Main Page | Class Hierarchy | Class List | File List | Class Members | Related Pages

glite::rgma::SSLCertVerifyCallback Class Reference

#include <SSLCertVerifyCallback.h>

List of all members.

Static Public Member Functions

int main (X509_STORE_CTX *X509StoreContext, void *argument)
int checkIssued (X509_STORE_CTX *X509StoreContext, X509 *certificate, X509 *candidateIssuerCertificate)


Detailed Description

Encapuslates OpenSSL Callback function to verify certificate chain. Modifies X509 certificate store context to replace the function for finding out of one certificate issued another with one that will accept proxy certificates being signed by certificates which have the X509v3 Key Usage field present but where the Key Usage field doesn't specify CA_sign.


Member Function Documentation

int glite::rgma::SSLCertVerifyCallback::checkIssued X509_STORE_CTX *  X509StoreContext,
X509 *  certificate,
X509 *  candidateIssuerCertificate
[static]
 

Replacement to the OpenSSL check_issued function pointed to by X509_STORE_CTX.check_issued. It recognises issuer certificates which have the X509v3 Key Usage extension field present but without the CA_Sign authorisation specified in it, when the issuer has signed a proxy certificate.

The default OpenSSL implementation won't recognise an issuer which has the Key Usage extension field present but doesn't have the CA Sign bit set in it.

Both versions recognise issuers which don't have the Key Usage extension field present at all.

Returns:
1 if the candidateIssuerCertificate issued certificate, or 0 if it didn't.

int glite::rgma::SSLCertVerifyCallback::main X509_STORE_CTX *  X509StoreContext,
void *  argument
[static]
 

Callback function. Replace X509StoreContext->check_issued and then call the default OpenSSL X509_verify_cert. Signature is as required for OpenSSL 0.9.7 SSL_CTX_set_cert_verify_callback().


The documentation for this class was generated from the following files:
Generated on Wed Apr 25 19:11:33 2007 for glite-rgma-api-cpp by doxygen 1.3.5