) failed\n");
|
||||
goto cleanup;
|
||||
}
|
||||
wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, cert_verify_cb);
|
||||
if (wolfSSL_CTX_EnableOCSPStapling(ctx) != WOLFSSL_SUCCESS) {
|
||||
fprintf(stderr, "wolfSSL_CTX_EnableOCSPStapling failed\n");
|
||||
goto cleanup;
|
||||
}
|
||||
if (wolfSSL_CTX_EnableOCSPMustStaple(ctx) != WOLFSSL_SUCCESS) {
|
||||
fprintf(stderr, "wolfSSL_CTX_EnableOCSPMustStaple failed\n");
|
||||
goto cleanup;
|
||||
}
|
||||
if (use_tls13) {
|
||||
if (wolfSSL_CTX_UseOCSPStapling(ctx, WOLFSSL_CSR_OCSP, 0) != WOLFSSL_SUCCESS) {
|
||||
fprintf(stderr, "wolfSSL_CTX_UseOCSPStaplingV2 failed\n");
|
||||
goto cleanup;
|
||||
}
|
||||
}
|
||||
else {
|
||||
if (wolfSSL_CTX_UseOCSPStaplingV2(ctx, WOLFSSL_CSR2_OCSP_MULTI, 0) != WOLFSSL_SUCCESS) {
|
||||
fprintf(stderr, "wolfSSL_CTX_UseOCSPStaplingV2 failed\n");
|
||||
goto cleanup;
|
||||
}
|
||||
}
|
||||
wolfSSL_CTX_set_ocsp_status_verify_cb(ctx, ocsp_verify_cb, NULL);
|
||||
|
||||
sockfd = socket(AF_INET, SOCK_STREAM, 0);
|
||||
if (sockfd < 0) {
|
||||
perror("socket");
|
||||
goto cleanup;
|
||||
}
|
||||
memset(&serv_addr, 0, sizeof(serv_addr));
|
||||
serv_addr.sin_family = AF_INET;
|
||||
serv_addr.sin_port = htons(SERVER_PORT);
|
||||
if (inet_pton(AF_INET, "127.0.0.1", &serv_addr.sin_addr) != 1) {
|
||||
fprintf(stderr, "inet_pton failed for client\n");
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
if (connect(sockfd, (struct sockaddr*)&serv_addr, sizeof(serv_addr)) < 0) {
|
||||
perror("connect");
|
||||
goto cleanup;
|
||||
}
|
||||
ssl = wolfSSL_new(ctx);
|
||||
if (!ssl) {
|
||||
fprintf(stderr, "wolfSSL_new (client) failed\n");
|
||||
goto cleanup;
|
||||
}
|
||||
wolfSSL_set_fd(ssl, sockfd);
|
||||
/* No way to get ssl from the store without OPENSSL_EXTRA */
|
||||
wolfSSL_SetCertCbCtx(ssl, ssl);
|
||||
|
||||
if (wolfSSL_connect(ssl) == WOLFSSL_SUCCESS) {
|
||||
printf("Client: TLS handshake success\n");
|
||||
printf("Negotiated TLS version: %s\n", wolfSSL_get_version(ssl));
|
||||
int n = wolfSSL_read(ssl, buf, sizeof(buf)-1);
|
||||
if (n > 0) {
|
||||
buf[n] = 0;
|
||||
printf("Client: received: %s\n", buf);
|
||||
ret = 0;
|
||||
} else if (n < 0) {
|
||||
fprintf(stderr, "Client: wolfSSL_read failed: %s\n", wolfSSL_ERR_reason_error_string(wolfSSL_get_error(ssl, 0)));
|
||||
goto cleanup;
|
||||
}
|
||||
} else {
|
||||
fprintf(stderr, "Client: TLS handshake failed: %s\n", wolfSSL_ERR_reason_error_string(wolfSSL_get_error(ssl, 0)));
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
ret = 0;
|
||||
cleanup:
|
||||
if (ssl) wolfSSL_free(ssl);
|
||||
if (sockfd >= 0) close(sockfd);
|
||||
if (ctx) wolfSSL_CTX_free(ctx);
|
||||
wolfSSL_Cleanup();
|
||||
return ret;
|
||||
}
|
||||
|
|
@ -0,0 +1,293 @@
|
|||
/* ocsp-server.c
|
||||
*
|
||||
* Standalone OCSP stapling server example.
|
||||
*
|
||||
* Copyright (C) 2006-2025 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL. (formerly known as CyaSSL)
|
||||
*
|
||||
* wolfSSL is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* wolfSSL is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
|
||||
*/
|
||||
|
||||
#include <wolfssl/options.h>
|
||||
#include <wolfssl/ssl.h>
|
||||
#include <wolfssl/ocsp.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <unistd.h>
|
||||
#include <arpa/inet.h>
|
||||
#include <sys/socket.h>
|
||||
#include <netdb.h>
|
||||
|
||||
#define SERVER_CERT "server-certs/server1-cert.pem"
|
||||
#define SERVER_KEY "server-certs/server1-key.pem"
|
||||
#define SERVER_ISSUER_CERT "client-certs/intermediate1-ca-cert.pem"
|
||||
#define SERVER_PORT 11111
|
||||
#define HTTP_TMP_BUFFER_SIZE 512
|
||||
#define URL_SIZE 128
|
||||
|
||||
static unsigned char* ocsp_resp = NULL;
|
||||
static int ocsp_resp_sz = 0;
|
||||
|
||||
/* This callback can be used to choose between multiple certs/keys. It can
|
||||
* be used to select certs based on SNI, ciphersuites, etc. Here we just
|
||||
* load a single cert/key. */
|
||||
static int cert_cb(WOLFSSL* ssl, void* arg)
|
||||
{
|
||||
(void)arg;
|
||||
if (wolfSSL_use_certificate_chain_file(ssl, SERVER_CERT) != WOLFSSL_SUCCESS) {
|
||||
fprintf(stderr, "Error loading server certificate: %s\n", wolfSSL_ERR_reason_error_string(wolfSSL_get_error(ssl, 0)));
|
||||
return 0;
|
||||
}
|
||||
if (wolfSSL_use_PrivateKey_file(ssl, SERVER_KEY, WOLFSSL_FILETYPE_PEM) != WOLFSSL_SUCCESS) {
|
||||
fprintf(stderr, "Error loading server private key: %s\n", wolfSSL_ERR_reason_error_string(wolfSSL_get_error(ssl, 0)));
|
||||
return 0;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
int ocsp_cb(void* ctx, const char* url, int urlSz,
|
||||
byte* ocspReqBuf, int ocspReqSz, byte** ocspRespBuf)
|
||||
{
|
||||
int httpBufSz = 0;
|
||||
byte httpBuf[HTTP_TMP_BUFFER_SIZE];
|
||||
char path[URL_SIZE];
|
||||
char domainName[URL_SIZE];
|
||||
word16 port = 0;
|
||||
SOCKET_T sfd = SOCKET_INVALID;
|
||||
int ret = -1;
|
||||
int respSz = 0;
|
||||
|
||||
if (wolfIO_DecodeUrl(url, urlSz, domainName, path, &port) != 0) {
|
||||
WOLFSSL_MSG("Unable to decode OCSP URL");
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
httpBufSz = wolfIO_HttpBuildRequestOcsp(domainName, path, ocspReqSz,
|
||||
httpBuf, HTTP_TMP_BUFFER_SIZE);
|
||||
if (wolfIO_TcpConnect(&sfd, domainName, port, 0) != 0) {
|
||||
WOLFSSL_MSG("OCSP Responder connection failed");
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
if (wolfIO_Send(sfd, (char*)httpBuf, httpBufSz, 0) != httpBufSz) {
|
||||
WOLFSSL_MSG("OCSP http request failed");
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
if (wolfIO_Send(sfd, (char*)ocspReqBuf, ocspReqSz, 0) != ocspReqSz) {
|
||||
WOLFSSL_MSG("OCSP ocsp request failed");
|
||||
goto cleanup;
|
||||
}
|
||||
if ((respSz = wolfIO_HttpProcessResponseOcsp((int)sfd, ocspRespBuf, httpBuf,
|
||||
HTTP_TMP_BUFFER_SIZE, ctx)) <= 0) {
|
||||
WOLFSSL_MSG("OCSP http response failed");
|
||||
goto cleanup;
|
||||
}
|
||||
ocsp_resp = *ocspRespBuf;
|
||||
ocsp_resp_sz = ret = respSz;
|
||||
cleanup:
|
||||
if (sfd != SOCKET_INVALID)
|
||||
CloseSocket(sfd);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int fetch_ocsp_response(unsigned char** resp, int* respSz)
|
||||
{
|
||||
int ret = -1;
|
||||
WOLFSSL_CERT_MANAGER* cm = NULL;
|
||||
unsigned char* certPem = NULL;
|
||||
unsigned char* certDer = NULL;
|
||||
long certPemSz = 0;
|
||||
int certDerSz = 0;
|
||||
FILE* f = NULL;
|
||||
|
||||
*resp = NULL;
|
||||
*respSz = 0;
|
||||
|
||||
f = fopen(SERVER_CERT, "rb");
|
||||
if (!f) {
|
||||
fprintf(stderr, "Failed to open server cert: %s\n", SERVER_CERT);
|
||||
goto cleanup;
|
||||
}
|
||||
fseek(f, 0, SEEK_END);
|
||||
certPemSz = ftell(f);
|
||||
fseek(f, 0, SEEK_SET);
|
||||
certPem = (unsigned char*)malloc(certPemSz);
|
||||
if (!certPem) {
|
||||
fprintf(stderr, "malloc failed\n");
|
||||
goto cleanup;
|
||||
}
|
||||
if (fread(certPem, 1, certPemSz, f) != (size_t)certPemSz) {
|
||||
fprintf(stderr, "fread failed\n");
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
certDer = (unsigned char*)malloc(certPemSz);
|
||||
if (!certDer) {
|
||||
fprintf(stderr, "malloc failed\n");
|
||||
goto cleanup;
|
||||
}
|
||||
certDerSz = wolfSSL_CertPemToDer(certPem, (int)certPemSz, certDer, (int)certPemSz, CERT_TYPE);
|
||||
if (certDerSz <= 0) {
|
||||
fprintf(stderr, "wolfSSL_CertPemToDer failed\n");
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
cm = wolfSSL_CertManagerNew();
|
||||
if (!cm) {
|
||||
fprintf(stderr, "wolfSSL_CertManagerNew failed\n");
|
||||
goto cleanup;
|
||||
}
|
||||
if (wolfSSL_CertManagerEnableOCSP(cm, WOLFSSL_OCSP_NO_NONCE) != WOLFSSL_SUCCESS) {
|
||||
fprintf(stderr, "wolfSSL_CertManagerEnableOCSP failed\n");
|
||||
goto cleanup;
|
||||
}
|
||||
if (wolfSSL_CertManagerLoadCA(cm, SERVER_ISSUER_CERT, NULL) != WOLFSSL_SUCCESS) {
|
||||
fprintf(stderr, "wolfSSL_CertManagerLoadCA failed for issuer cert: %s\n", SERVER_ISSUER_CERT);
|
||||
goto cleanup;
|
||||
}
|
||||
wolfSSL_CertManagerSetOCSP_Cb(cm, ocsp_cb, NULL, NULL);
|
||||
|
||||
/* This calls ocsp_cb to fetch the response and verifies it. ocsp_cb stores the response globally. */
|
||||
if (wolfSSL_CertManagerCheckOCSP(cm, certDer, certDerSz) == WOLFSSL_SUCCESS) {
|
||||
ret = 0;
|
||||
} else {
|
||||
fprintf(stderr, "wolfSSL_CertManagerCheckOCSP failed or OCSP not verified\n");
|
||||
}
|
||||
|
||||
cleanup:
|
||||
if (f) fclose(f);
|
||||
if (certPem) free(certPem);
|
||||
if (certDer) free(certDer);
|
||||
if (cm) wolfSSL_CertManagerFree(cm);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int status_cb(WOLFSSL* ssl, void* ctx)
|
||||
{
|
||||
unsigned char* resp_buf;
|
||||
|
||||
(void)ctx;
|
||||
if (ocsp_resp == NULL || ocsp_resp_sz == 0)
|
||||
return WOLFSSL_OCSP_STATUS_CB_ALERT_FATAL;
|
||||
|
||||
resp_buf = (unsigned char*)malloc(ocsp_resp_sz);
|
||||
if (resp_buf == NULL)
|
||||
return WOLFSSL_OCSP_STATUS_CB_ALERT_FATAL;
|
||||
|
||||
memcpy(resp_buf, ocsp_resp, ocsp_resp_sz);
|
||||
if (wolfSSL_set_tlsext_status_ocsp_resp(ssl, resp_buf, ocsp_resp_sz) != WOLFSSL_SUCCESS) {
|
||||
free(resp_buf);
|
||||
return WOLFSSL_OCSP_STATUS_CB_ALERT_FATAL;
|
||||
}
|
||||
|
||||
/* wolfSSL takes ownership of resp_buf, so do not free it here */
|
||||
return WOLFSSL_OCSP_STATUS_CB_OK;
|
||||
}
|
||||
|
||||
int main()
|
||||
{
|
||||
int listenfd = -1, connfd = -1;
|
||||
struct sockaddr_in serv_addr;
|
||||
WOLFSSL_CTX* ctx = NULL;
|
||||
WOLFSSL* ssl = NULL;
|
||||
int ret = 1;
|
||||
|
||||
if (fetch_ocsp_response(&ocsp_resp, &ocsp_resp_sz) != 0) {
|
||||
fprintf(stderr, "Failed to fetch OCSP response at startup\n");
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
wolfSSL_Init();
|
||||
ctx = wolfSSL_CTX_new(wolfTLS_server_method());
|
||||
if (!ctx) {
|
||||
fprintf(stderr, "wolfSSL_CTX_new failed\n");
|
||||
goto cleanup;
|
||||
}
|
||||
wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL);
|
||||
wolfSSL_CTX_set_cert_cb(ctx, cert_cb, NULL);
|
||||
|
||||
if (wolfSSL_CTX_set_tlsext_status_cb(ctx, status_cb) != WOLFSSL_SUCCESS) {
|
||||
fprintf(stderr, "wolfSSL_CTX_set_tlsext_status_cb failed\n");
|
||||
goto cleanup;
|
||||
}
|
||||
if (wolfSSL_CTX_set_tlsext_status_arg(ctx, NULL) <= 0) {
|
||||
fprintf(stderr, "wolfSSL_CTX_set_tlsext_status_arg failed\n");
|
||||
goto cleanup;
|
||||
}
|
||||
if (wolfSSL_CTX_EnableOCSPStapling(ctx) != WOLFSSL_SUCCESS) {
|
||||
fprintf(stderr, "wolfSSL_CTX_EnableOCSPStapling failed\n");
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
listenfd = socket(AF_INET, SOCK_STREAM, 0);
|
||||
if (listenfd < 0) {
|
||||
perror("socket");
|
||||
goto cleanup;
|
||||
}
|
||||
int optval = 1;
|
||||
if (setsockopt(listenfd, SOL_SOCKET, SO_REUSEADDR, &optval, sizeof(optval)) < 0) {
|
||||
perror("setsockopt");
|
||||
goto cleanup;
|
||||
}
|
||||
memset(&serv_addr, 0, sizeof(serv_addr));
|
||||
serv_addr.sin_family = AF_INET;
|
||||
serv_addr.sin_addr.s_addr = INADDR_ANY;
|
||||
serv_addr.sin_port = htons(SERVER_PORT);
|
||||
if (bind(listenfd, (struct sockaddr*)&serv_addr, sizeof(serv_addr)) < 0) {
|
||||
perror("bind");
|
||||
goto cleanup;
|
||||
}
|
||||
if (listen(listenfd, 1) < 0) {
|
||||
perror("listen");
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
printf("Server: waiting for connection...\n");
|
||||
connfd = accept(listenfd, NULL, NULL);
|
||||
if (connfd < 0) {
|
||||
perror("accept");
|
||||
goto cleanup;
|
||||
}
|
||||
ssl = wolfSSL_new(ctx);
|
||||
if (!ssl) {
|
||||
fprintf(stderr, "wolfSSL_new failed\n");
|
||||
goto cleanup;
|
||||
}
|
||||
wolfSSL_set_fd(ssl, connfd);
|
||||
|
||||
if (wolfSSL_accept(ssl) == WOLFSSL_SUCCESS) {
|
||||
printf("Server: TLS handshake success\n");
|
||||
printf("Negotiated TLS version: %s\n", wolfSSL_get_version(ssl));
|
||||
if (wolfSSL_write(ssl, "hello", 5) != 5) {
|
||||
fprintf(stderr, "Server: wolfSSL_write failed\n");
|
||||
goto cleanup;
|
||||
}
|
||||
} else {
|
||||
fprintf(stderr, "Server: TLS handshake failed: %s\n", wolfSSL_ERR_reason_error_string(wolfSSL_get_error(ssl, 0)));
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
ret = 0;
|
||||
cleanup:
|
||||
if (ssl) wolfSSL_free(ssl);
|
||||
if (connfd >= 0) close(connfd);
|
||||
if (listenfd >= 0) close(listenfd);
|
||||
if (ctx) wolfSSL_CTX_free(ctx);
|
||||
wolfSSL_Cleanup();
|
||||
return ret;
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
V 161213070133Z 05 unknown /C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=www1.wolfssl.com/emailAddress=info@wolfssl.com
|
||||
|
|
@ -0,0 +1,181 @@
|
|||
Certificate:
|
||||
Data:
|
||||
Version: 3 (0x2)
|
||||
Serial Number: 4 (0x4)
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Issuer: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com
|
||||
Validity
|
||||
Not Before: Dec 18 21:25:31 2024 GMT
|
||||
Not After : Sep 14 21:25:31 2027 GMT
|
||||
Subject: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL OCSP Responder, emailAddress = info@wolfssl.com
|
||||
Subject Public Key Info:
|
||||
Public Key Algorithm: rsaEncryption
|
||||
Public-Key: (2048 bit)
|
||||
Modulus:
|
||||
00:b8:ba:23:b4:f6:c3:7b:14:c3:a4:f5:1d:61:a1:
|
||||
f5:1e:63:b9:85:23:34:50:6d:f8:7c:a2:8a:04:8b:
|
||||
d5:75:5c:2d:f7:63:88:d1:07:7a:ea:0b:45:35:2b:
|
||||
eb:1f:b1:22:b4:94:41:38:e2:9d:74:d6:8b:30:22:
|
||||
10:51:c5:db:ca:3f:46:2b:fe:e5:5a:3f:41:74:67:
|
||||
75:95:a9:94:d5:c3:ee:42:f8:8d:eb:92:95:e1:d9:
|
||||
65:b7:43:c4:18:de:16:80:90:ce:24:35:21:c4:55:
|
||||
ac:5a:51:e0:2e:2d:b3:0a:5a:4f:4a:73:31:50:ee:
|
||||
4a:16:bd:39:8b:ad:05:48:87:b1:99:e2:10:a7:06:
|
||||
72:67:ca:5c:d1:97:bd:c8:f1:76:f8:e0:4a:ec:bc:
|
||||
93:f4:66:4c:28:71:d1:d8:66:03:b4:90:30:bb:17:
|
||||
b0:fe:97:f5:1e:e8:c7:5d:9b:8b:11:19:12:3c:ab:
|
||||
82:71:78:ff:ae:3f:32:b2:08:71:b2:1b:8c:27:ac:
|
||||
11:b8:d8:43:49:cf:b0:70:b1:f0:8c:ae:da:24:87:
|
||||
17:3b:d8:04:65:6c:00:76:50:ef:15:08:d7:b4:73:
|
||||
68:26:14:87:95:c3:5f:6e:61:b8:87:84:fa:80:1a:
|
||||
0a:8b:98:f3:e3:ff:4e:44:1c:65:74:7c:71:54:65:
|
||||
e5:39
|
||||
Exponent: 65537 (0x10001)
|
||||
X509v3 extensions:
|
||||
X509v3 Basic Constraints:
|
||||
CA:FALSE
|
||||
X509v3 Subject Key Identifier:
|
||||
32:67:E1:B1:79:D2:81:FC:9F:23:0C:70:40:50:B5:46:56:B8:30:36
|
||||
X509v3 Authority Key Identifier:
|
||||
keyid:73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21
|
||||
DirName:/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=wolfSSL root CA/emailAddress=info@wolfssl.com
|
||||
serial:63
|
||||
X509v3 Extended Key Usage:
|
||||
OCSP Signing
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Signature Value:
|
||||
4d:a2:d8:55:e0:2b:f4:ad:65:e2:92:35:cb:60:a0:a2:6b:a6:
|
||||
88:c1:86:58:57:37:bd:2e:28:6e:1c:56:2a:35:de:ff:3e:8e:
|
||||
3d:47:21:1a:e9:d3:c6:b4:e2:cb:3e:c6:af:9b:ef:23:88:56:
|
||||
95:73:2e:b3:ed:c5:11:4b:69:f7:13:3a:05:e1:af:ba:c9:59:
|
||||
fd:e2:a0:81:a0:4c:0c:2c:cb:57:ad:96:3a:8c:32:a6:4a:f8:
|
||||
72:b8:ec:b3:26:69:d6:6a:4c:4c:78:18:3c:ca:19:f1:b5:8e:
|
||||
23:81:5b:27:90:e0:5c:2b:17:4d:78:99:6b:25:bd:2f:ae:1b:
|
||||
aa:ce:84:b9:44:21:46:c0:34:6b:5b:b9:1b:ca:5c:60:f1:ef:
|
||||
e6:66:bc:84:63:56:50:7d:bb:2c:2f:7b:47:b4:fd:58:77:87:
|
||||
ee:27:20:96:72:8e:4c:7e:4f:93:eb:5f:8f:9c:1e:59:7a:96:
|
||||
aa:53:77:22:41:d8:d3:f9:89:8f:e8:9d:65:bd:0c:71:3c:bb:
|
||||
a3:07:bf:fb:a8:d1:18:0a:b4:c4:f7:83:b3:86:2b:f0:5b:05:
|
||||
28:c1:01:31:73:5c:2b:bd:60:97:a3:36:82:96:d7:83:df:75:
|
||||
ee:29:42:97:86:41:55:b9:70:87:d5:02:85:13:41:f8:25:05:
|
||||
ab:6a:aa:57
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEvjCCA6agAwIBAgIBBDANBgkqhkiG9w0BAQsFADCBlzELMAkGA1UEBhMCVVMx
|
||||
EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoM
|
||||
B3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NM
|
||||
IHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjQx
|
||||
MjE4MjEyNTMxWhcNMjcwOTE0MjEyNTMxWjCBnjELMAkGA1UEBhMCVVMxEzARBgNV
|
||||
BAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dvbGZT
|
||||
U0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMR8wHQYDVQQDDBZ3b2xmU1NMIE9DU1Ag
|
||||
UmVzcG9uZGVyMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMIIBIjAN
|
||||
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuLojtPbDexTDpPUdYaH1HmO5hSM0
|
||||
UG34fKKKBIvVdVwt92OI0Qd66gtFNSvrH7EitJRBOOKddNaLMCIQUcXbyj9GK/7l
|
||||
Wj9BdGd1lamU1cPuQviN65KV4dllt0PEGN4WgJDOJDUhxFWsWlHgLi2zClpPSnMx
|
||||
UO5KFr05i60FSIexmeIQpwZyZ8pc0Ze9yPF2+OBK7LyT9GZMKHHR2GYDtJAwuxew
|
||||
/pf1HujHXZuLERkSPKuCcXj/rj8ysghxshuMJ6wRuNhDSc+wcLHwjK7aJIcXO9gE
|
||||
ZWwAdlDvFQjXtHNoJhSHlcNfbmG4h4T6gBoKi5jz4/9ORBxldHxxVGXlOQIDAQAB
|
||||
o4IBCjCCAQYwCQYDVR0TBAIwADAdBgNVHQ4EFgQUMmfhsXnSgfyfIwxwQFC1Rla4
|
||||
MDYwgcQGA1UdIwSBvDCBuYAUc7AcpC+Cy89HpTjXsASCOn5yFSGhgZ2kgZowgZcx
|
||||
CzAJBgNVBAYTAlVTMRMwEQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0
|
||||
dGxlMRAwDgYDVQQKDAd3b2xmU1NMMRQwEgYDVQQLDAtFbmdpbmVlcmluZzEYMBYG
|
||||
A1UEAwwPd29sZlNTTCByb290IENBMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZz
|
||||
c2wuY29tggFjMBMGA1UdJQQMMAoGCCsGAQUFBwMJMA0GCSqGSIb3DQEBCwUAA4IB
|
||||
AQBNothV4Cv0rWXikjXLYKCia6aIwYZYVze9LihuHFYqNd7/Po49RyEa6dPGtOLL
|
||||
Psavm+8jiFaVcy6z7cURS2n3EzoF4a+6yVn94qCBoEwMLMtXrZY6jDKmSvhyuOyz
|
||||
JmnWakxMeBg8yhnxtY4jgVsnkOBcKxdNeJlrJb0vrhuqzoS5RCFGwDRrW7kbylxg
|
||||
8e/mZryEY1ZQfbssL3tHtP1Yd4fuJyCWco5Mfk+T61+PnB5ZepaqU3ciQdjT+YmP
|
||||
6J1lvQxxPLujB7/7qNEYCrTE94OzhivwWwUowQExc1wrvWCXozaClteD33XuKUKX
|
||||
hkFVuXCH1QKFE0H4JQWraqpX
|
||||
-----END CERTIFICATE-----
|
||||
Certificate:
|
||||
Data:
|
||||
Version: 3 (0x2)
|
||||
Serial Number: 99 (0x63)
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Issuer: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com
|
||||
Validity
|
||||
Not Before: Dec 18 21:25:31 2024 GMT
|
||||
Not After : Sep 14 21:25:31 2027 GMT
|
||||
Subject: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com
|
||||
Subject Public Key Info:
|
||||
Public Key Algorithm: rsaEncryption
|
||||
Public-Key: (2048 bit)
|
||||
Modulus:
|
||||
00:ab:2c:b4:2f:1d:06:09:ef:4e:29:86:84:7e:cc:
|
||||
bf:a6:79:7c:f0:c0:c1:64:25:8c:75:b7:10:05:ca:
|
||||
48:27:0c:0e:32:1c:b0:fe:99:85:39:b6:b9:a2:f7:
|
||||
27:ff:6d:3c:8c:16:73:29:21:7f:8b:a6:54:71:90:
|
||||
ad:cc:05:b9:9f:15:c7:0a:3f:5f:69:f4:0a:5f:8c:
|
||||
71:b5:2c:bf:66:e2:03:9a:32:f4:d2:ec:2a:89:4b:
|
||||
f9:35:88:14:33:47:4e:2e:05:79:01:ed:64:36:76:
|
||||
b9:f8:85:cd:01:88:ac:c5:b2:b1:59:b8:cd:5a:f4:
|
||||
09:09:38:9b:da:5a:cf:ce:78:99:1f:49:3d:41:d6:
|
||||
06:7c:52:99:c8:97:d1:b3:80:3a:a2:4f:36:c4:c5:
|
||||
96:30:77:31:38:c8:70:cc:e1:67:06:b3:2b:2f:93:
|
||||
b5:69:cf:83:7e:88:53:9b:0f:46:21:4c:d6:05:36:
|
||||
44:99:60:68:47:e5:32:01:12:d4:10:73:ae:9a:34:
|
||||
94:fa:6e:b8:58:4f:7b:5b:8a:92:97:ad:fd:97:b9:
|
||||
75:ca:c2:d4:45:7d:17:6b:cd:2f:f3:63:7a:0e:30:
|
||||
b5:0b:a9:d9:a6:7c:74:60:9d:cc:09:03:43:f1:0f:
|
||||
90:d3:b7:fe:6c:9f:d9:cd:78:4b:15:ae:8c:5b:f9:
|
||||
99:81
|
||||
Exponent: 65537 (0x10001)
|
||||
X509v3 extensions:
|
||||
X509v3 Basic Constraints:
|
||||
CA:TRUE
|
||||
X509v3 Subject Key Identifier:
|
||||
73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21
|
||||
X509v3 Authority Key Identifier:
|
||||
keyid:73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21
|
||||
DirName:/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=wolfSSL root CA/emailAddress=info@wolfssl.com
|
||||
serial:63
|
||||
X509v3 Key Usage:
|
||||
Certificate Sign, CRL Sign
|
||||
Authority Information Access:
|
||||
OCSP - URI:http://127.0.0.1:22220
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Signature Value:
|
||||
76:e8:fa:f6:1e:5b:0e:ff:24:43:e0:cb:19:26:38:d9:df:18:
|
||||
5d:66:e1:4b:ac:e4:8e:b0:49:2c:d6:04:20:eb:4a:a8:06:d7:
|
||||
55:ec:6b:38:f8:0f:8c:e6:c9:ec:42:f0:ca:07:9f:88:7a:ee:
|
||||
bf:af:3f:7d:d3:45:67:20:84:bb:c7:c5:32:69:ab:59:e1:e3:
|
||||
38:4b:ed:18:2e:de:da:88:ec:a0:b7:ff:c1:50:96:73:e3:03:
|
||||
df:a1:e7:47:93:13:1d:fb:e6:6b:37:3e:50:a3:eb:5b:24:26:
|
||||
d2:43:2e:6e:9c:83:9c:fb:79:ba:cd:fd:3b:e5:87:87:a7:0f:
|
||||
5f:f9:64:34:56:5e:8b:13:e2:c4:41:e3:9d:3e:36:2d:cb:d3:
|
||||
5f:d3:12:90:bf:78:c1:4c:df:eb:7b:99:e6:1e:ee:52:78:6f:
|
||||
0c:82:e1:59:d4:25:40:e5:24:95:3e:0f:cc:08:60:fe:b4:8c:
|
||||
48:42:bf:29:74:92:71:1a:85:00:a7:4c:f0:c0:32:47:f3:be:
|
||||
f4:08:5c:f2:43:e0:b9:76:86:60:9a:3b:af:d6:32:41:5f:b0:
|
||||
04:12:44:2a:44:19:d4:27:d3:ce:71:7e:5b:16:1a:f5:0c:db:
|
||||
43:b0:a6:bb:76:02:f6:e0:30:4e:04:f4:f3:9b:cd:d4:ae:45:
|
||||
94:c5:8c:bb
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIE5jCCA86gAwIBAgIBYzANBgkqhkiG9w0BAQsFADCBlzELMAkGA1UEBhMCVVMx
|
||||
EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoM
|
||||
B3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NM
|
||||
IHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjQx
|
||||
MjE4MjEyNTMxWhcNMjcwOTE0MjEyNTMxWjCBlzELMAkGA1UEBhMCVVMxEzARBgNV
|
||||
BAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dvbGZT
|
||||
U0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NMIHJvb3Qg
|
||||
Q0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wggEiMA0GCSqGSIb3
|
||||
DQEBAQUAA4IBDwAwggEKAoIBAQCrLLQvHQYJ704phoR+zL+meXzwwMFkJYx1txAF
|
||||
ykgnDA4yHLD+mYU5trmi9yf/bTyMFnMpIX+LplRxkK3MBbmfFccKP19p9ApfjHG1
|
||||
LL9m4gOaMvTS7CqJS/k1iBQzR04uBXkB7WQ2drn4hc0BiKzFsrFZuM1a9AkJOJva
|
||||
Ws/OeJkfST1B1gZ8UpnIl9GzgDqiTzbExZYwdzE4yHDM4WcGsysvk7Vpz4N+iFOb
|
||||
D0YhTNYFNkSZYGhH5TIBEtQQc66aNJT6brhYT3tbipKXrf2XuXXKwtRFfRdrzS/z
|
||||
Y3oOMLULqdmmfHRgncwJA0PxD5DTt/5sn9nNeEsVroxb+ZmBAgMBAAGjggE5MIIB
|
||||
NTAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRzsBykL4LLz0elONewBII6fnIVITCB
|
||||
xAYDVR0jBIG8MIG5gBRzsBykL4LLz0elONewBII6fnIVIaGBnaSBmjCBlzELMAkG
|
||||
A1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUx
|
||||
EDAOBgNVBAoMB3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQD
|
||||
DA93b2xmU1NMIHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5j
|
||||
b22CAWMwCwYDVR0PBAQDAgEGMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAYYW
|
||||
aHR0cDovLzEyNy4wLjAuMToyMjIyMDANBgkqhkiG9w0BAQsFAAOCAQEAduj69h5b
|
||||
Dv8kQ+DLGSY42d8YXWbhS6zkjrBJLNYEIOtKqAbXVexrOPgPjObJ7ELwygefiHru
|
||||
v68/fdNFZyCEu8fFMmmrWeHjOEvtGC7e2ojsoLf/wVCWc+MD36HnR5MTHfvmazc+
|
||||
UKPrWyQm0kMubpyDnPt5us39O+WHh6cPX/lkNFZeixPixEHjnT42LcvTX9MSkL94
|
||||
wUzf63uZ5h7uUnhvDILhWdQlQOUklT4PzAhg/rSMSEK/KXSScRqFAKdM8MAyR/O+
|
||||
9Ahc8kPguXaGYJo7r9YyQV+wBBJEKkQZ1CfTznF+WxYa9QzbQ7Cmu3YC9uAwTgT0
|
||||
85vN1K5FlMWMuw==
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEowIBAAKCAQEAuLojtPbDexTDpPUdYaH1HmO5hSM0UG34fKKKBIvVdVwt92OI
|
||||
0Qd66gtFNSvrH7EitJRBOOKddNaLMCIQUcXbyj9GK/7lWj9BdGd1lamU1cPuQviN
|
||||
65KV4dllt0PEGN4WgJDOJDUhxFWsWlHgLi2zClpPSnMxUO5KFr05i60FSIexmeIQ
|
||||
pwZyZ8pc0Ze9yPF2+OBK7LyT9GZMKHHR2GYDtJAwuxew/pf1HujHXZuLERkSPKuC
|
||||
cXj/rj8ysghxshuMJ6wRuNhDSc+wcLHwjK7aJIcXO9gEZWwAdlDvFQjXtHNoJhSH
|
||||
lcNfbmG4h4T6gBoKi5jz4/9ORBxldHxxVGXlOQIDAQABAoIBAGI2tR1VxYD+/TYL
|
||||
DGAIV+acZtqeaQYKMf8x++eG4SrQo6/QP8HDFFqzO0yV2SC0cRtJZ5PzCHxCRSaG
|
||||
Nd8EL2NMWOazUwW0c/yLtTypOPSeg2Mf+3SwLvgxOZ9CbFQ8YAJi+vbNOPLGCijL
|
||||
N0HWEkcC1P1kWWgKCWIloR7eEt0IQOb5PPSCu3buq/rForb6qUf+L+ESpWed6bnc
|
||||
uhIrHDuQ/PopW05fW1r61zI286wKdLRyatQsljNqPvVdFVhtCKqCqMHdIzMg2cbh
|
||||
q9DJMWc/KLjzBk6YPMZKm/4k4RXj+IwS+iITbpUNrhYj2TMevBMPW3AIRobD823D
|
||||
ehQv+rECgYEA3CWL+G9zJ5PXRDAdQ69lN+CE/Uf9444CN5idMO+qRQ+QE8hWYT/U
|
||||
PFH/aUgd1k3WJZseR/GTWx29VsRPSDWZXzwzLfUNKnqvp0b2oZe/EdYiRSo8OCPp
|
||||
kF07HbTKe4Cyma7HdgDkNkS+UW5JujnuLcuee+wTq6xU0289juwFBc8CgYEA1s/d
|
||||
VtwXqBf3qMxfi+eMa77fqxptAFGtZNKNkYwX42Ow6Hehj8EnoPqYEF+9MzKn/BFh
|
||||
ROnQ76axKBN8mkRUjpv7d2+zMlDnGrWul8q6VrfGiU2P7jd4L6GY/V1MYktnIBsd
|
||||
Ld/jW8P0FFfI2RIREPWdrATxBhQpTJfXd/7rLncCgYB1wrvyBCQUSrg/KIGvADbj
|
||||
wf1Bw23jeMZk2QVU9Q8e7ClE+8iBMvSj47T9q28SgQaJjUWQdIA/oFP1AwPp+4n0
|
||||
cK5r6gbF72Tg1Uv+ur6hmuswFlyqJ0O8TrLdvCUIFZr0LJNT4zwwb2tjAdz8ehqX
|
||||
crFvVqRbE884XuwN9ODm7wKBgQDIEnKlI/kkpq4UmcWkGNXAxNauFr7PPUOyVCln
|
||||
FoRpVcC/xCzGJ7ExTjWzing950BulgFynhPsIeV+3id/x4S6Dq34YCEXDCMzzWQA
|
||||
HOHRQvm3iHY1+ZQHSQulb/Bk3LYAQUC8KXspTSlYiSqYgytCEIH6Zd/XOY/9tq8J
|
||||
JHUHoQKBgHYIB2mRCuDK5C3dCspdPVeAUqptK1nnXxWY/MXA6v+M4wFsIxV7Iwg7
|
||||
HEjeD5yKH4619syPCFz3jrCxL0oJqVTD2tnrbLf8idEt2eaV/3o2mUGFjvWpTywg
|
||||
F8DewhrGh6z7FWHp4cMrxpq1hkdi6k+481T1GKBJ1zBSTzskTHQB
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
|
@ -0,0 +1,276 @@
|
|||
Certificate:
|
||||
Data:
|
||||
Version: 3 (0x2)
|
||||
Serial Number: 5 (0x5)
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Issuer: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL intermediate CA 1, emailAddress = info@wolfssl.com
|
||||
Validity
|
||||
Not Before: Dec 18 21:25:31 2024 GMT
|
||||
Not After : Sep 14 21:25:31 2027 GMT
|
||||
Subject: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = www1.wolfssl.com, emailAddress = info@wolfssl.com
|
||||
Subject Public Key Info:
|
||||
Public Key Algorithm: rsaEncryption
|
||||
Public-Key: (2048 bit)
|
||||
Modulus:
|
||||
00:e6:96:55:75:cf:8a:97:68:8c:b6:38:f6:7a:05:
|
||||
be:33:b6:51:47:37:8a:f7:db:91:be:92:6b:b7:00:
|
||||
8c:f2:c5:24:6e:18:e9:92:00:81:01:dc:b3:4c:28:
|
||||
a9:b7:80:f1:96:cf:23:7a:2f:ae:f8:e3:0f:2d:d3:
|
||||
5e:23:e7:db:4c:b2:5d:89:16:17:be:be:81:db:fb:
|
||||
12:6d:28:4b:10:a0:12:04:27:c1:c9:d0:79:95:ef:
|
||||
e8:8d:8c:59:9b:4e:72:7d:bc:49:2b:22:4e:f8:4f:
|
||||
e2:0c:f1:e9:e9:97:f9:df:8c:5a:0a:aa:38:1d:43:
|
||||
04:a3:a7:89:a1:e2:83:a4:4b:b5:4e:45:88:a6:22:
|
||||
5d:ac:a9:58:67:88:c1:d5:61:ef:bd:11:05:27:94:
|
||||
47:bb:33:a5:8a:ca:ee:1f:8d:c0:6e:24:af:cd:ca:
|
||||
bf:80:47:71:95:ac:a9:f1:5d:23:6c:f5:4b:b4:a9:
|
||||
e1:c4:66:fb:e5:c4:a1:9f:a7:51:d1:78:cd:2e:b4:
|
||||
3f:2e:e2:82:f3:7f:c4:a7:f4:31:cf:76:27:3f:db:
|
||||
2e:d2:6e:c3:47:23:82:a3:48:40:8c:a7:c1:13:f0:
|
||||
63:50:54:43:f6:71:12:e1:6f:a5:7a:58:26:f7:fd:
|
||||
8b:3b:70:18:a0:43:ba:01:6b:b3:f8:d5:be:05:13:
|
||||
64:31
|
||||
Exponent: 65537 (0x10001)
|
||||
