How can you extract individual OIDs from a certificate with mbedtls?

Question

I have a x509 certificate loaded into mbedtls and I can get the entire subject field via:

mbedtls_x509_dn_gets(p, n, cert.subject);

It is possible to string tokenize the output to extract the particular fields but this seems error prone.

Is there an easy way to get individual OID values of this field, such as the CN or OU entries?

score 2 · Accepted Answer · answered Jul 22 '18 at 19:12

Usage:

const mbedtls_x509_name *name = &cert_ctx.subject;
char value[64];
size_t value_len;

value_len = find_oid_value_in_name(name, "CN", value, sizeof(value));
if(value_len)
{
    printf("CN: %s\n", value);
} else
{
    printf("Unable to find OID\n");
}

Function:

size_t find_oid_value_in_name(const mbedtls_x509_name *name, const char* target_short_name, char *value, size_t value_length)
{
    const char* short_name = NULL;
    bool found = false;
    size_t retval = 0;

    while((name != NULL) && !found)
    {
        // if there is no data for this name go to the next one
        if(!name->oid.p)
        {
            name = name->next;
            continue;
        }

        int ret = mbedtls_oid_get_attr_short_name(&name->oid, &short_name);
        if((ret == 0) && (strcmp(short_name, target_short_name) == 0))
        {
            found = true;
        }

        if(found)
        {
            size_t bytes_to_write = (name->val.len >= value_length) ? value_length - 1 : name->val.len;

            for(size_t i = 0; i < bytes_to_write; i++)
            {
                char c = name->val.p[i];
                if( c < 32 || c == 127 || ( c > 128 && c < 160 ) )
                {
                    value[i] = '?';
                } else
                {
                    value[i] = c;
                }
            }

            // null terminate
            value[bytes_to_write] = 0;

            retval = name->val.len;
        }

        name = name->next;
    }

    return retval;
}

Florian Weimer · Answer 2 · 2018-07-20T15:26:47.967

0

Doesn't mbedtls_x509_dn_gets work on a parsed ASN.1 structure, of type mbedtls_asn1_named_data? You should be able to iterate through that until you find the OID you are interested in. You can use the function mbedtls_asn1_find_named_data to automate this.

edited Jul 20 '18 at 15:26

answered Jul 20 '18 at 13:45

Florian Weimer

32,022
3
48
92

mbedtls_x509_dn_gets() stores in a printable form btw, not asn1_named_data, https://tls.mbed.org/api/x509_8h.html – Chris Morgan Jul 20 '18 at 15:25
Sorry for the confusing wording. If you already have the parsed DN, can't you manipulate it directly? – Florian Weimer Jul 20 '18 at 15:27
Do you mean extract the fields with string tokenizing or something else? – Chris Morgan Jul 20 '18 at 18:22
I mean working with the `dn` argument directly, and not calling `mbedtls_x509_dn_gets` at all to convert the DN to a string. Maybe it's clearer if you can give us the exact OID for which you want to extract data? – Florian Weimer Jul 20 '18 at 18:59
Sure, I'd like to extract CN, O, and OU entries. – Chris Morgan Jul 20 '18 at 19:18

How can you extract individual OIDs from a certificate with mbedtls?

2 Answers2