Add verify() to CertificateChain.

2 files changed, 55 insertions, 0 deletions

diff --git a/src/certificates.cc b/src/certificates.cc
index 0a0393c6..b6e45c0e 100644
--- a/src/certificates.cc
+++ b/src/certificates.cc
@@ -324,3 +324,52 @@ CertificateChain::add (shared_ptr<Certificate> c)
 {
 	_certificates.push_back (c);
 }
+
+/** Verify the chain.
+ *  @return true if it's ok, false if not.
+ */
+bool
+CertificateChain::verify () const
+{
+	X509_STORE* store = X509_STORE_new ();
+	if (!store) {
+		return false;
+	}
+	
+	for (list<shared_ptr<Certificate> >::const_iterator i = _certificates.begin(); i != _certificates.end(); ++i) {
+		list<shared_ptr<Certificate> >::const_iterator j = i;
+		++j;
+		if (j ==  _certificates.end ()) {
+			break;
+		}
+
+		if (!X509_STORE_add_cert (store, (*i)->x509 ())) {
+			X509_STORE_free (store);
+			return false;
+		}
+
+		X509_STORE_CTX* ctx = X509_STORE_CTX_new ();
+		if (!ctx) {
+			X509_STORE_free (store);
+			return false;
+		}
+
+		X509_STORE_set_flags (store, 0);
+		if (!X509_STORE_CTX_init (ctx, store, (*j)->x509 (), 0)) {
+			X509_STORE_CTX_free (ctx);
+			X509_STORE_free (store);
+			return false;
+		}
+
+		int v = X509_verify_cert (ctx);
+		X509_STORE_CTX_free (ctx);
+
+		if (v == 0) {
+			X509_STORE_free (store);
+			return false;
+		}
+	}
+
+	X509_STORE_free (store);
+	return true;
+}
diff --git a/src/certificates.h b/src/certificates.h
index 96a8cbb7..5a2b9324 100644
--- a/src/certificates.h
+++ b/src/certificates.h
@@ -65,6 +65,10 @@ public:
 	std::string subject () const;
 	std::string common_name () const;
 
+	X509* x509 () const {
+		return _certificate;
+	}
+
 	RSA* public_key () const;
 
 	std::string thumbprint () const;
@@ -95,6 +99,8 @@ public:
 
 	std::list<boost::shared_ptr<Certificate> > leaf_to_root () const;
 
+	bool verify () const;
+
 private:
 	friend class ::certificates;
 	std::list<boost::shared_ptr<Certificate> > _certificates;