From: Magnus Bodin <magnus@...>
Date: 2005-03-22T04:10:09+09:00
Subject: OpenSSL::X509 hash mystifications


When doing peer certificate verifications, one should save the ca_certs
in the ca_path in a filename that matches the "hash" of the ca_cert with
the extension '.0'. This works ONLY if you calculate the hash from the
commandline. HOW DO YOU calculate the 'correct' hash from ruby? 

Doing the hash-calculation on the commandline like this
	openssl x509 -hash -in ca_cert.pem

gives the result '4890865b'. Saving the cert as '4890865b.0' in the
ca_path works fine when doing verify peer.

But. Calculating the hash from ruby does not give the same answer.

cert = cert = OpenSSL::X509::Certificate.new File.read("ca_cert.pem")

puts cert.hash        gives              3237948
printf "%x\n",cert.hash gives             31683c
puts cert.to_der.hash gives           1024038690
printf "%x\n",cert.to_der.hash gives    3d099722
puts cert.to_pem.hash gives            583322971
printf "%x\n",cert.to_pem.hash gives    22c4cd5b

So. Which hash am I supposed to calculate in ruby that gives 4890865b?

-----BEGIN CERTIFICATE-----
MIID0DCCArigAwIBAgIBADANBgkqhkiG9w0BAQUFADA8MQswCQYDVQQGEwJVUzEN
MAsGA1UECgwEbnNmdzERMA8GA1UECwwIbnNmdy5zY2ExCzAJBgNVBAMMAkNBMB4X
DTA1MDMyMTE2MDYyNloXDTEwMDMyMTE2MDYyNlowPDELMAkGA1UEBhMCVVMxDTAL
BgNVBAoMBG5zZncxETAPBgNVBAsMCG5zZncuc2NhMQswCQYDVQQDDAJDQTCCASIw
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALaGZXzsf5xsyZZhT6SD2SD5R19W
UD8yuETMR2PfQ8X4Mrb30EDOOzyGGfQHYWziiM2gQDUIcv1SwTx/5FI5fTALY+pH
+edZchM+XaNLR7YeB5Hcv8fxU3nXNl76RM6ZZeM9lZ88JgRtlAYxMe6OWqMW+Ix2
snxch3owLgakvq7PQW5LPHD7JFiFOa3zo76ufrrJrooc1+6G91LqS4I1wLVyJ4KB
ljxRxUC+xw18sTlwx1tTBzuoT46eRSm6WkXqkIZSKma5KOE5CRKdDAw7LELZv13d
cxGwohX/CN8AznYiIaZ/6YH1Lsa5e4CAochIAq+4Ilr9wGYUgPbxCOmOxcsCAwEA
AaOB3DCB2TAPBgNVHRMBAf8EBTADAQH/MDEGCWCGSAGG+EIBDQQkFiJSdWJ5L09w
ZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBTc6Acd1pSILACY
cEy99uNrILEMIDAOBgNVHQ8BAf8EBAMCAQYwZAYDVR0jBF0wW4AU3OgHHdaUiCwA
mHBMvfbjayCxDCChQKQ+MDwxCzAJBgNVBAYTAlVTMQ0wCwYDVQQKDARuc2Z3MREw
DwYDVQQLDAhuc2Z3LnNjYTELMAkGA1UEAwwCQ0GCAQAwDQYJKoZIhvcNAQEFBQAD
ggEBAFr1e8/TgwCF8/a+D8ZKH97Wj5T6mP9qI1puANCle3tgowCKSm/0LN7wKCmy
HmtWOFfdKdOoApY53i+sB/SaElXBMef3a452k4rt2J3LMoSMtdFRG0VyyQBwkU7y
npQlO3SMtt/pj65k9ymKXVihT84PzuNh51G17Pd9cVqzPkguRvqNwzenXb9ycA8e
ugWy9zscuyEzQocjhzATTWDl8IJEwz3ygEciPmMrF48Oo0/Kn4r+Gw5FZB93bXqm
UsHLI1K/YqEJoEJ2R20COiCH+B7dCu6lnXSikbYTFOkxsrRS5Dqp5RhDruDMrUH4
GJJc4Ix4estT601xChOWfteC4Gg=
-----END CERTIFICATE-----

-- magnus