cpp-netlib-devel

[cpp-netlib-devel] load a certificate

[Benjamin W. <we...@tr...>]

Hi all,

first I want to thank you for the great work you did writing this 
library! It really helps me a lot!
I have been working on integrating openssl and writing an own 
minimalistic dummy-HTTP-client when I discovered this awesome projekt 
just in time.

I work on a cross-platform library and that library has to communicate 
with one specific HTTPS server.
To authenticate the server, we receive (in advance) an X509-certificate 
to build into our software.

I would like to ask you if it is possible to load one or more specific 
CA-certificates for a HTTPS client connection (doesn't matter if from 
file or from memory).

I've already had a look at the source code and saw that the method 
"https_sync_connection" takes a string-argument "certificate_filename",
but I saw no way to pass such a filename at the high-level-api.
Is this parameter solely used to load system-default CA-certificates?
If not, could you please explain to me how I can load a certificate from 
file or memory?

Thank you very much in advance and good luck with this project!

Greetings from Switzerland,

Benjamin Weibel

Re: [cpp-netlib-devel] load a certificate

[Dean M. B. <mik...@gm...>]

On Fri, Mar 25, 2011 at 11:34 PM, Benjamin Weibel <we...@tr...> wrote:
> Hi all,
>
> first I want to thank you for the great work you did writing this
> library! It really helps me a lot!

You're welcome. :)

> I have been working on integrating openssl and writing an own
> minimalistic dummy-HTTP-client when I discovered this awesome projekt
> just in time.
>
> I work on a cross-platform library and that library has to communicate
> with one specific HTTPS server.
> To authenticate the server, we receive (in advance) an X509-certificate
> to build into our software.
>
> I would like to ask you if it is possible to load one or more specific
> CA-certificates for a HTTPS client connection (doesn't matter if from
> file or from memory).
>
> I've already had a look at the source code and saw that the method
> "https_sync_connection" takes a string-argument "certificate_filename",
> but I saw no way to pass such a filename at the high-level-api.
> Is this parameter solely used to load system-default CA-certificates?
> If not, could you please explain to me how I can load a certificate from
> file or memory?
>

Oops, that filename should actually be a list of filenames; also there
should be a way in the server's constructor to pass the parameter
properly into the connection objects. That has still yet to be done,
but can actually be patched easily.

I was in the middle of adding support for this when I moved my focus
to the server side of the HTTP implementation. At any rate I'll see
whether I can make that happen as soon as I get a better development
machine than the one I have right now.

> Thank you very much in advance and good luck with this project!
>

Thank you for the feedback too -- I'll look at adding this capability
from the client constructor to allow for adding a range of filenames
or even just areas in memory that point to the contents of the
certificates.

If you can, please file an issue over at
https://github.com/cpp-netlib/cpp-netlib/issues so that I can keep
track of this feature.

> Greetings from Switzerland,
>

Greetings from the Philippines!

Thanks Benjamin!

-- 
Dean Michael Berris
http://about.me/deanberris

Re: [cpp-netlib-devel] load a certificate

[Dean M. B. <mik...@gm...>]

On Sat, Mar 26, 2011 at 10:09 AM, Dean Michael Berris
<mik...@gm...> wrote:
> On Fri, Mar 25, 2011 at 11:34 PM, Benjamin Weibel <we...@tr...> wrote:
>>
>> I've already had a look at the source code and saw that the method
>> "https_sync_connection" takes a string-argument "certificate_filename",
>> but I saw no way to pass such a filename at the high-level-api.
>> Is this parameter solely used to load system-default CA-certificates?
>> If not, could you please explain to me how I can load a certificate from
>> file or memory?
>>
>
> Oops, that filename should actually be a list of filenames; also there
> should be a way in the server's constructor to pass the parameter
> properly into the connection objects. That has still yet to be done,
> but can actually be patched easily.
>

And because I thought it was worth the effort, I made changes in the
0.9-devel branch that makes this possible. Documentation about using
the new constructor parameters (_openssl_certificate and
_openssl_verify_path) pending, but the idea is simple:

  using namespace boost::network::http;
  client c(_openssl_certificate="/tmp/my-cert");
  client::request req("https://some.server.com/");
  client::response res = c.get(req);

I've just pushed this to 0.9-devel so you should be able to start
using this in your application.

HTH!

-- 
Dean Michael Berris
http://about.me/deanberris