目的:使用C mbedtls库实现https(RSA证书)双向认证连接。
开发环境:windows 11, VS2022,mbedtls-3.6.2
私钥格式:p1/p8
#include "mbedtls/net_sockets.h"
#include "mbedtls/ssl.h"
#include "mbedtls/entropy.h"
#include "mbedtls/ctr_drbg.h"
#include "mbedtls/debug.h"
#include "mbedtls/error.h"
#include "mbedtls/certs.h"#include <mbedtls/pk.h>
#include <mbedtls/pem.h>
#include <mbedtls/base64.h>// 这个函数假设 SSL 握手已经成功完成
void print_server_san(mbedtls_ssl_context* ssl) {const mbedtls_x509_crt* cert = mbedtls_ssl_get_peer_cert(ssl);if (cert == NULL) {printf("No server certificate found.\n");return;}// 确保 `subject_alt_names` 是正确的类型const mbedtls_x509_sequence* san = &cert->subject_alt_names;while (san != NULL) {const mbedtls_asn1_buf* entry = &san->buf;unsigned char tag = entry->tag;// 检查是否为 IP 地址 (context-specific tag 7)if ((tag & MBEDTLS_ASN1_TAG_CLASS_MASK) == MBEDTLS_ASN1_CONTEXT_SPECIFIC &&(tag & MBEDTLS_ASN1_TAG_VALUE_MASK) == 7) {// IP 地址以二进制形式存储if (entry->len == 4) { // IPv4 地址printf("Server certificate SAN (IP): %u.%u.%u.%u\n",entry->p[0], entry->p[1], entry->p[2], entry->p[3]);}else if (entry->len == 16) { // IPv6 地址printf("Server certificate SAN (IPv6): ");for (int i = 0; i < 16; i++) {printf("%02x", entry->p[i]);if (i % 2 == 1 && i < 15) {printf(":");}}printf("\n");}}san = san->next;}
}void print_mbedtls_error(int ret) {char error_buf[100];mbedtls_strerror(ret, error_buf, sizeof(error_buf));fprintf(stderr, "Error: %s\n", error_buf);
}int print_prikey_b64() {int ret;mbedtls_pk_context pkey;unsigned char* key_buffer = NULL;size_t key_len = 0;unsigned char* base64_buffer = NULL;size_t base64_len = 0;mbedtls_pk_init(&pkey);// 读取私钥文件ret = mbedtls_pk_parse_keyfile(&pkey, "res/yax/client_p8.key", NULL);if (ret != 0) {print_mbedtls_error(ret);goto cleanup;}// 获取私钥的 DER 格式所需的缓冲区长度key_len = mbedtls_pk_write_key_der(&pkey, NULL, 0);if (key_len <= 0) {print_mbedtls_error(key_len);goto cleanup;}printf("Key length required for DER format: %zu bytes\n", key_len);// 分配比所需长度更大的缓冲区来确保足够的空间key_buffer = (unsigned char*)malloc(key_len);if (!key_buffer) {fprintf(stderr, "Memory allocation failed for key_buffer with size %zu bytes\n", key_len);ret = -1;goto cleanup;}// 将私钥写入 DER 格式缓冲区,注意返回值是实际写入的字节数ret = mbedtls_pk_write_key_der(&pkey, key_buffer, key_len);if (ret < 0) {print_mbedtls_error(ret);goto cleanup;}// 计算 Base64 编码所需的缓冲区长度key_len = ret; // 实际写入的字节数ret = mbedtls_base64_encode(NULL, 0, &base64_len, key_buffer + (key_len - ret), key_len);if (ret != MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL) {print_mbedtls_error(ret);goto cleanup;}// 分配缓冲区以存储 Base64 编码的数据base64_buffer = (unsigned char*)malloc(base64_len);if (!base64_buffer) {fprintf(stderr, "Memory allocation failed for base64_buffer\n");ret = -1;goto cleanup;}// 将 DER 格式的私钥转换为 Base64 编码ret = mbedtls_base64_encode(base64_buffer, base64_len, &base64_len, key_buffer + (key_len - ret), key_len);if (ret != 0) {print_mbedtls_error(ret);goto cleanup;}// 打印 Base64 编码的私钥printf("Base64 Encoded Private Key:\n%s\n", base64_buffer);cleanup:mbedtls_pk_free(&pkey);if (key_buffer) {free(key_buffer);}if (base64_buffer) {free(base64_buffer);}//Key length required for DER format: 18446744073709551508 bytes//Memory allocation failed for key_buffer with size 18446744073709551508 bytesreturn ret != 0 ? EXIT_FAILURE : EXIT_SUCCESS;
