0

I asked a more specific question yesterday on SO but haven't had any luck with responses. Basically I am trying to get OpenSSL wired up in low-level C with minimal dependencies. In that link I referenced some GitHub gist/repo examples of of OpenSSL C usage, but they are all incomplete.

What I'm stuck on right now is figuring out how to actually "secure" OpenSSL, haha. Surprising it doesn't default to being secure. So what I'm looking at code-wise is this:

if(! SSL_CTX_load_verify_locations(ctx, "/path/to/TrustStore.pem", NULL))
{
    / Handle failed load here /
}

The SSL_CTX_load_verify_locations function documentation doesn't explain exactly (a) where to get the "trusted certificate store" or whatever, and (b) if not getting it then how to generate one using the openssl CLI tool.

What am I supposed to do here? How do I actually get to "securing" the thing? It seems that I need to obtain these trusted certificates somehow. (This is for an HTTPS client, not a server. I just want to make HTTPS requests). Am I supposed to hunt them down somewhere? (I am on a Mac). Or am I supposed to generate them with the OpenSSL cli? Or can the parameter to SSL_CTX_load_verify_locations be null, and it just somehow picks it up from the source code somewhere automatically? Or is that what this is? (ssl_init(0,0), which goes to here, to here at if (SSL_CTX_use_certificate_file(ctx, certfile, SSL_FILETYPE_PEM) != 1), essentially passing 0 to SSL_CTX_use_certificate_file, but then again SSL_CTX_use_certificate_file is a different method from SSL_CTX_load_verify_locations, so not sure if it's related).

1 Answer 1

1

Since OpenSSL traditionally cannot easily access the native trust store on Windows and Mac the common way for OpenSSL based applications on these platforms is to use the same set of trusted certificates as Firefox does, which also comes with its own trust store on all platforms and does not use the native one. This set can be downloaded at CA certificates extracted from Mozilla. It then gets set with SSL_CTX_load_verify_locations for the specific SSL context as you already figured out (SSL_CTX_use_certificate_file and related is for loading client certificates and not the trust store).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .