OpenSSL implements two-way authentication tutorial (with server and client code)

#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <openssl/ssl.h>
#include <openssl/err.h>

#define MAXBUF 1024

void ShowCerts(SSL * ssl)
{
  X509 *cert;
  char *line;

  cert = SSL_get_peer_certificate(ssl);
  // SSL_get_verify_result() is the key point. SSL_CTX_set_verify() only configures whether to enable it and does not perform authentication. Calling this function will actually verify the certificate authentication. // If the verification fails, the program throws an exception to terminate the connection if (SSL_get_verify_result (ssl) == X509_V_OK) {
    printf("Certificate verification passed\n");
  }
  if (cert != NULL) {
    printf("Digital certificate information:\n");
    line = X509_NAME_oneline(X509_get_subject_name(cert), 0, 0);
    printf("Certificate: %s\n", line);
    free(line);
    line = X509_NAME_oneline(X509_get_issuer_name(cert), 0, 0);
    printf("Issuer: %s\n", line);
    free(line);
    X509_free(cert);
  } else
    printf("No certificate information!\n");
}

int main(int argc, char **argv) {
  int sockfd, new_fd;
  socklen_t len;
  struct sockaddr_in my_addr, their_addr;
  unsigned int myport, lisnum;
  char buf[MAXBUF + 1];
  SSL_CTX *ctx;

  if (argv[1])
    myport = atoi(argv[1]);
  else
    myport = 7838;

  if (argv[2])
    lisnum = atoi(argv[2]);
  else
    lisnum = 2;

  /* SSL library initialization */
  SSL_library_init();
  /* Load all SSL algorithms */
  OpenSSL_add_all_algorithms();
  /* Load all SSL error messages */
  SSL_load_error_strings();
  /* Generate a SSL_CTX, SSL Content Text, in a way that is compatible with SSL V2 and V3 standards */
  ctx = SSL_CTX_new(SSLv23_server_method());
  /* You can also use SSLv2_server_method() or SSLv3_server_method() to indicate V2 or V3 standards separately*/
  if (ctx == NULL) {
    ERR_print_errors_fp(stdout);
    exit(1);
  }

  // Two-way verification // SSL_VERIFY_PEER --- requires certificate authentication, and will allow the request to pass even if no certificate is present // SSL_VERIFY_FAIL_IF_NO_PEER_CERT --- requires the client to provide a certificate, but will allow the request to pass even if no certificate is present SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL);
  // Set up the trusted root certificate if (SSL_CTX_load_verify_locations(ctx, "ca.crt",NULL)<=0){
    ERR_print_errors_fp(stdout);
    exit(1);
  }

  /* Load the user's digital certificate, which is used to send to the client. The certificate contains the public key*/
  if (SSL_CTX_use_certificate_file(ctx, argv[3], SSL_FILETYPE_PEM) <= 0) {
    ERR_print_errors_fp(stdout);
    exit(1);
  }
  /* Load user private key */
  if (SSL_CTX_use_PrivateKey_file(ctx, argv[4], SSL_FILETYPE_PEM) <= 0) {
    ERR_print_errors_fp(stdout);
    exit(1);
  }
  /* Check if the user's private key is correct*/
  if (!SSL_CTX_check_private_key(ctx)) {
    ERR_print_errors_fp(stdout);
    exit(1);
  }

  /* Open a socket listener */
  if ((sockfd = socket(PF_INET, SOCK_STREAM, 0)) == -1) {
    perror("socket");
    exit(1);
  } else
    printf("socket created\n");

  bzero(&my_addr, sizeof(my_addr));
  my_addr.sin_family = PF_INET;
  my_addr.sin_port = htons(myport);
  my_addr.sin_addr.s_addr = INADDR_ANY;

  if (bind(sockfd, (struct sockaddr *) &my_addr, sizeof(struct sockaddr))
      == -1) {
    perror("bind");
    exit(1);
  } else
    printf("binded\n");

  if (listen(sockfd, lisnum) == -1) {
    perror("listen");
    exit(1);
  } else
    printf("begin listen\n");

  while (1) {
    SSL *ssl;
    len = sizeof(struct sockaddr);
    /* Waiting for the client to connect*/
    if ((new_fd = accept(sockfd, (struct sockaddr *) &their_addr, &len))
        == -1) {
      perror("accept");
      exit(errno);
    } else
      printf("server: got connection from %s, port %d, socket %d\n",
          inet_ntoa(their_addr.sin_addr), ntohs(their_addr.sin_port),
          new_fd);

    /* Generate a new SSL based on ctx */
    ssl = SSL_new(ctx);
    /* Add the connected user's socket to SSL */
    SSL_set_fd(ssl, new_fd);
    /* Establish SSL connection */
    if (SSL_accept(ssl) == -1) {
      perror("accept");
      close(new_fd);
      break;
    }
    ShowCerts(ssl);

