[PR #197] [MERGED] Add CA certificate authentication to TcpSocket and SSL class #223

New issue

Closed

opened 2026-05-05 03:43:18 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 03:43:18 -06:00

Owner

📋 Pull Request Information

Original PR: https://github.com/ultimatepp/ultimatepp/pull/197
Author: @zouqinglei
Created: 4/17/2024
Status: ✅ Merged
Merged: 4/21/2024
Merged by: @mirek-fidler

Base: master ← Head: master

📝 Commits (3)

c75c7df Add CA certificate authentication to TcpSocket Class
b8db73b Add CA certificate authentication to TcpSocket Class
9d61ebd update code review of Add CA certificate authentication

📊 Changes

5 files changed (+44 additions, -0 deletions)

View changed files

📝 uppsrc/Core/Inet.h (+4 -0)
📝 uppsrc/Core/SSL/SSL.h (+2 -0)
📝 uppsrc/Core/SSL/Socket.cpp (+16 -0)
📝 uppsrc/Core/SSL/Util.cpp (+16 -0)
📝 uppsrc/Core/Socket.cpp (+6 -0)

📄 Description

I found the HttpRequest and TcpSocket can not support CA certificate function, this may be have the mitm issue. So I add some code to TcpSocket and SSL class for slove this problem.

After the change, we can use the HttpRequest like this:

HttpRequest http;
http.Host(m_ip).Port(m_port).Post(strRequest);
http.SSL(true);
	
String cacrt = "xxxx"; //a string of PEM CA myca.crt
http.SSLCAcert(cacrt);
String strContent =  http.Execute();

if the CA cert is not the server.cert's CA ,then report an error "SSL CA invalid".

The CA and Server cert gen steps:

//1. Gen CA file. myca.key, myca.crt
openssl genrsa -aes256 -out myca.key 2048
openssl rsa -in myca.key -out myca.key
openssl req -new -x509 -days 3650 -key myca.key -out myca.crt -subj "/C=CN/ST=SD/L=YT/O=xx/OU=CA/CN=MYCA/emailAddress=youremail@xxx.com"

//2.	gen server.key and server.crt
openssl genrsa -aes256 -out server.key 2048
openssl rsa in server.key -out server.key

openssl req -new -key server.key -out server.csr -subj 
"/C=CN/ST=SD/L=YT/O=xxx/OU=RD/CN=xxx/emailAddress=youremail@xxx.com"

openssl x509 -req -days 3650 -in server.csr -CA myca.crt -CAkey myca.key -CAcreateserial -out server.crt

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/ultimatepp/ultimatepp/pull/197 **Author:** [@zouqinglei](https://github.com/zouqinglei) **Created:** 4/17/2024 **Status:** ✅ Merged **Merged:** 4/21/2024 **Merged by:** [@mirek-fidler](https://github.com/mirek-fidler) **Base:** `master` ← **Head:** `master` --- ### 📝 Commits (3) - [`c75c7df`](https://github.com/ultimatepp/ultimatepp/commit/c75c7dfcedad423f0c7a1e9b3ca7f5d493e79ad3) Add CA certificate authentication to TcpSocket Class - [`b8db73b`](https://github.com/ultimatepp/ultimatepp/commit/b8db73b735f823bf1cfb767c8cf86f1af2090ef0) Add CA certificate authentication to TcpSocket Class - [`9d61ebd`](https://github.com/ultimatepp/ultimatepp/commit/9d61ebd719f105716f9d4390b0ab032f0aa30fc8) update code review of Add CA certificate authentication ### 📊 Changes **5 files changed** (+44 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `uppsrc/Core/Inet.h` (+4 -0) 📝 `uppsrc/Core/SSL/SSL.h` (+2 -0) 📝 `uppsrc/Core/SSL/Socket.cpp` (+16 -0) 📝 `uppsrc/Core/SSL/Util.cpp` (+16 -0) 📝 `uppsrc/Core/Socket.cpp` (+6 -0) </details> ### 📄 Description I found the HttpRequest and TcpSocket can not support CA certificate function, this may be have the mitm issue. So I add some code to TcpSocket and SSL class for slove this problem. After the change, we can use the HttpRequest like this: ``` HttpRequest http; http.Host(m_ip).Port(m_port).Post(strRequest); http.SSL(true); String cacrt = "xxxx"; //a string of PEM CA myca.crt http.SSLCAcert(cacrt); String strContent = http.Execute(); ``` if the CA cert is not the server.cert's CA ,then report an error "SSL CA invalid". The CA and Server cert gen steps: ``` //1. Gen CA file. myca.key, myca.crt openssl genrsa -aes256 -out myca.key 2048 openssl rsa -in myca.key -out myca.key openssl req -new -x509 -days 3650 -key myca.key -out myca.crt -subj "/C=CN/ST=SD/L=YT/O=xx/OU=CA/CN=MYCA/emailAddress=youremail@xxx.com" //2. gen server.key and server.crt openssl genrsa -aes256 -out server.key 2048 openssl rsa in server.key -out server.key openssl req -new -key server.key -out server.csr -subj "/C=CN/ST=SD/L=YT/O=xxx/OU=RD/CN=xxx/emailAddress=youremail@xxx.com" openssl x509 -req -days 3650 -in server.csr -CA myca.crt -CAkey myca.key -CAcreateserial -out server.crt ``` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>