2

The subject (sort of) says it all...

Is there a TLS library (other than OpenSSL which does everything :-) ) that allows me to:

  1. Add my own extensions to the TLS
  2. Get the certificate data so I can make a certificate fingerprint

What I'm trying to do is have a TLS setup, where the client passes a URL as an extension, and, the client can get at the certificate so I can create a hash as a fingerprint that I can use as a unique ID?

It would allow me to pass meta-data along with the TLS setup to allow the server to fetch data outside of the TLS session.

Improve this question
7
  • You might want to check out ucspi-ssl. This set of tools includes sslserver which can be used to build a server that accepts SSL/TLS connections, and sslclient which can be used to build a client that is able to initiate SSL/TLS connections. Both provide access to the certificate used to secure the connection.
    – mti2935
    May 22 at 21:27
  • 4
    "other than OpenSSL" - why this explicit exclusion, especially since OpenSSL seems to do what you need? This sounds like you have some specific requirements which exclude OpenSSL. But these might also apply to other libraries, so you need to specify these requirements. For example what about LibreSSL which is a fork of OpenSSL?
    – Steffen Ullrich
    May 23 at 4:46
  • Most if not all TLS connectors allow access to the certificate, usually through some kind of context that is delivered when the handshake succeeds. As for the extensions; extensions to do what exactly?
    – Maarten Bodewes
    May 23 at 11:50
  • I was hoping to add a new URL into the certificate. Let's call it IdentityService which points to a URL. The receiving server can use this URL to get additional information.. Assume my client cert had this extra attribute, my server should be able to retrieve it and the service pointed to by the URL should be able to get the server's cert fingerprint.
    – user500123
    May 23 at 21:55
  • I had avoided openssl because I was told it was big, complex and convulted to use -- I was looking at the "new" SSLs like Boring and BearSSL. I get it -- use something ucsp-ssl and see how it's done and build off of those concepts.....
    – user500123
    May 23 at 22:44

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .