Use openssl to write server and client programs

The following is an overview of how to use openssl for programming.

1. Use the same ca to generate two certificates: server. cer and client. cer. Note that when generating server. cer, you must specify that the certificate can be used on the server.

Server code:

 

 
 

  
  
# Include "openssl/bio. h"
  
  
# Include "openssl/ssl. h"
  
  
# Include "openssl/err. h"
  
  
 
  
  
# Include <cutil. h>
  
  
 
  
  
# Define EXIT_IF_TRUE (x) if (x )\
  
  
Do {\
  
  
Fprintf (stderr, "Check '% s' is true \ n", # x );\
  
  
ERR_print_errors_fp (stderr );\
  
  
Exit (2 );\
  
  
} While (0)
  
  
 
  
  
Int main (int argc, char ** argv)
  
  
{
  
  
SSL_CTX * ctx;
  
  
SSL * ssl;
  
  
X509 * client_cert;
  
  
 
  
  
Char szBuffer [1024];
  
  
Int nLen;
  
  
 
  
  
Struct sockaddr_in addr;
  
  
Int len;
  
  
Int nListenFd, nAcceptFd;
  
  
 
  
  
// Initialization
  
  
Cutil_init ();
  
  
Cutil_log_set_level (LOG_ALL );
  
  
Cutil_log_set_stderr (1 );
  
  
SSLeay_add_ssl_algorithms ();
  
  
OpenSSL_add_all_algorithms ();
  
  
SSL_load_error_strings ();
  
  
ERR_load_BIO_strings ();
  
  
 
  
  
// We use SSL V3, V2
  
  
EXIT_IF_TRUE (ctx = SSL_CTX_new (SSLv23_method () = NULL );
  
  
 
  
  
// Verify the certificate of the other party
  
  
SSL_CTX_set_verify (ctx, SSL_VERIFY_PEER, NULL );
  
  
 
  
  
// Load the CA certificate
  
  
EXIT_IF_TRUE (! SSL_CTX_load_verify_locations (ctx, "cacert. cer", NULL ));
  
  
 
  
  
// Load your own certificate
  
  
EXIT_IF_TRUE (SSL_CTX_use_certificate_file (ctx, "server. cer", SSL_FILETYPE_PEM) <= 0 );
  
  
 
  
  
// Load your private key
  
  
EXIT_IF_TRUE (SSL_CTX_use_PrivateKey_file (ctx, "server. key", SSL_FILETYPE_PEM) <= 0 );
  
  
 
  
  
// Determine whether the private key is correct
  
  
EXIT_IF_TRUE (! SSL_CTX_check_private_key (ctx ));
  
  
 
  
  
// Create and wait for connection
  
  
NListenFd = cutil_socket_new (SOCK_STREAM );
  
  
Cutil_socket_bind (nListenFd, NULL, 8812, 1 );
  
  
 
  
  
Memset (& addr, 0, sizeof (addr ));
  
  
Len = sizeof (addr );
  
  
NAcceptFd = accept (nListenFd, (struct sockaddr *) & addr, (size_t *) & len );
  
  
Cutil_log_debug ("Accept a connect from [% s: % d] \ n ",
  
  
Inet_ntoa (addr. sin_addr), ntohs (addr. sin_port ));
  
  
 
  
  
// Pay the connection to SSL
  
  
EXIT_IF_TRUE (ssl = SSL_new (ctx) = NULL );
  
  
SSL_set_fd (ssl, nAcceptFd );
  
  
EXIT_IF_TRUE (SSL_accept (ssl )! = 1 );
  
  
 
  
  
// Perform the operation
  
  
Memset (szBuffer, 0, sizeof (szBuffer ));
  
  
NLen = SSL_read (ssl, szBuffer, sizeof (szBuffer ));
  
  
Fprintf (stderr, "Get Len % d % s OK \ n", nLen, szBuffer );
  