X509v3 extensions:
|
||||
X509v3 Basic Constraints:
|
||||
CA:FALSE
|
||||
X509v3 Subject Key Identifier:
|
||||
CC:55:15:00:E2:44:89:92:63:6D:10:5D:B9:9E:73:B6:5D:3A:19:CA
|
||||
X509v3 Authority Key Identifier:
|
||||
keyid:83:C6:3A:89:2C:81:F4:02:D7:9D:4C:E2:2A:C0:71:82:64:44:DA:0E
|
||||
DirName:/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=wolfSSL root CA/emailAddress=info@wolfssl.com
|
||||
serial:01
|
||||
X509v3 Key Usage:
|
||||
Digital Signature, Non Repudiation, Key Encipherment
|
||||
Authority Information Access:
|
||||
OCSP - URI:http://127.0.0.1:22221
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Signature Value:
|
||||
7c:53:b6:71:1e:1a:9a:54:42:15:3a:81:06:d2:7c:bc:56:63:
|
||||
13:0a:4d:21:3f:59:68:4c:07:17:65:a1:26:ce:10:4c:90:f5:
|
||||
13:66:60:9b:9c:d9:85:7f:a3:da:9f:a6:d7:69:df:c7:b1:0b:
|
||||
4d:14:93:32:7f:df:7a:e6:ab:cc:74:de:a8:6d:c5:4c:55:be:
|
||||
a1:8a:14:48:38:e0:34:76:5c:cb:27:6b:a1:31:de:6c:bc:ac:
|
||||
ea:73:7e:ce:ad:86:e2:54:7b:0f:87:4f:b7:24:c0:06:83:17:
|
||||
0d:75:a7:09:5e:2f:74:c3:85:f5:2e:ec:84:21:b6:ce:93:0d:
|
||||
bf:5c:39:24:5d:e0:63:25:04:5c:23:a7:d8:93:e8:1a:34:44:
|
||||
fb:67:94:80:45:7c:78:31:20:d1:ed:a2:06:6b:84:1f:3a:99:
|
||||
f2:de:14:cb:8e:cf:fd:dd:51:a3:af:17:8a:83:f3:f5:4e:ea:
|
||||
a5:33:c8:fa:84:9a:17:7e:5d:6f:f8:90:2e:ac:88:66:b6:49:
|
||||
44:72:85:43:ca:58:d9:94:56:85:98:56:b8:34:d4:22:5d:8e:
|
||||
7a:35:ef:5a:96:15:29:2d:7b:f1:1f:55:98:7f:2f:d8:08:36:
|
||||
ec:c9:a1:c6:05:3e:db:dd:e4:f8:2d:ca:92:e0:e8:a4:e4:7c:
|
||||
39:77:72:97
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIE7jCCA9agAwIBAgIBBTANBgkqhkiG9w0BAQsFADCBoTELMAkGA1UEBhMCVVMx
|
||||
EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoM
|
||||
B3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMSIwIAYDVQQDDBl3b2xmU1NM
|
||||
IGludGVybWVkaWF0ZSBDQSAxMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wu
|
||||
Y29tMB4XDTI0MTIxODIxMjUzMVoXDTI3MDkxNDIxMjUzMVowgZgxCzAJBgNVBAYT
|
||||
AlVTMRMwEQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMRAwDgYD
|
||||
VQQKDAd3b2xmU1NMMRQwEgYDVQQLDAtFbmdpbmVlcmluZzEZMBcGA1UEAwwQd3d3
|
||||
MS53b2xmc3NsLmNvbTEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTCC
|
||||
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOaWVXXPipdojLY49noFvjO2
|
||||
UUc3ivfbkb6Sa7cAjPLFJG4Y6ZIAgQHcs0woqbeA8ZbPI3ovrvjjDy3TXiPn20yy
|
||||
XYkWF76+gdv7Em0oSxCgEgQnwcnQeZXv6I2MWZtOcn28SSsiTvhP4gzx6emX+d+M
|
||||
WgqqOB1DBKOniaHig6RLtU5FiKYiXaypWGeIwdVh770RBSeUR7szpYrK7h+NwG4k
|
||||
r83Kv4BHcZWsqfFdI2z1S7Sp4cRm++XEoZ+nUdF4zS60Py7igvN/xKf0Mc92Jz/b
|
||||
LtJuw0cjgqNIQIynwRPwY1BUQ/ZxEuFvpXpYJvf9iztwGKBDugFrs/jVvgUTZDEC
|
||||
AwEAAaOCATYwggEyMAkGA1UdEwQCMAAwHQYDVR0OBBYEFMxVFQDiRImSY20QXbme
|
||||
c7ZdOhnKMIHEBgNVHSMEgbwwgbmAFIPGOoksgfQC151M4irAcYJkRNoOoYGdpIGa
|
||||
MIGXMQswCQYDVQQGEwJVUzETMBEGA1UECAwKV2FzaGluZ3RvbjEQMA4GA1UEBwwH
|
||||
U2VhdHRsZTEQMA4GA1UECgwHd29sZlNTTDEUMBIGA1UECwwLRW5naW5lZXJpbmcx
|
||||
GDAWBgNVBAMMD3dvbGZTU0wgcm9vdCBDQTEfMB0GCSqGSIb3DQEJARYQaW5mb0B3
|
||||
b2xmc3NsLmNvbYIBATALBgNVHQ8EBAMCBeAwMgYIKwYBBQUHAQEEJjAkMCIGCCsG
|
||||
AQUFBzABhhZodHRwOi8vMTI3LjAuMC4xOjIyMjIxMA0GCSqGSIb3DQEBCwUAA4IB
|
||||
AQB8U7ZxHhqaVEIVOoEG0ny8VmMTCk0hP1loTAcXZaEmzhBMkPUTZmCbnNmFf6Pa
|
||||
n6bXad/HsQtNFJMyf9965qvMdN6obcVMVb6hihRIOOA0dlzLJ2uhMd5svKzqc37O
|
||||
rYbiVHsPh0+3JMAGgxcNdacJXi90w4X1LuyEIbbOkw2/XDkkXeBjJQRcI6fYk+ga
|
||||
NET7Z5SARXx4MSDR7aIGa4QfOpny3hTLjs/93VGjrxeKg/P1TuqlM8j6hJoXfl1v
|
||||
+JAurIhmtklEcoVDyljZlFaFmFa4NNQiXY56Ne9alhUpLXvxH1WYfy/YCDbsyaHG
|
||||
BT7b3eT4LcqS4Oik5Hw5d3KX
|
||||
-----END CERTIFICATE-----
|
||||
Certificate:
|
||||
Data:
|
||||
Version: 3 (0x2)
|
||||
Serial Number: 1 (0x1)
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Issuer: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com
|
||||
Validity
|
||||
Not Before: Dec 18 21:25:31 2024 GMT
|
||||
Not After : Sep 14 21:25:31 2027 GMT
|
||||
Subject: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL intermediate CA 1, emailAddress = info@wolfssl.com
|
||||
Subject Public Key Info:
|
||||
Public Key Algorithm: rsaEncryption
|
||||
Public-Key: (2048 bit)
|
||||
Modulus:
|
||||
00:de:b4:c8:5c:77:e0:2d:b1:f5:b9:ad:16:47:35:
|
||||
a0:35:65:65:c6:e1:40:ab:1e:b4:b9:13:b7:cb:8c:
|
||||
bb:77:a5:76:da:6d:87:87:f6:4a:4d:13:e4:26:3e:
|
||||
27:87:ee:5b:c7:6a:3f:45:30:61:55:5c:f6:35:d1:
|
||||
65:fa:98:11:a3:a7:55:d5:be:91:82:4b:fc:be:90:
|
||||
d6:50:53:63:9a:2c:22:e1:35:11:dc:78:02:97:8a:
|
||||
e4:46:92:9c:53:08:76:de:1f:53:b6:b8:ca:77:3e:
|
||||
79:6e:bc:d0:e3:0d:30:5b:4c:f6:94:0d:30:29:64:
|
||||
9f:04:e5:db:fb:89:60:67:bb:af:26:83:51:77:24:
|
||||
2f:2b:0b:a1:94:81:10:98:e8:eb:26:a8:1e:7c:e4:
|
||||
c4:6c:67:06:95:55:4a:dd:52:f4:f2:60:6d:01:2b:
|
||||
19:91:35:6d:a4:08:47:06:71:24:00:d9:de:c6:56:
|
||||
f3:8b:53:2c:e2:9a:96:a5:f3:62:e5:c4:e3:23:f2:
|
||||
d2:fc:21:ea:0f:62:76:8d:d5:99:48:ce:dc:58:c4:
|
||||
bb:7f:da:94:2c:80:74:83:c5:e0:b0:15:7e:41:fd:
|
||||
0e:f2:f4:f0:78:76:7b:ad:26:0d:aa:48:96:17:2f:
|
||||
21:e3:95:2b:26:37:f9:aa:80:2f:fe:de:f6:5e:bc:
|
||||
97:7f
|
||||
Exponent: 65537 (0x10001)
|
||||
X509v3 extensions:
|
||||
X509v3 Basic Constraints:
|
||||
CA:TRUE
|
||||