}int testHttps_p8() {printf("Https功能演示start:\n");int ret;mbedtls_net_context server_fd;mbedtls_ssl_context ssl;mbedtls_ssl_config conf;mbedtls_x509_crt cacert, clicert;mbedtls_pk_context pkey;mbedtls_entropy_context entropy;mbedtls_ctr_drbg_context ctr_drbg;const char* pers = "ssl_client1";// Initialize structuresmbedtls_net_init(&server_fd);mbedtls_ssl_init(&ssl);mbedtls_ssl_config_init(&conf);mbedtls_x509_crt_init(&cacert);mbedtls_x509_crt_init(&clicert);mbedtls_pk_init(&pkey);mbedtls_ctr_drbg_init(&ctr_drbg);mbedtls_entropy_init(&entropy);// 设置 RNG//ret = mbedtls_ctr_drbg_seed(&(hc->tls.ctr_drbg), mbedtls_entropy_func, &hc->tls.entropy, NULL, 0);//ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, (const unsigned char*)pers, strlen(pers));ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, NULL, 0);if (ret != 0){return ret;}// Load certificates//mbedtls_x509_crt_parse_file(&clicert, "res/yax/client_https_with_chain.cer"); //含有客户端证书链mbedtls_x509_crt_parse_file(&clicert, "res/yax/client_https.cer"); //不含有证书链mbedtls_x509_crt_parse_file(&cacert, "res/yax/ca.cer"); //所有客户端和服务端所有证书链//mbedtls_x509_crt_parse_file(&cacert, "res/yax/root.cer"); //只提供一个服务器证书的root证书即可mbedtls_pk_parse_keyfile(&pkey, "res/yax/client_p8.key", NULL); //p1或p8格式都可以,但必须包含头尾//mbedtls_pk_parse_keyfile(&pkey, "res/yax2/client_p8.key", NULL);mbedtls_ssl_conf_authmode(&ssl, MBEDTLS_SSL_VERIFY_REQUIRED); //设置认证模式为 MBEDTLS_SSL_VERIFY_OPTIONAL 或 MBEDTLS_SSL_VERIFY_NONE 来调试是否由于证书验证失败引起的问题//但是,这仅用于调试,生产环境应该始终使用 MBEDTLS_SSL_VERIFY_REQUIRED。 // Seed the random number generator//mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, (const unsigned char*)pers, strlen(pers));// Setup SSL configurationmbedtls_ssl_config_defaults(&conf, MBEDTLS_SSL_IS_CLIENT, MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT);mbedtls_ssl_conf_rng(&conf, mbedtls_ctr_drbg_random, &ctr_drbg);mbedtls_ssl_conf_dbg(&conf, my_debug, stdout);mbedtls_ssl_conf_ca_chain(&conf, &cacert, NULL);mbedtls_ssl_conf_own_cert(&conf, &clicert, &pkey);//mbedtls_ssl_set_hostname(&ssl, "4.3.2.1"); //服务器证书alt name dns = ip而不是域名时,不要调用这个//mbedtls_ssl_set_hostname(&ssl, NULL); //忽略主机名验证//mbedtls_ssl_conf_verify(&conf, 0, NULL); // 设置自定义的证书验证回调// Connect to servermbedtls_net_connect(&server_fd, "4.3.2.1", "443", MBEDTLS_NET_PROTO_TCP); //rsa https 测试服务端//mbedtls_net_connect(&server_fd, "4.3.2.1", "443", MBEDTLS_NET_PROTO_TCP); //RSA 国密sm2 双算法证书https 不适用。// Setup SSL contextmbedtls_ssl_setup(&ssl, &conf);mbedtls_ssl_set_bio(&ssl, &server_fd, mbedtls_net_send, mbedtls_net_recv, NULL);// Perform SSL handshakewhile ((ret = mbedtls_ssl_handshake(&ssl)) != 0) {if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE) {char error_buf[100];mbedtls_strerror(ret, error_buf, 100);printf("Handshake failed: %s\n", error_buf);return 1;}}//打印服务器证书的sanprint_server_san(&ssl);//print_prikey_b64();// Communicate with the server// ...// Send data to serverconst char* msg = "Hello, Server!";mbedtls_ssl_write(&ssl, (const unsigned char*)msg, strlen(msg));// Read responsechar buffer[1024];do {memset(buffer, 0, sizeof(buffer));ret = mbedtls_ssl_read(&ssl, (unsigned char*)buffer, sizeof(buffer) - 1);if (ret > 0) {printf("Received %d bytes:\n%s\n", ret, buffer);}else if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE) {break;}} while (ret > 0);// Clean upmbedtls_ssl_close_notify(&ssl);mbedtls_net_free(&server_fd);mbedtls_x509_crt_free(&cacert);mbedtls_x509_crt_free(&clicert);mbedtls_pk_free(&pkey);mbedtls_ssl_free(&ssl);mbedtls_ssl_config_free(&conf);mbedtls_ctr_drbg_free(&ctr_drbg);mbedtls_entropy_free(&entropy);printf("Https功能演示End:\n");return EXIT_SUCCESS;
