ruby - 使用 SOAP 中的 WSSE 发送以 Ruby 中的 Base 64 编码的公钥

Question

我正在尝试发送以 Base 64 编码的 WSSE DSA 公钥。我一直在尝试使用 Open SSL 库将公钥与证书文件分开，但 OpenSSL 似乎使用了我的整个证书文件而不是仅提取公钥。

File.open("path/certificate.cer", 'rb') do |file|
  cert_file = file.read()
  cert = OpenSSL::X509::Certificate.new cert_file
end
cert_string = (cert.public_key.to_s+"").delete("\n") #it was formatting itself with newlines
cert_string = cert_string[26..-25] #the start/end messages aren't sent
puts cert_string

Answer 1

这是我用来从证书中提取公钥的代码。我用它来public key pinning ，因此它使用连接中的 SSL*。

本质上，您调用一次 len1 = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), NULL) 来获取长度，然后调用 len2 = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), buffer) 第二次检索证书。您可以使用 len1 和 len2 作为基本的健全性检查，以确保您返回预期的字节数。

int pin_peer_pubkey(SSL* ssl)
{
    if(NULL == ssl) return FALSE;
    
    X509* cert = NULL;
    
    /* Scratch */
    int len1 = 0, len2 = 0;
    unsigned char *buff1 = NULL;
    
    /* Result is returned to caller */
    int ret = 0, result = FALSE;
    
    do
    {
        /* http://www.openssl.org/docs/ssl/SSL_get_peer_certificate.html */
        cert = SSL_get_peer_certificate(ssl);
        if(!(cert != NULL))
            break; /* failed */
        
        /* Begin Gyrations to get the subjectPublicKeyInfo       */
        /* Thanks to Viktor Dukhovni on the OpenSSL mailing list */
        
        /* http://groups.google.com/group/mailing.openssl.users/browse_thread/thread/d61858dae102c6c7 */
        len1 = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), NULL);
        if(!(len1 > 0))
            break; /* failed */
        
        /* scratch */
        unsigned char* temp = NULL;
        
        /* http://www.openssl.org/docs/crypto/buffer.html */
        buff1 = temp = OPENSSL_malloc(len1);
        if(!(buff1 != NULL))
            break; /* failed */
        
        /* http://www.openssl.org/docs/crypto/d2i_X509.html */
        len2 = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), &temp);

        /* These checks are verifying we got back the same values as when we sized the buffer.      */
        /* Its pretty weak since they should always be the same. But it gives us something to test. */
        if(!((len1 == len2) && (temp != NULL) && ((temp - buff1) == len1)))
            break; /* failed */
        
        /* End Gyrations */
        
        /* Do something with the public key */
        ...

        ret = TRUE;
        
    } while(0);          
    
    /* http://www.openssl.org/docs/crypto/buffer.html */
    if(NULL != buff1)
        OPENSSL_free(buff1);
    
    /* http://www.openssl.org/docs/crypto/X509_new.html */
    if(NULL != cert)
        X509_free(cert);
    
    return result;
}

---

Sending a Public Key Encoded in Base 64 in Ruby using WSSE in SOAP...

嗯，这是您可以制定的协议(protocol)细节。您可以将其作为原始字节发送、Base64 编码( RFC 4648 ，第 4 节)或 Base64URL 编码( RFC 4648 ，第 5 节)并发送。这取决于你。