X509v3 Subject Key Identifier:
|
||||
83:C6:3A:89:2C:81:F4:02:D7:9D:4C:E2:2A:C0:71:82:64:44:DA:0E
|
||||
X509v3 Authority Key Identifier:
|
||||
keyid:73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21
|
||||
DirName:/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=wolfSSL root CA/emailAddress=info@wolfssl.com
|
||||
serial:63
|
||||
X509v3 Key Usage:
|
||||
Certificate Sign, CRL Sign
|
||||
Authority Information Access:
|
||||
OCSP - URI:http://127.0.0.1:22220
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Signature Value:
|
||||
75:57:f1:0c:87:8f:a2:70:3c:ce:e4:70:0e:99:6a:da:c4:80:
|
||||
94:2c:25:0c:de:0d:7b:f3:94:f1:e8:ad:6f:d0:de:9a:9d:f5:
|
||||
64:31:65:3f:18:e6:c3:f5:b5:1d:a2:be:5b:97:79:41:78:15:
|
||||
1c:b3:83:de:d0:00:ea:d2:70:43:c5:60:60:07:72:e5:76:59:
|
||||
b8:0e:2f:47:c9:8d:a4:4c:f1:20:b0:40:3b:ed:e9:de:b2:46:
|
||||
10:90:1b:0f:96:16:e6:97:bc:d5:9a:93:aa:3c:e3:b3:6b:5f:
|
||||
db:2c:af:2b:da:7c:36:36:aa:86:a1:65:70:c8:f1:34:d1:1f:
|
||||
10:96:71:e6:cf:69:5c:bf:0e:15:33:97:fe:40:42:be:30:48:
|
||||
ad:fb:d7:0e:7b:73:dd:64:30:7e:10:81:ac:3b:0b:3c:e4:12:
|
||||
9f:31:8b:3d:f0:9b:84:dc:5b:32:33:39:de:eb:1a:17:89:d8:
|
||||
1b:00:33:2d:50:a4:1a:2c:11:a2:60:ac:c1:9a:0f:44:90:00:
|
||||
cf:8d:6c:af:5b:71:23:7a:a7:4f:df:f5:3f:5c:ae:93:ca:4e:
|
||||
ec:f0:1b:f4:fa:53:7d:d9:36:af:5e:4c:54:c7:3a:d5:e3:68:
|
||||
ca:78:e5:1f:55:44:65:eb:00:2d:c3:c8:ba:0e:1f:47:1c:67:
|
||||
2e:a9:c1:6e
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIE8DCCA9igAwIBAgIBATANBgkqhkiG9w0BAQsFADCBlzELMAkGA1UEBhMCVVMx
|
||||
EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoM
|
||||
B3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NM
|
||||
IHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjQx
|
||||
MjE4MjEyNTMxWhcNMjcwOTE0MjEyNTMxWjCBoTELMAkGA1UEBhMCVVMxEzARBgNV
|
||||
BAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dvbGZT
|
||||
U0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMSIwIAYDVQQDDBl3b2xmU1NMIGludGVy
|
||||
bWVkaWF0ZSBDQSAxMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMIIB
|
||||
IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3rTIXHfgLbH1ua0WRzWgNWVl
|
||||
xuFAqx60uRO3y4y7d6V22m2Hh/ZKTRPkJj4nh+5bx2o/RTBhVVz2NdFl+pgRo6dV
|
||||
1b6Rgkv8vpDWUFNjmiwi4TUR3HgCl4rkRpKcUwh23h9TtrjKdz55brzQ4w0wW0z2
|
||||
lA0wKWSfBOXb+4lgZ7uvJoNRdyQvKwuhlIEQmOjrJqgefOTEbGcGlVVK3VL08mBt
|
||||
ASsZkTVtpAhHBnEkANnexlbzi1Ms4pqWpfNi5cTjI/LS/CHqD2J2jdWZSM7cWMS7
|
||||
f9qULIB0g8XgsBV+Qf0O8vTweHZ7rSYNqkiWFy8h45UrJjf5qoAv/t72XryXfwID
|
||||
AQABo4IBOTCCATUwDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQUg8Y6iSyB9ALXnUzi
|
||||
KsBxgmRE2g4wgcQGA1UdIwSBvDCBuYAUc7AcpC+Cy89HpTjXsASCOn5yFSGhgZ2k
|
||||
gZowgZcxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQH
|
||||
DAdTZWF0dGxlMRAwDgYDVQQKDAd3b2xmU1NMMRQwEgYDVQQLDAtFbmdpbmVlcmlu
|
||||
ZzEYMBYGA1UEAwwPd29sZlNTTCByb290IENBMR8wHQYJKoZIhvcNAQkBFhBpbmZv
|
||||
QHdvbGZzc2wuY29tggFjMAsGA1UdDwQEAwIBBjAyBggrBgEFBQcBAQQmMCQwIgYI
|
||||
KwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6MjIyMjAwDQYJKoZIhvcNAQELBQAD
|
||||
ggEBAHVX8QyHj6JwPM7kcA6ZatrEgJQsJQzeDXvzlPHorW/Q3pqd9WQxZT8Y5sP1
|
||||
tR2ivluXeUF4FRyzg97QAOrScEPFYGAHcuV2WbgOL0fJjaRM8SCwQDvt6d6yRhCQ
|
||||
Gw+WFuaXvNWak6o847NrX9ssryvafDY2qoahZXDI8TTRHxCWcebPaVy/DhUzl/5A
|
||||
Qr4wSK371w57c91kMH4Qgaw7CzzkEp8xiz3wm4TcWzIzOd7rGheJ2BsAMy1QpBos
|
||||
EaJgrMGaD0SQAM+NbK9bcSN6p0/f9T9crpPKTuzwG/T6U33ZNq9eTFTHOtXjaMp4
|
||||
5R9VRGXrAC3DyLoOH0ccZy6pwW4=
|
||||
-----END CERTIFICATE-----
|
||||
Certificate:
|
||||
Data:
|
||||
Version: 3 (0x2)
|
||||
Serial Number: 99 (0x63)
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Issuer: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com
|
||||
Validity
|
||||
Not Before: Dec 18 21:25:31 2024 GMT
|
||||
Not After : Sep 14 21:25:31 2027 GMT
|
||||
Subject: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com
|
||||
Subject Public Key Info:
|
||||
Public Key Algorithm: rsaEncryption
|
||||
Public-Key: (2048 bit)
|
||||
Modulus:
|
||||
00:ab:2c:b4:2f:1d:06:09:ef:4e:29:86:84:7e:cc:
|
||||
bf:a6:79:7c:f0:c0:c1:64:25:8c:75:b7:10:05:ca:
|
||||
48:27:0c:0e:32:1c:b0:fe:99:85:39:b6:b9:a2:f7:
|
||||
27:ff:6d:3c:8c:16:73:29:21:7f:8b:a6:54:71:90:
|
||||
ad:cc:05:b9:9f:15:c7:0a:3f:5f:69:f4:0a:5f:8c:
|
||||
71:b5:2c:bf:66:e2:03:9a:32:f4:d2:ec:2a:89:4b:
|
||||
f9:35:88:14:33:47:4e:2e:05:79:01:ed:64:36:76:
|
||||
b9:f8:85:cd:01:88:ac:c5:b2:b1:59:b8:cd:5a:f4:
|
||||
09:09:38:9b:da:5a:cf:ce:78:99:1f:49:3d:41:d6:
|
||||
06:7c:52:99:c8:97:d1:b3:80:3a:a2:4f:36:c4:c5:
|
||||
96:30:77:31:38:c8:70:cc:e1:67:06:b3:2b:2f:93:
|
||||
b5:69:cf:83:7e:88:53:9b:0f:46:21:4c:d6:05:36:
|
||||
44:99:60:68:47:e5:32:01:12:d4:10:73:ae:9a:34:
|
||||
94:fa:6e:b8:58:4f:7b:5b:8a:92:97:ad:fd:97:b9:
|
||||
75:ca:c2:d4:45:7d:17:6b:cd:2f:f3:63:7a:0e:30:
|
||||
b5:0b:a9:d9:a6:7c:74:60:9d:cc:09:03:43:f1:0f:
|
||||
90:d3:b7:fe:6c:9f:d9:cd:78:4b:15:ae:8c:5b:f9:
|
||||
99:81
|
||||
Exponent: 65537 (0x10001)
|
||||
X509v3 extensions:
|
||||
X509v3 Basic Constraints:
|
||||
CA:TRUE
|
||||
X509v3 Subject Key Identifier:
|
||||
73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21
|
||||
X509v3 Authority Key Identifier:
|
||||
keyid:73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21
|
||||
DirName:/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=wolfSSL root CA/emailAddress=info@wolfssl.com
|
||||
serial:63
|
||||
X509v3 Key Usage:
|
||||
Certificate Sign, CRL Sign
|
||||
Authority Information Access:
|
||||
OCSP - URI:http://127.0.0.1:22220
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Signature Value:
|
||||
76:e8:fa:f6:1e:5b:0e:ff:24:43:e0:cb:19:26:38:d9:df:18:
|
||||
5d:66:e1:4b:ac:e4:8e:b0:49:2c:d6:04:20:eb:4a:a8:06:d7:
|
||||
55:ec:6b:38:f8:0f:8c:e6:c9:ec:42:f0:ca:07:9f:88:7a:ee:
|
||||
bf:af:3f:7d:d3:45:67:20:84:bb:c7:c5:32:69:ab:59:e1:e3:
|
||||
38:4b:ed:18:2e:de:da:88:ec:a0:b7:ff:c1:50:96:73:e3:03:
|
||||
df:a1:e7:47:93:13:1d:fb:e6:6b:37:3e:50:a3:eb:5b:24:26:
|
||||
d2:43:2e:6e:9c:83:9c:fb:79:ba:cd:fd:3b:e5:87:87:a7:0f:
|
||||
5f:f9:64:34:56:5e:8b:13:e2:c4:41:e3:9d:3e:36:2d:cb:d3:
|
||||
5f:d3:12:90:bf:78:c1:4c:df:eb:7b:99:e6:1e:ee:52:78:6f:
|
||||
0c:82:e1:59:d4:25:40:e5:24:95:3e:0f:cc:08:60:fe:b4:8c:
|
||||
48:42:bf:29:74:92:71:1a:85:00:a7:4c:f0:c0:32:47:f3:be:
|
||||
f4:08:5c:f2:43:e0:b9:76:86:60:9a:3b:af:d6:32:41:5f:b0:
|
||||
04:12:44:2a:44:19:d4:27:d3:ce:71:7e:5b:16:1a:f5:0c:db:
|
||||
43:b0:a6:bb:76:02:f6:e0:30:4e:04:f4:f3:9b:cd:d4:ae:45:
|
||||
94:c5:8c:bb
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIE5jCCA86gAwIBAgIBYzANBgkqhkiG9w0BAQsFADCBlzELMAkGA1UEBhMCVVMx
|
||||
EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoM
|
||||
B3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NM
|
||||
IHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjQx
|
||||
MjE4MjEyNTMxWhcNMjcwOTE0MjEyNTMxWjCBlzELMAkGA1UEBhMCVVMxEzARBgNV
|
||||
BAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dvbGZT
|
||||
U0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NMIHJvb3Qg
|
||||
Q0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wggEiMA0GCSqGSIb3
|
||||
DQEBAQUAA4IBDwAwggEKAoIBAQCrLLQvHQYJ704phoR+zL+meXzwwMFkJYx1txAF
|
||||
ykgnDA4yHLD+mYU5trmi9yf/bTyMFnMpIX+LplRxkK3MBbmfFccKP19p9ApfjHG1
|
||||
LL9m4gOaMvTS7CqJS/k1iBQzR04uBXkB7WQ2drn4hc0BiKzFsrFZuM1a9AkJOJva
|
||||
Ws/OeJkfST1B1gZ8UpnIl9GzgDqiTzbExZYwdzE4yHDM4WcGsysvk7Vpz4N+iFOb
|
||||
D0YhTNYFNkSZYGhH5TIBEtQQc66aNJT6brhYT3tbipKXrf2XuXXKwtRFfRdrzS/z
|
||||
Y3oOMLULqdmmfHRgncwJA0PxD5DTt/5sn9nNeEsVroxb+ZmBAgMBAAGjggE5MIIB
|
||||
NTAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRzsBykL4LLz0elONewBII6fnIVITCB
|
||||
xAYDVR0jBIG8MIG5gBRzsBykL4LLz0elONewBII6fnIVIaGBnaSBmjCBlzELMAkG
|
||||
A1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUx
|
||||
EDAOBgNVBAoMB3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQD
|
||||
DA93b2xmU1NMIHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5j
|
||||
b22CAWMwCwYDVR0PBAQDAgEGMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAYYW
|
||||
aHR0cDovLzEyNy4wLjAuMToyMjIyMDANBgkqhkiG9w0BAQsFAAOCAQEAduj69h5b
|
||||
Dv8kQ+DLGSY42d8YXWbhS6zkjrBJLNYEIOtKqAbXVexrOPgPjObJ7ELwygefiHru
|
||||
v68/fdNFZyCEu8fFMmmrWeHjOEvtGC7e2ojsoLf/wVCWc+MD36HnR5MTHfvmazc+
|
||||
UKPrWyQm0kMubpyDnPt5us39O+WHh6cPX/lkNFZeixPixEHjnT42LcvTX9MSkL94
|
||||
wUzf63uZ5h7uUnhvDILhWdQlQOUklT4PzAhg/rSMSEK/KXSScRqFAKdM8MAyR/O+
|
||||
9Ahc8kPguXaGYJo7r9YyQV+wBBJEKkQZ1CfTznF+WxYa9QzbQ7Cmu3YC9uAwTgT0
|
||||
85vN1K5FlMWMuw==
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDmllV1z4qXaIy2
|
||||
OPZ6Bb4ztlFHN4r325G+kmu3AIzyxSRuGOmSAIEB3LNMKKm3gPGWzyN6L6744w8t
|
||||
014j59tMsl2JFhe+voHb+xJtKEsQoBIEJ8HJ0HmV7+iNjFmbTnJ9vEkrIk74T+IM
|
||||
8enpl/nfjFoKqjgdQwSjp4mh4oOkS7VORYimIl2sqVhniMHVYe+9EQUnlEe7M6WK
|
||||
yu4fjcBuJK/Nyr+AR3GVrKnxXSNs9Uu0qeHEZvvlxKGfp1HReM0utD8u4oLzf8Sn
|
||||
9DHPdic/2y7SbsNHI4KjSECMp8ET8GNQVEP2cRLhb6V6WCb3/Ys7cBigQ7oBa7P4
|
||||
1b4FE2QxAgMBAAECggEBAMcAl2DFbOae5FGfd5h3vF8EycCcvuKKLI4775pQb1RV
|
||||
r8sU1P+cT7o7rsHblh04u0dcHVImNOu3ijISaPyz7R+UEAVve66y23/uf0iVrbL7
|
||||
cpEDfsudkFFGa30901elrEm3Za5EPcMvrfdeEHH5Jz02876giS032ZkjzjRYOSRg
|
||||
TuFhiqjRTMfE6AB63KSRWcb6AYEocHV/jF+IEQcz9ctsv6XKKKJtge4+Y3+gQU4N
|
||||
ALUE6OjBsD5KpMVuMYBSfTucYi5g2eOK05PoCOR8lTqgvsbof+ALj+84zEpG20aK
|
||||
p0KdMVwiMolXaYcvKBOGPxZKt7sQaIMitbs0iuErMQECgYEA+cLVZh4qkRnsjPVc
|
||||
/27qC/VLeWo2QAL7TWC7YgkY0MgNtZXRkJZdKOlzYWo/iJmuxHj7eUFLkoHpPNV2
|
||||
X6WG+CGHD1qq/BqLQNlJKS/MtI2VNzOjBJ/J3SktOGo3BwL+Q5uSRNHukQip0YnD
|
||||
c9GCU4UhfBHr/UNitMBH6N5aPqUCgYEA7FjjTGomVseF5wNbfw2xLjBmRuQ2DDgJ
|
||||
/OvCtV6it+OiVU9R+cYcz/hVl1QLIkGBHt5hb8O6np4tW5ehKd5LNTtolIO+/BLL
|
||||
2xPZCLY7U+LES5dgUTC/wb5t5igAmPuOMi9qNQ1kYxbKYJVLRUdwfOM8FNE4gjZF
|
||||
kj2BIb6OxZ0CgYEAmuXXvWZ2FdmTGHTPwWdDZjkyHtHdZWO0AXA9pnZn2oxH3FdX
|
||||
SinHCymFsmPXlVtixV0W8UOqn+lMAruMl5MsGtWIUuBzbLj1pjlcI1wOw+ePJFY1
|
||||
AxgqdKwl7HgLOqEDmmBwnZfpMi/CSj77ZegIwM2vT6g5yK+zFtCtiGHmbDUCgYBf
|
||||
L2VLbyzFolGBOk7tGnyTF5b5UguaXC9ZlzGxjc2Gtby5Etr29xy/fUorSgO55hu0
|
||||
bOdc9b0BCL9HtgeILyim5ag2t+CA8Kj9MD8mTQ4TuK5Jq0t1J2bzBliIau/irN0V
|
||||
xRbHCv+1EIas4zOPUTgyc+nMkH5roqPeQ7rv9ijV2QKBgQDJiNmAJv3dlie2x+bj
|
||||
rX5RDF1Q/egVVGx41jPyuzh0oFLwEQG2lSHEAKgF+gWt0ZMwNzPB9oue2LBSpNFl
|
||||
7ZdpFCpzD+3OcaxnWYEGT+qNhczbf0PvVNBOzOI33Trr7maktWi0Mh9qmXqoNuwG
|
||||
uCnrEriJlBk2MV88tIG/ZJ+bvQ==
|
||||
-----END PRIVATE KEY-----
|
||||
Loading…
Reference in New Issue