Re: Using certificates and keys from a list

> On Apr 5, 2026, at 13:32, Viktor Dukhovni <[email protected]> wrote:
> 
> On Sun, Apr 05, 2026 at 01:06:29PM -0700, Doug Hardie wrote:
> 
>>>> then read them into that memory and use a table of those addresses.
>>>> Then use SSL_use_certificate(SSL *ssl, X509 *x) to load the
>>>> certificate into the SSL and then SSL_use_PrivateKey(SSL *ssl,
>>>> EVP_PKEY *pkey) to load the key?  It seems like I am missing
>>>> something.
> 
> The pkey_type data flow is bit non-obvious, the NID stays NID_undef for
> PKCS#8 keys (the norm), which can be decoded generically, otherwise it
> is set to a type-specific NID for type-specific PEM encodings:
> 
>    https://github.com/vdukhovni/postfix/blob/250e75ebd980eafa3ed5f25e1d9d6a896b794c2e/postfix/src/tls/tls_certkey.c#L363-L370
> 
>    } else if (strcmp(name, PEM_STRING_PKCS8INF) == 0
>       || ((pkey_type = EVP_PKEY_RSA) != NID_undef
>   && strcmp(name, PEM_STRING_RSA) == 0)
>       || ((pkey_type = EVP_PKEY_EC) != NID_undef
>   && strcmp(name, PEM_STRING_ECPRIVATEKEY) == 0)
>       || ((pkey_type = EVP_PKEY_DSA) != NID_undef
>   && strcmp(name, PEM_STRING_DSA) == 0)) {
> load_pkey(st, pkey_type, buf, buflen);
> 
> Those comparisons with `NID_undef` are assignments, the last one before
> a strcmp() matches one wins.  Then in load_pkey() the NID is used to
> either fall back to PKCS#8 or to pass to d2i_PrivateKey():
> 
>    https://github.com/vdukhovni/postfix/blob/250e75ebd980eafa3ed5f25e1d9d6a896b794c2e/postfix/src/tls/tls_certkey.c#L258-L266
> 
>    if (pkey_type != NID_undef) {
> pkey = d2i_PrivateKey(pkey_type, 0, &p, buflen);
>    } else {
> p8 = d2i_PKCS8_PRIV_KEY_INFO(NULL, &p, buflen);
> if (p8) {
>    pkey = EVP_PKCS82PKEY(p8);
>    PKCS8_PRIV_KEY_INFO_free(p8);
> }
>    }


That is some interesting code.  Quite clever.  Reminds me of some code a contractor wrote for the USAF (assembly language):

	xor a, b		bet you can't figure out what this does.
	xor b, a
	xor a, b

This was way before wikipedia.  I had the contractor rewrite the comment to explain what it did.

Thanks to Viktor and Victor, I now have the application working in a test environment.  Later this week I'll generate all the needed certificates and put it into production.


-- Doug


-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/AE036075-13CC-41A7-B66F-924B769A57D4%40sermon-archive.info.