Search code examples
csslopensslrsax509

Openssl how to find out what the bit size of the public key in an X509 certificate is

If I have an X509* that openssl has provided me, what's the best way to figure out the bit-ness of the RSA public key in the certificate? I can't quite figure this out. I'm pretty sure that if I'm in the SSL certificate verification callback, I can get the X509 ptr with

X509 * cert = X509_STORE_CTX_get_current_cert(the_x509_store_ctx);

and I would surmise I get the public key like this

EVP_PKEY *public_key = X509_get_pubkey(cert);

and then I need to check whether it's RSA, presumably?

if (public_key && (EVP_PKEY_RSA == public_key->type))

and once I know that I got a public key back and that it's RSA, I'd like to do this:

int key_length = BN_num_bits(public_key->pkey.rsa->n);

but I've found that while this works quite nicely on openssl 0.9.8, on 1.0.1h it segfaults on Windows. The BIGNUM 'n' doesn't seem to be valid - the data ptr in it has a garbage pointer.

Any idea what's wrong?

Solution

  • As already suggested, to get the RSA modulus size in bytes (so not "bit size"...) use:

    EVP_PKEY * public_key = X509_get_pubkey(cert);
RSA *rsa_key = EVP_PKEY_get1_RSA(public_key);
int key_length = RSA_size(rsa_key);
...
RSA_free(rsa_key);