    /* Start processing data sending and receiving on each new connection*/
    bzero(buf, MAXBUF + 1);
    strcpy(buf, "server->client");
    /* Send message to client */
    len = SSL_write(ssl, buf, strlen(buf));

    if (len <= 0) {
      printf("Message '%s' failed to send! Error code is %d, error message is '%s'\n", buf, errno,
          strerror(errno));
      goto finish;
    } else
      printf("Message '%s' was sent successfully, a total of %d bytes were sent!\n", buf, len);

    bzero(buf, MAXBUF + 1);
    /* Receive messages from the client */
    len = SSL_read(ssl, buf, MAXBUF);
    if (len > 0)
      printf("Successful message reception: '%s', %d bytes of data\n", buf, len);
    else
      printf("Message reception failed! Error code is %d, error message is '%s'\n",
      errno, strerror(errno));
    /* Handle the end of data sending and receiving on each new connection*/
    finish:
    /* Close the SSL connection */
    SSL_shutdown(ssl);
    /* Release SSL */
    SSL_free(ssl);
    /* Close the socket */
    close(new_fd);
  }
  /* Close the listening socket */
  close(sockfd);
  /* Release CTX */
  SSL_CTX_free(ctx);
  return 0;
}

#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <sys/socket.h>
#include <resolv.h>
#include <stdlib.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <openssl/ssl.h>
#include <openssl/err.h>

#define MAXBUF 1024

void ShowCerts(SSL * ssl)
{
  X509 *cert;
  char *line;

  cert = SSL_get_peer_certificate(ssl);
  // SSL_get_verify_result() is the key point. SSL_CTX_set_verify() only configures whether to enable it and does not perform authentication. Calling this function will actually verify the certificate authentication. // If the verification fails, the program throws an exception to terminate the connection if (SSL_get_verify_result (ssl) == X509_V_OK) {
    printf("Certificate verification passed\n");
  }
  if (cert != NULL) {
    printf("Digital certificate information:\n");
    line = X509_NAME_oneline(X509_get_subject_name(cert), 0, 0);
    printf("Certificate: %s\n", line);
    free(line);
    line = X509_NAME_oneline(X509_get_issuer_name(cert), 0, 0);
    printf("Issuer: %s\n", line);
    free(line);
    X509_free(cert);
  } else
    printf("No certificate information!\n");
}

int main(int argc, char **argv)
{
  int sockfd, len;
  struct sockaddr_in dest;
  char buffer[MAXBUF + 1];
  SSL_CTX *ctx;
  SSL *ssl;

  if (argc != 5) {
    printf("Parameter format error! Correct usage is as follows:\n\t\t%s IP address port\n\tFor example:\t%s 127.0.0.1 80\nThis program is used to get from a certain"
       "The server at IP address receives messages with at most MAXBUF bytes at a certain port",
       argv[0], argv[0]);
    exit(0);
  }

  /* SSL library initialization, see ssl-server.c code*/
  SSL_library_init();
  OpenSSL_add_all_algorithms();
  SSL_load_error_strings();
  ctx = SSL_CTX_new(SSLv23_client_method());
  if (ctx == NULL) {
    ERR_print_errors_fp(stdout);
    exit(1);
  }

  // Two-way verification // SSL_VERIFY_PEER --- requires certificate authentication, and will allow the request to pass even if no certificate is present // SSL_VERIFY_FAIL_IF_NO_PEER_CERT --- requires the client to provide a certificate, but will allow the request to pass even if no certificate is present SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL);
  // Set up the trusted root certificate if (SSL_CTX_load_verify_locations(ctx, "ca.crt",NULL)<=0){
    ERR_print_errors_fp(stdout);
    exit(1);
  }

  /* Load the user's digital certificate, which is used to send to the client. The certificate contains the public key*/
  if (SSL_CTX_use_certificate_file(ctx, argv[3], SSL_FILETYPE_PEM) <= 0) {
    ERR_print_errors_fp(stdout);
    exit(1);
  }
  /* Load user private key */
  if (SSL_CTX_use_PrivateKey_file(ctx, argv[4], SSL_FILETYPE_PEM) <= 0) {
    ERR_print_errors_fp(stdout);
    exit(1);
  }
  /* Check if the user's private key is correct*/
  if (!SSL_CTX_check_private_key(ctx)) {
    ERR_print_errors_fp(stdout);
    exit(1);
  }

  /* Create a socket for TCP communication */
  if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
    perror("Socket");
    exit(errno);
  }
  printf("socket created\n");

  /* Initialize the server (other party) address and port information*/
  bzero(&dest, sizeof(dest));
  dest.sin_family = AF_INET;
  dest.sin_port = htons(atoi(argv[2]));
  if (inet_aton(argv[1], (struct in_addr *) &dest.sin_addr.s_addr) == 0) {
    perror(argv[1]);
    exit(errno);
  }
  printf("address created\n");

  /* Connect to server */
  if (connect(sockfd, (struct sockaddr *) &dest, sizeof(dest)) != 0) {
    perror("Connect ");
    exit(errno);
  }
  printf("server connected\n");

  /* Generate a new SSL based on ctx */
  ssl = SSL_new(ctx);
  SSL_set_fd(ssl, sockfd);
  /* Establish SSL connection */
  if (SSL_connect(ssl) == -1)
    ERR_print_errors_fp(stderr);
  else {
    printf("Connected with %s encryption\n", SSL_get_cipher(ssl));
    ShowCerts(ssl);
  }

  /* Receive the message sent by the other party, and receive at most MAXBUF bytes*/
  bzero(buffer, MAXBUF + 1);
  /* Receive messages from the server */
  len = SSL_read(ssl, buffer, MAXBUF);
  if (len > 0)
    printf("Received message successfully: '%s', total %d bytes of data\n",
        buffer,len);
  else {
    printf
      ("Message reception failed! Error code is %d, error message is '%s'\n",
       errno, strerror(errno));
    goto finish;
  }
  bzero(buffer, MAXBUF + 1);
  strcpy(buffer, "from client->server");
  /* Send a message to the server */
  len = SSL_write(ssl, buffer, strlen(buffer));
  if (len < 0)
    printf
      ("Message '%s' failed to send! Error code is %d, error message is '%s'\n",
       buffer, errno, strerror(errno));
  else
    printf("Message '%s' was sent successfully, a total of %d bytes were sent!\n",
        buffer,len);

 finish:
  /* Close the connection */
  SSL_shutdown(ssl);
  SSL_free(ssl);
  close(sockfd);
  SSL_CTX_free(ctx);
  return 0;
}

# CA certificate and key generation method 1 - directly generate CA key and self-signed certificate # If you do not need to enter a password when reading the private key file ca_rsa_private.pem in the future, that is, do not encrypt the private key for storage, then replace -passout pass:123456 with -nodes
openssl req -newkey rsa:2048 -passout pass:123456 -keyout ca_rsa_private.pem -x509 -days 365 -out ca.crt -subj "/C=CN/ST=GD/L=SZ/O=COM/OU=NSP/CN=CA/[email protected]"
# CA certificate and key generation method 2 -- Generate CA key and self-signed certificate step by step:
# openssl genrsa -aes256 -passout pass:123456 -out ca_rsa_private.pem 2048
# openssl req -new -x509 -days 365 -key ca_rsa_private.pem -passin pass:123456 -out ca.crt -subj "/C=CN/ST=GD/L=SZ/O=COM/OU=NSP/CN=CA/[email protected]"

# Server certificate and key generation method 1 - directly generate server key and certificate to be signed # If you do not need to enter a password when reading the private key file server_rsa_private.pem in the future, that is, do not encrypt and store the private key, then replace -passout pass:server with -nodes
openssl req -newkey rsa:2048 -passout pass:server -keyout server_rsa_private.pem -out server.csr -subj "/C=CN/ST=GD/L=SZ/O=COM/OU=NSP/CN=SERVER/[email protected]"
# Server certificate and key generation method 2 -- Generate server key and certificate to be signed step by step# openssl genrsa -aes256 -passout pass:server -out server_rsa_private.pem 2048
# openssl req -new -key server_rsa_private.pem -passin pass:server -out server.csr -subj "/C=CN/ST=GD/L=SZ/O=COM/OU=NSP/CN=SERVER/[email protected]"
# Use the CA certificate and key to sign the server certificate:
openssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkey ca_rsa_private.pem -passin pass:123456 -CAcreateserial -out server.crt
# Convert the encrypted RSA key to an unencrypted RSA key to avoid requiring the decryption password every time it is read. # The password is the passout set when generating the private key file and the passin to be entered when reading the private key file. For example, enter "server" here.
openssl rsa -in server_rsa_private.pem -out server_rsa_private.pem.unsecure

# Method 1 for generating client certificate and key: directly generate client key and certificate to be signed # If you do not need to enter a password when reading the private key file client_rsa_private.pem in the future, that is, do not encrypt and store the private key, then replace -passout pass:client with -nodes
openssl req -newkey rsa:2048 -passout pass:client -keyout client_rsa_private.pem -out client.csr -subj "/C=CN/ST=GD/L=SZ/O=COM/OU=NSP/CN=CLIENT/[email protected]"
# Method 2 for generating client certificate and key: Generate client key and certificate to be signed step by step:
# openssl genrsa -aes256 -passout pass:client -out client_rsa_private.pem 2048
# openssl req -new -key client_rsa_private.pem -passin pass:client -out client.csr -subj "/C=CN/ST=GD/L=SZ/O=COM/OU=NSP/CN=CLIENT/[email protected]"
# Use the CA certificate and key to sign the client certificate:
openssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkey ca_rsa_private.pem -passin pass:123456 -CAcreateserial -out client.crt
# Convert the encrypted RSA key to an unencrypted RSA key to avoid requiring the decryption password every time it is read. # The password is the passout set when generating the private key file and the passin to be entered when reading the private key file. For example, enter "client" here.
openssl rsa -in client_rsa_private.pem -out client_rsa_private.pem.unsecure