OpenSSL, public keys and private keys

I recently experimented with the OpenSSL API in C, and I'm confused by some customization features, as well as some concepts in public key cryptography in general.

In general, I understand how public key cryptography works. You have a public key that is accessible to everyone, and then both the server and the client have a secret key that is needed to decrypt messages.

However, I'm a little confused when you really need a public key. Can a web browser need a public key? I would not have thought, since it seems that in most cases of use only the server (and not the client) needs a public key. If the server and client have a public key, which one is used?

Adding to my confusion, the fact is that the OpenSSL API defines a function SSL_CTX_use_PrivateKey_file(), but there is no corresponding one SSL_CTX_use_PublicKey_file(). In my experiments, I wrote a simple web client that connects to an https site and uploads a file. It works great, and no public key is required. I simply created the private key using the OpenSSL command line tools and then called SSL_CTX_use_PrivateKey_file()in my program.

But, if I wrote the server, unlike the client, I do not need a public key? And if so, why don't I see anything like it use_PublicKey_filein the OpenSSL API?

+3
source share
4 answers

TLS/SSL , - . ( ), .

, ( ) - - , , . - .

, - . SSL_CTX_use_certificate() - . - SSL_CTX_use_PrivateKey_file().

+1

, , .

OpenSSL C, , , . , , -, , tls ( ).

, HTTPS , . , , .

TLS RFC .

0

- , - . - WHICH-, .

"" ( ) SSL- , . , , , . , , , , - ( ). CA ( ). "" ( ) . , .

SSL- ( ) .

0

. , , , .

As a client, you will use a certificate to get the server’s public key SSL_CTX_use_certificate_file. The certificate contains a public key and is usually verified by a trusted certificate certificate. This guarantees the client the authenticity of the server if you trust the issuer of the certificate. Web browsers come with a set of trusted certificate certificates so that they can verify the certificates that they will download.

-1
source

All Articles