114 lines
2.8 KiB
Markdown
114 lines
2.8 KiB
Markdown
# wolfSSL CertManager Examples
|
|
|
|
This directory contains examples of using the wolfSSL CertManager to verify
|
|
certificates in a standalone manner, separate from an SSL/TLS connection.
|
|
|
|
## Example Applications
|
|
|
|
- **certverify.c** - Basic certificate verification example
|
|
- **certloadverifybuffer.c** - Certificate verification from memory buffer
|
|
- **certverify_ocsp.c** - Certificate verification with OCSP revocation
|
|
checking
|
|
|
|
## certverify.c and/or certloadverifybuffer.c
|
|
|
|
### Building wolfSSL
|
|
|
|
```bash
|
|
cd wolfssl
|
|
./autogen.sh
|
|
./configure
|
|
make all
|
|
make check
|
|
sudo make install
|
|
```
|
|
|
|
### Building the Examples
|
|
|
|
```bash
|
|
cd wolfssl-examples/certmanager
|
|
make certverify
|
|
make certloadverifybuffer
|
|
```
|
|
|
|
### Running the Examples
|
|
|
|
```bash
|
|
./certverify
|
|
./certloadverifybuffer
|
|
```
|
|
|
|
## certverify_ocsp
|
|
|
|
The `certverify_ocsp` example demonstrates certificate verification with
|
|
OCSP (Online Certificate Status Protocol) checking. These instructions assume
|
|
that your `wolfssl` source directory and the `wolfssl-examples` directory share
|
|
the same parent directory.
|
|
|
|
### Building wolfSSL
|
|
|
|
```bash
|
|
cd wolfssl
|
|
./autogen.sh
|
|
./configure --enable-crl --enable-ocsp
|
|
make all
|
|
make check
|
|
sudo make install
|
|
```
|
|
|
|
### Building the Example
|
|
|
|
```bash
|
|
cd wolfssl-examples/certmanager
|
|
make certverify_ocsp
|
|
```
|
|
|
|
### Running the Example
|
|
|
|
The OCSP demo requires an OCSP responder to be running. You can start one using
|
|
OpenSSL:
|
|
|
|
**Terminal 1 - Start the OCSP Responder:**
|
|
|
|
From the `wolfssl-examples/certmanager` directory:
|
|
|
|
```bash
|
|
openssl ocsp -port 22221 -ndays 365 \
|
|
-index ../../wolfssl/certs/ocsp/index-intermediate1-ca-issued-certs.txt \
|
|
-rsigner ../../wolfssl/certs/ocsp/ocsp-responder-cert.pem \
|
|
-rkey ../../wolfssl/certs/ocsp/ocsp-responder-key.pem \
|
|
-CA ../../wolfssl/certs/ocsp/intermediate1-ca-cert.pem \
|
|
-text
|
|
```
|
|
|
|
**Terminal 2 - Run the Example:**
|
|
|
|
From the `wolfssl-examples/certmanager` directory:
|
|
|
|
```bash
|
|
./certverify_ocsp
|
|
```
|
|
|
|
### Expected Output
|
|
|
|
When the OCSP responder is running, you should see output that indicates basic
|
|
verification passed and OCSP checking is done and successful. Importantly,
|
|
OpenSSL should also show some pretty prints of the OCSP request.
|
|
|
|
### OCSP Certificate Structure
|
|
|
|
The OCSP test uses the following certificate chain from the wolfSSL repository's
|
|
`certs/ocsp/` directory. This assumes the wolfssl and wolfssl-examples
|
|
repositories are in the same parent directory.
|
|
|
|
|
|
- **root-ca-cert.pem** - Root CA certificate
|
|
- **intermediate1-ca-cert.pem** - Intermediate CA that issued the server cert
|
|
- **server1-cert.pem** - Server certificate with OCSP URL in AIA extension
|
|
- **ocsp-responder-cert.pem** - Certificate for the OCSP responder
|
|
- **ocsp-responder-key.pem** - Private key for the OCSP responder
|
|
|
|
The server1-cert.pem certificate contains an Authority Information Access (AIA)
|
|
extension pointing to `http://127.0.0.1:22221` for OCSP queries.
|
|
|