}//在证书base64编码前后添加头尾
char* cert_add_ht(const char* filename) {FILE* file = fopen(filename, "r");if (!file) {perror("无法打开文件");return NULL;}// 获取文件大小fseek(file, 0, SEEK_END);long filesize = ftell(file);fseek(file, 0, SEEK_SET);// 分配内存读取文件内容char* base64_data = (char*)malloc(filesize + 1);if (!base64_data) {perror("内存分配失败");fclose(file);return NULL;}fread(base64_data, 1, filesize, file);base64_data[filesize] = '\0'; // 确保字符串结束fclose(file);const char* pem_header = "-----BEGIN CERTIFICATE-----\n";const char* pem_footer = "\n-----END CERTIFICATE-----\n";// 计算 PEM 格式总长度size_t pem_size = strlen(pem_header) + strlen(base64_data) + strlen(pem_footer) + 1;// 分配内存以存储 PEM 格式数据char* pem_cert = (char*)malloc(pem_size);if (!pem_cert) {perror("内存分配失败");free(base64_data);return NULL;}// 生成 PEM 格式数据snprintf(pem_cert, pem_size, "%s%s%s", pem_header, base64_data, pem_footer);free(base64_data);return pem_cert;
}char* pkcs1_key_add_ht(const char* filename) {FILE* file = fopen(filename, "r");if (!file) {perror("无法打开文件");return NULL;}// 获取文件大小fseek(file, 0, SEEK_END);long filesize = ftell(file);fseek(file, 0, SEEK_SET);// 分配内存读取文件内容char* base64_data = (char*)malloc(filesize + 1);if (!base64_data) {perror("内存分配失败");fclose(file);return NULL;}fread(base64_data, 1, filesize, file);base64_data[filesize] = '\0'; // 确保字符串结束fclose(file);const char* pem_header = "-----BEGIN RSA PRIVATE KEY-----\n";const char* pem_footer = "\n-----END RSA PRIVATE KEY-----\n";// 计算 PEM 格式总长度size_t pem_size = strlen(pem_header) + strlen(base64_data) + strlen(pem_footer) + 1;// 分配内存以存储 PEM 格式数据char* pem_cert = (char*)malloc(pem_size);if (!pem_cert) {perror("内存分配失败");free(base64_data);return NULL;}// 生成 PEM 格式数据snprintf(pem_cert, pem_size, "%s%s%s", pem_header, base64_data, pem_footer);free(base64_data);return pem_cert;
}int testHttps() {printf("Https功能演示start:\n");int ret;mbedtls_net_context server_fd;mbedtls_ssl_context ssl;mbedtls_ssl_config conf;mbedtls_x509_crt cacert, clicert;mbedtls_pk_context pkey;mbedtls_entropy_context entropy;mbedtls_ctr_drbg_context ctr_drbg;const char* pers = "ssl_client1";// Initialize structuresmbedtls_net_init(&server_fd);mbedtls_ssl_init(&ssl);mbedtls_ssl_config_init(&conf);mbedtls_x509_crt_init(&cacert);mbedtls_x509_crt_init(&clicert);mbedtls_pk_init(&pkey);mbedtls_ctr_drbg_init(&ctr_drbg);mbedtls_entropy_init(&entropy);// 设置 RNG//ret = mbedtls_ctr_drbg_seed(&(hc->tls.ctr_drbg), mbedtls_entropy_func, &hc->tls.entropy, NULL, 0);//ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, (const unsigned char*)pers, strlen(pers));ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, NULL, 0);if (ret != 0){return ret;}const char* file_cert_b64 = "res/yax2/client_https_noht.cer";// 读取证书文件(不包含头尾)并转换为 PEM 格式(包含头尾)char* pem_cert = cert_add_ht(file_cert_b64);// 获取 PEM 证书的大小size_t pem_size = strlen(pem_cert) + 1; // 