Chilkat HOME .NET Core C# Android™ AutoIt C C# C++ Chilkat2-Python CkPython Classic ASP DataFlex Delphi ActiveX Delphi DLL Go Java Lianja Mono C# Node.js Objective-C PHP ActiveX PHP Extension Perl PowerBuilder PowerShell PureBasic Ruby SQL Server Swift 2 Swift 3,4,5... Tcl Unicode C Unicode C++ VB.NET VBScript Visual Basic 6.0 Visual FoxPro Xojo Plugin
(Unicode C) Validate Certificate using OCSP ProtocolDemonstrates how to validate a certificate (check the revoked status) using the OCSP protocol.
#include <C_CkCertW.h> #include <C_CkPrngW.h> #include <C_CkJsonObjectW.h> #include <C_CkBinDataW.h> #include <C_CkHttpW.h> #include <C_CkHttpResponseW.h> void ChilkatSample(void) { HCkCertW cert; BOOL success; const wchar_t *ocspUrl; const wchar_t *hashAlg; HCkPrngW prng; HCkJsonObjectW json; HCkBinDataW ocspRequest; HCkHttpW http; HCkHttpResponseW resp; HCkBinDataW ocspReply; HCkJsonObjectW jsonReply; int ocspStatus; int certStatus; // Note: Requires Chilkat v9.5.0.75 or greater. // This requires the Chilkat API to have been previously unlocked. // See Global Unlock Sample for sample code. // This example will check the revoked status of a certificate loaded from a file. cert = CkCertW_Create(); success = CkCertW_LoadFromFile(cert,L"qa_data/certs/google.crt"); if (success != TRUE) { wprintf(L"%s\n",CkCertW_lastErrorText(cert)); CkCertW_Dispose(cert); return; } // Get the cert's OCSP URL. ocspUrl = CkCertW_ocspUrl(cert); // Build the JSON that will be the OCSP request. // Possible hash algorithms are sha1, sha256, sha384, sha512. hashAlg = L"sha256"; prng = CkPrngW_Create(); json = CkJsonObjectW_Create(); CkJsonObjectW_putEmitCompact(json,FALSE); // Read more about OCSP nonce lengths CkJsonObjectW_UpdateString(json,L"extensions.ocspNonce",CkPrngW_genRandom(prng,16,L"base64")); CkJsonObjectW_putI(json,0); CkJsonObjectW_UpdateString(json,L"request[i].cert.hashAlg",hashAlg); CkJsonObjectW_UpdateString(json,L"request[i].cert.issuerNameHash",CkCertW_hashOf(cert,L"IssuerDN",hashAlg,L"base64")); CkJsonObjectW_UpdateString(json,L"request[i].cert.issuerKeyHash",CkCertW_hashOf(cert,L"IssuerPublicKey",hashAlg,L"base64")); CkJsonObjectW_UpdateString(json,L"request[i].cert.serialNumber",CkCertW_serialNumber(cert)); wprintf(L"%s\n",CkJsonObjectW_emit(json)); // Our OCSP request looks something like this: // { // "extensions": { // "ocspNonce": "qZDfbpO+nUxRzz6c/SPjE5QCAsPfpkQlRDxTnGl0gnxt7iXO" // }, // "request": [ // { // "cert": { // "hashAlg": "sha1", // "issuerNameHash": "9u2wY2IygZo19o11oJ0CShGqbK0=", // "issuerKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=", // "serialNumber": "6175535D87BF94B6" // } // } // ] // } ocspRequest = CkBinDataW_Create(); http = CkHttpW_Create(); // Convert our JSON to a binary (ASN.1) OCSP request success = CkHttpW_CreateOcspRequest(http,json,ocspRequest); if (success == FALSE) { wprintf(L"%s\n",CkHttpW_lastErrorText(http)); CkCertW_Dispose(cert); CkPrngW_Dispose(prng); CkJsonObjectW_Dispose(json); CkBinDataW_Dispose(ocspRequest); CkHttpW_Dispose(http); return; } // Send the OCSP request to the OCSP server resp = CkHttpW_PBinaryBd(http,L"POST",ocspUrl,ocspRequest,L"application/ocsp-request",FALSE,FALSE); if (CkHttpW_getLastMethodSuccess(http) != TRUE) { wprintf(L"%s\n",CkHttpW_lastErrorText(http)); CkCertW_Dispose(cert); CkPrngW_Dispose(prng); CkJsonObjectW_Dispose(json); CkBinDataW_Dispose(ocspRequest); CkHttpW_Dispose(http); return; } // Get the binary (ASN.1) OCSP reply ocspReply = CkBinDataW_Create(); CkHttpResponseW_GetBodyBd(resp,ocspReply); CkHttpResponseW_Dispose(resp); // Convert the binary reply to JSON. // Also returns the overall OCSP response status. jsonReply = CkJsonObjectW_Create(); ocspStatus = CkHttpW_ParseOcspReply(http,ocspReply,jsonReply); // The ocspStatus can have one of these values: // -1: The ARG1 does not contain a valid OCSP reply. // 0: Successful - Response has valid confirmations.. // 1: Malformed request - Illegal confirmation request. // 2: Internal error - Internal error in issuer. // 3: Try later - Try again later. // 4: Not used - This value is never returned. // 5: Sig required - Must sign the request. // 6: Unauthorized - Request unauthorized. if (ocspStatus < 0) { wprintf(L"Invalid OCSP reply.\n"); CkCertW_Dispose(cert); CkPrngW_Dispose(prng); CkJsonObjectW_Dispose(json); CkBinDataW_Dispose(ocspRequest); CkHttpW_Dispose(http); CkBinDataW_Dispose(ocspReply); CkJsonObjectW_Dispose(jsonReply); return; } wprintf(L"Overall OCSP Response Status: %d\n",ocspStatus); // Let's examine the OCSP response (in JSON). CkJsonObjectW_putEmitCompact(jsonReply,FALSE); wprintf(L"%s\n",CkJsonObjectW_emit(jsonReply)); // The JSON reply looks like this: // (Use the online tool at https://tools.chilkat.io/jsonParse.cshtml // to generate JSON parsing code.) // { // "responseStatus": 0, // "responseTypeOid": "1.3.6.1.5.5.7.48.1.1", // "responseTypeName": "ocspBasic", // "response": { // "responderIdChoice": "KeyHash", // "responderKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=", // "dateTime": "20180803193937Z", // "cert": [ // { // "hashOid": "1.3.14.3.2.26", // "hashAlg": "SHA-1", // "issuerNameHash": "9u2wY2IygZo19o11oJ0CShGqbK0=", // "issuerKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=", // "serialNumber": "6175535D87BF94B6", // "status": 0, // "thisUpdate": "20180803193937Z", // "nextUpdate": "20180810193937Z" // } // ] // } // } // // The certificate status: certStatus = -1; if (CkJsonObjectW_HasMember(jsonReply,L"response.cert[0].status") == TRUE) { certStatus = CkJsonObjectW_IntOf(jsonReply,L"response.cert[0].status"); } // Possible certStatus values are: // -1: No status returned. // 0: Good // 1: Revoked // 2: Unknown. wprintf(L"Certificate Status: %d\n",certStatus); CkCertW_Dispose(cert); CkPrngW_Dispose(prng); CkJsonObjectW_Dispose(json); CkBinDataW_Dispose(ocspRequest); CkHttpW_Dispose(http); CkBinDataW_Dispose(ocspReply); CkJsonObjectW_Dispose(jsonReply); } |
© 2000-2024 Chilkat Software, Inc. All Rights Reserved.