  
Strcat (szBuffer, "this is from server ");
  
  
SSL_write (ssl, szBuffer, strlen (szBuffer ));
  
  
 
  
  
// Release resources
  
  
SSL_free (ssl );
  
  
SSL_CTX_free (ctx );
  
  
Close (nAcceptFd );
  
  
}
 
 
Client code

 
 

  
  
# Include "openssl/bio. h"
  
  
# Include "openssl/ssl. h"
  
  
# Include "openssl/err. h"
  
  
 
  
  
# Include <cutil. h>
  
  
 
  
  
# Define EXIT_IF_TRUE (x) if (x )\
  
  
Do {\
  
  
Fprintf (stderr, "Check '% s' is true \ n", # x );\
  
  
ERR_print_errors_fp (stderr );\
  
  
Exit (2 );\
  
  
} While (0)
  
  
 
  
  
Int main (int argc, char ** argv)
  
  
{
  
  
SSL_METHOD * meth;
  
  
SSL_CTX * ctx;
  
  
SSL * ssl;
  
  
 
  
  
Int nFd;
  
  
Int nLen;
  
  
Char szBuffer [1024];
  
  
 
  
  
// Initialization
  
  
Cutil_init ();
  
  
Cutil_log_set_level (LOG_ALL );
  
  
Cutil_log_set_stderr (1 );
  
  
SSLeay_add_ssl_algorithms ();
  
  
OpenSSL_add_all_algorithms ();
  
  
SSL_load_error_strings ();
  
  
ERR_load_BIO_strings ();
  
  
 
  
  
// We use SSL V3, V2
  
  
EXIT_IF_TRUE (ctx = SSL_CTX_new (SSLv23_method () = NULL );
  
  
 
  
  
// Verify the certificate of the other party
  
  
SSL_CTX_set_verify (ctx, SSL_VERIFY_PEER, NULL );
  
  
 
  
  
// Load the CA certificate
  
  
EXIT_IF_TRUE (! SSL_CTX_load_verify_locations (ctx, "cacert. cer", NULL ));
  
  
 
  
  
// Load your own certificate
  
  
EXIT_IF_TRUE (SSL_CTX_use_certificate_file (ctx, "client. cer", SSL_FILETYPE_PEM) <= 0 );
  
  
 
  
  
// Load your private key
  
  
EXIT_IF_TRUE (SSL_CTX_use_PrivateKey_file (ctx, "client. key", SSL_FILETYPE_PEM) <= 0 );
  
  
 
  
  
// Determine whether the private key is correct
  
  
EXIT_IF_TRUE (! SSL_CTX_check_private_key (ctx ));
  
  

  
  
// Create a connection
  
  
NFd = cutil_socket_new (SOCK_STREAM );
  
  
If (cutil_socket_connect (nFd, "127.0.0.1", 8812, 30) <0)
  
  
{
  
  
Cutil_log_error ("failed to connect to the server \ n ");
  
  
Return-1;
  
  
}
  
  
 
  
  
// Pay the connection to SSL
  
  
EXIT_IF_TRUE (ssl = SSL_new (ctx) = NULL );
  
  
SSL_set_fd (ssl, nFd );
  
  
EXIT_IF_TRUE (SSL_connect (ssl )! = 1 );
  
  
 
  
  
// Perform the operation
  
  
Sprintf (szBuffer, "this is from client % d", getpid ());
  
  
SSL_write (ssl, szBuffer, strlen (szBuffer ));
  
  
 
  
  
// Release resources
  
  
Memset (szBuffer, 0, sizeof (szBuffer ));
  
  
NLen = SSL_read (ssl, szBuffer, sizeof (szBuffer ));
  
  
Fprintf (stderr, "Get Len % d % s OK \ n", nLen, szBuffer );
  
  

  
  
SSL_free (ssl );
  
  
SSL_CTX_free (ctx );
  
  
Close (nFd );
  
  
}