包括终止符mbedtls_x509_crt_parse(&clicert, (const unsigned char*)pem_cert, pem_size);free(pem_cert);const char* file_key_p1_b64 = "res/yax2/client_p1_noht.key";// 读取证书文件(不包含头尾)并转换为 PEM 格式(包含头尾)char* pem_key = pkcs1_key_add_ht(file_key_p1_b64);// 获取 PEM 证书的大小size_t key_size = strlen(pem_key) + 1; // 包括终止符mbedtls_pk_parse_key(&pkey, (const unsigned char*)pem_key, key_size,NULL,0);free(pem_key);mbedtls_x509_crt_parse_file(&cacert, "res/yax/ca.cer"); //所有客户端和服务端所有证书链// Load certificates//mbedtls_x509_crt_parse_file(&clicert, "res/yax/client_https_with_chain.cer"); //含有客户端证书链//mbedtls_x509_crt_parse_file(&clicert, "res/yax2/client_https_noht.cer"); //不含有证书链//mbedtls_x509_crt_parse_file(&cacert, "res/yax/ca.cer"); //所有客户端和服务端所有证书链//mbedtls_x509_crt_parse_file(&cacert, "res/yax/root.cer"); //只提供一个服务器证书的root证书即可//mbedtls_pk_parse_keyfile(&pkey, "res/yax2/client_p1.key", NULL); //p1或p8格式都可以,但必须包含头尾//mbedtls_pk_parse_keyfile(&pkey, "res/yax2/client_p8.key", NULL);mbedtls_ssl_conf_authmode(&ssl, MBEDTLS_SSL_VERIFY_REQUIRED); //设置认证模式为 MBEDTLS_SSL_VERIFY_OPTIONAL 或 MBEDTLS_SSL_VERIFY_NONE 来调试是否由于证书验证失败引起的问题//但是,这仅用于调试,生产环境应该始终使用 MBEDTLS_SSL_VERIFY_REQUIRED。
// Seed the random number generator
//mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, (const unsigned char*)pers, strlen(pers));// Setup SSL configurationmbedtls_ssl_config_defaults(&conf, MBEDTLS_SSL_IS_CLIENT, MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT);mbedtls_ssl_conf_rng(&conf, mbedtls_ctr_drbg_random, &ctr_drbg);mbedtls_ssl_conf_dbg(&conf, my_debug, stdout);mbedtls_ssl_conf_ca_chain(&conf, &cacert, NULL);mbedtls_ssl_conf_own_cert(&conf, &clicert, &pkey);//mbedtls_ssl_set_hostname(&ssl, "1.2.3.4"); //服务器证书alt name dns = ip而不是域名时,不要调用这个//mbedtls_ssl_set_hostname(&ssl, NULL); //忽略主机名验证//mbedtls_ssl_conf_verify(&conf, 0, NULL); // 设置自定义的证书验证回调// Connect to servermbedtls_net_connect(&server_fd, "2.3.4.5", "443", MBEDTLS_NET_PROTO_TCP); //rsa https 测试服务端//mbedtls_net_connect(&server_fd, "2.3.4.5", "443", MBEDTLS_NET_PROTO_TCP); //RSA 国密sm2 双算法证书https 不适用。// Setup SSL contextmbedtls_ssl_setup(&ssl, &conf);mbedtls_ssl_set_bio(&ssl, &server_fd, mbedtls_net_send, mbedtls_net_recv, NULL);// Perform SSL handshakewhile ((ret = mbedtls_ssl_handshake(&ssl)) != 0) {if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE) {char error_buf[100];mbedtls_strerror(ret, error_buf, 100);printf("Handshake failed: %s\n", error_buf);return 1;}}//打印服务器证书的sanprint_server_san(&ssl);//print_prikey_b64();// Communicate with the server// ...// Send data to serverconst char* msg = "Hello, Server!";mbedtls_ssl_write(&ssl, (const unsigned char*)msg, strlen(msg));// Read responsechar buffer[1024];do {memset(buffer, 0, sizeof(buffer));ret = mbedtls_ssl_read(&ssl, (unsigned char*)buffer, sizeof(buffer) - 1);if (ret > 0) {printf("Received %d bytes:\n%s\n", ret, buffer);}else if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE) {break;}} while (ret > 0);// Clean upmbedtls_ssl_close_notify(&ssl);mbedtls_net_free(&server_fd);mbedtls_x509_crt_free(&cacert);mbedtls_x509_crt_free(&clicert);mbedtls_pk_free(&pkey);mbedtls_ssl_free(&ssl);mbedtls_ssl_config_free(&conf);mbedtls_ctr_drbg_free(&ctr_drbg);mbedtls_entropy_free(&entropy);printf("Https功能演示End:\n");return EXIT_SUCCESS;
}