From: Daniel Danopia <danopia@...>
Date: 2009-10-21T07:20:08+09:00
Subject: Re: Certificate hashes using Base64, DER, ASN.1, PkiPath...

It seems like the hardest part is that it gives a hash. I think I'm
going to add some debug code into the Java and print out a Base64 pre-
hashing to see what is going on.

On Oct 20, 3:59 am, Brian Candler <b.cand...@pobox.com> wrote:
> Daniel Danopia wrote:
> >> it wants a Base64 encoding (I got that
> > part) of a PkiPath of a DER-encoded cert chain. I can't figure out how
> > to generate the last two in Ruby.
>
> Do you have a test case you can share - i.e. an actual certificate in
> PEM format, together with the corresponding hash?
>
> Ruby provides a very thin layer on top of OpenSSL's API, so if you can
> answer the question for openssl you can probably do it in Ruby.
>
> Googling for "openssl pkipath" I found this, which at least defines the
> pkipath:http://marc.info/?l=openssl-users&m=109655589300276&w=2
>
> Encoding an ASN1 'Sequence' is fairly straightforward, and so is
> converting it to DER.
>
> >> OpenSSL::ASN1::Sequence.new([OpenSSL::ASN1::IA5String.new("hello"), OpenSSL::ASN1::IA5String.new("world")]).to_der
>
> => "0\016\026\005hello\026\005world"
>
> So my first attempt would be something along the lines of:
>
> >> c1 = OpenSSL::X509::Certificate.new(File.read("/etc/ssl/certs/Verisign_Class_1_Public_Primary_Certification_Authority.pem"))
> >> c2 = OpenSSL::X509::Certificate.new(File.read("/etc/ssl/certs/Verisign_Class_1_Public_Primary_Certification_Authority_-_G3.pem"))
> >> OpenSSL::ASN1::Sequence.new([c1,c2])
>
> If you have the source code to the Java libraries referred to in the
> example code, that may help too.
> --
> Posted viahttp://www.ruby-forum.com/.