0

I was going through the openssl server-client program given here---> http://simplestcodings.blogspot.com.br/2010/08/secure-server-client-using-openssl-in-c.html. I can see both the client and server get the certificates from peer. But i was wondering if i have to call a separate api to verify the certificates? In the above link, both client and server get the certificates and print them and start exchanging data. Where exactly is the certificate verification taking place here?

Thanks

Improve this question
0
2

The sample code you link to does not do any kind of verification.

It fails to verify the certificate chain because it does not use SSL_CTX_set_verify to enable verification (and the default is off). This way it accepts any certificate.

It also fails to verify the hostname against the certificate. Even if chain validation would be done this would mean that the attacker could use any certificate with a valid chain (which are easy to get) to man in the middle SSL connections to any host.

Improve this answer
2
  • A quick question. what other APIs should i use apart from the basic tcp/ssl connection establishment APIs in order send a csr to a CA and receive back a certificate from CA? – lone_wolf Jul 13 '16 at 17:37
  • @lone_wolf: please don't ask unrelated questions in a comment. Apart from that I don't think there is a procedure common between all CA to do this. – Steffen Ullrich Jul 13 '16 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.