Zilog EZ80F91AZA - Manual (Page 56)

UM020107-1211 SSL Configuration
ZTP Network Security SSL Plug-In
User Manual
50
The SSL protocol layer internally sets the SSL_X509_TRUSTED flag on all certificates that
it implicitly trusts, or on those certificates for which the VerifyCertificate callback
function returns SSL_SUCCESS .
The ZTP Network Security SSL Plug-In does not check if the certificate has been revoked. No
attempt is made to contact certificate issuers and obtain a list of certificates that have been revoked.
If this functionality is required, it must be implemented within the
VerifyCertificate callback
function.
Verifying All Certificates
In some instances, it is useful to examine all certificates – even those that the SSL layer
implicitly trusts (i.e., the
SSL_X509_TRUSTED flag is set), especially if the application
must perform additional integrity checks on the certificate beyond the basic verification
performed in the SSL library. For example, the application can obtain the issuer’s certifi-
cate revocation list (CRL) to determine if an otherwise-valid certificate should be rejected.
To force the VerifyCertificate callback to be called for all certificates processed by
the SSL handshake protocols, set the value of the SSL_PresentAllCertificates con-
figuration variable to TRUE. This variable is located in the ssl_conf.c configuration
file. Its default definition is shown in the following code fragment:
SSL_BOOL SSL_PresentAllCertificates = FALSE;
Signature Verification
A digital signature provides a mechanism that allows an entity to verify that another entity
was the originator of a specific piece of digital information. This verification establishes
the authenticity of the information. To generate a signature, the information is typically
hashed into a fixed-sized quantity using a digest algorithm, and then subjected to a public
key operation using the signatory’s private key.
Any other entity possessing the signatory’s public key can then perform the complemen-
tary public key operation using the signatory’s public key and compare the recovered
digest to a locally-generated digest of the same piece of information. If these digests are
identical, the information is deemed authentic; i.e., the signatory’s private key has not
been compromised. If the key remains secure, then by the nature of the asymmetric public
key algorithm, it is extremely unlikely that an attacker could forge the signature on an
altered block of information.
All X.509 certificates used by SSL must be signed by an issuer. By verifying the signature
on a certificate, the recipient can be relatively certain that the certificate is accurate and
identical to the information that the issuer originally signed. If it can be proven (via an
Note: