无法使用C 中的OPENSL API添加证书策略扩展

这确实是一个评论，但是评论没有空间。

$ grep -R NID_certificate_policies *crypto/objects/obj_dat.h:   NID_certificate_policies,3,&(lvalues[512]),0},
crypto/objects/objects.h:#define NID_certificate_policies   89
crypto/objects/obj_mac.h:#define NID_certificate_policies       89
crypto/x509v3/v3_cpols.c:NID_certificate_policies, 0,ASN1_ITEM_ref(CERTIFICATEPOLICIES),
crypto/x509v3/pcy_cache.c:  ext_cpols = X509_get_ext_d2i(x, NID_certificate_policies, &i, NULL);
crypto/x509v3/v3_purp.c:        NID_certificate_policies, /* 89 */

看v3_cpols.c，有一个不祥的警告：

/* Certificate policies extension support: this one is a bit complex... */

这是其声明的方式：

const X509V3_EXT_METHOD v3_cpols = {
  NID_certificate_policies, 0,ASN1_ITEM_ref(CERTIFICATEPOLICIES),
  0,0,0,0,
  0,0,
  0,0,
  (X509V3_EXT_I2R)i2r_certpol,
  (X509V3_EXT_R2I)r2i_certpol,
  NULL
};
ASN1_ITEM_TEMPLATE(CERTIFICATEPOLICIES) = 
    ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, CERTIFICATEPOLICIES, POLICYINFO)
ASN1_ITEM_TEMPLATE_END(CERTIFICATEPOLICIES)
IMPLEMENT_ASN1_FUNCTIONS(CERTIFICATEPOLICIES)

v3_cpol然后在 ext_dat.h中使用：

static const X509V3_EXT_METHOD *standard_exts[] = {
  &v3_nscert,
  &v3_ns_ia5_list[0],
  &v3_ns_ia5_list[1],
  &v3_ns_ia5_list[2],
  &v3_ns_ia5_list[3],
  &v3_ns_ia5_list[4],
  &v3_ns_ia5_list[5],
  &v3_ns_ia5_list[6],
  ...
  &v3_cpols,
  ...
};

似乎没有文档或清除用法。我关于OpenSSL的两本书缺乏治疗方法。看起来您在泥泞的水域中。

也许OpenSSL用户列表中的人们可以帮助您。我建议这样做，因为列表中的某些人可能可以回答（SH，DT，VD等），但是我还没有在Stack Overflow网站上看到他们。

这个问题已经很长时间了，但是我研究了openssl1.0.2k源代码，我发现其不支持直接添加CPS扩展：

static STACK_OF(POLICYINFO) *r2i_certpol(X509V3_EXT_METHOD *method,
                                         X509V3_CTX *ctx, char *value)
{
    WriteLogToFile("In r2i_certpol");
    STACK_OF(POLICYINFO) *pols = NULL;
    char *pstr;
    POLICYINFO *pol;
    ASN1_OBJECT *pobj;
    STACK_OF(CONF_VALUE) *vals;
    CONF_VALUE *cnf;
    int i, ia5org;
    pols = sk_POLICYINFO_new_null();
    if (pols == NULL) {
        X509V3err(X509V3_F_R2I_CERTPOL, ERR_R_MALLOC_FAILURE);
        return NULL;
    }
    WriteLogToFile("Before X509V3_parse_list");
    vals = X509V3_parse_list(value);
    WriteLogToFile("After X509V3_parse_list");
    if (vals == NULL) {
        X509V3err(X509V3_F_R2I_CERTPOL, ERR_R_X509V3_LIB);
        goto err;
    }
    ia5org = 0;
    for (i = 0; i < sk_CONF_VALUE_num(vals); i++) {
        cnf = sk_CONF_VALUE_value(vals, i);
        if (cnf->value || !cnf->name) {
            char str[1000];
            sprintf(str, "cnf->value: %s, cnf->name: %s", cnf->value, cnf->name);
            WriteLogToFile(str);
            X509V3err(X509V3_F_R2I_CERTPOL,
                      X509V3_R_INVALID_POLICY_IDENTIFIER);
            X509V3_conf_err(cnf);
            goto err;
        }
        pstr = cnf->name;
        WriteLogToFile(pstr);
        if (!strcmp(pstr, "ia5org")) {
            ia5org = 1;
            continue;
        } else if (*pstr == '@') {
            STACK_OF(CONF_VALUE) *polsect;
            polsect = X509V3_get_section(ctx, pstr + 1);
            if (!polsect) {
                X509V3err(X509V3_F_R2I_CERTPOL, X509V3_R_INVALID_SECTION);
                X509V3_conf_err(cnf);
                goto err;
            }
            pol = policy_section(ctx, polsect, ia5org);
            X509V3_section_free(ctx, polsect);
            if (!pol)
                goto err;
        } else {
            if (!(pobj = OBJ_txt2obj(cnf->name, 0))) {
                X509V3err(X509V3_F_R2I_CERTPOL,
                          X509V3_R_INVALID_OBJECT_IDENTIFIER);
                X509V3_conf_err(cnf);
                goto err;
            }
            pol = POLICYINFO_new();
            if (pol == NULL) {
                X509V3err(X509V3_F_R2I_CERTPOL, ERR_R_MALLOC_FAILURE);
                goto err;
            }
            pol->policyid = pobj;
        }
        if (!sk_POLICYINFO_push(pols, pol)) {
            POLICYINFO_free(pol);
            X509V3err(X509V3_F_R2I_CERTPOL, ERR_R_MALLOC_FAILURE);
            goto err;
        }
    }
    sk_CONF_VALUE_pop_free(vals, X509V3_conf_free);
    return pols;
 err:
    sk_CONF_VALUE_pop_free(vals, X509V3_conf_free);
    sk_POLICYINFO_pop_free(pols, POLICYINFO_free);
    return NULL;
}

" CPS"必须在部分部分中，该部分由openssl.conf文件配置，因此任何人遇到的问题都必须将CPS放入该配置文件中，并告诉OpenSSL搜索该部分，如下面的代码：

bool AddX509ExtensionFromFile(X509* cert, X509* issuer, int nid, char* value,char* extFile)
{
    if (extFile)
    {
        long errorline = -1;
        X509V3_CTX ctx2;
        CONF* extconf = NCONF_new(NULL);
        if (!NCONF_load(extconf, extFile, &errorline))
        {
            if (errorline <= 0)
            {
                printf("NCONF_load errorn");
            }
            else
            {
                printf("error on line %ld of config file '%s'n", errorline, extFile);
            }
        }
        char* extsect = "default";
        X509V3_set_ctx_test(&ctx2);
        X509V3_set_nconf(&ctx2, extconf);
        if (!X509V3_EXT_add_nconf(extconf, &ctx2, extsect, NULL))
        {
            printf("error loading extension section %sn", extsect);
        }
        X509V3_set_ctx(&ctx2, issuer, cert, NULL, NULL, 0);
        X509_EXTENSION* ex = X509V3_EXT_conf_nid(NULL, &ctx2, nid, value);
        if (!ex) {
            return false;
        }
        int result = X509_add_ext(cert, ex, -1);
        X509_EXTENSION_free(ex);
        return (result == 0) ? true : false;
    }
    return false;
}