国密SM2申请证书格式问题

国密证书摘要需要使用 SM3 算法，
修改  `x509/cert_req.c` 第 154 行 将 MBEDTLS_MD_SHA256 改为 MBEDTLS_MD_SM3
`mbedtls_x509write_csr_set_md_alg( &req, MBEDTLS_MD_SM3 );`

执行命令
```bash
$gen_key type=ec ec_curve=sm2p256r1 filename=privkey.pem format=pem
$cert_req filename=privkey.pem subject_name=CN=Bob,O=security,C=china output_file=cert.req pk_alg=sm2
```
此时生成国密申请证书 `cert.req`
查看证书内容：
```bash
openssl req -in cert.req -text -noout
Certificate Request:
    Data:
        Version: 1 (0x0)
        Subject: CN = Bob, O = security, C = china
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:29:2d:a5:f1:e1:62:74:a9:7d:ff:ff:ff:af:1f:
                    f9:8a:2b:c2:fc:02:ef:55:a3:36:64:4b:42:c8:27:
                    be:40:c8:ed:dd:98:cd:09:76:4b:98:75:69:fb:b3:
                    a2:82:59:dc:35:62:af:15:0e:df:99:20:e0:e7:33:
                    40:37:47:44:92
                ASN1 OID: SM2
        Attributes:
            a0:00
    Signature Algorithm: 1.2.156.10197.1.501
         a2:2c:94:bd:c2:30:13:c6:4e:4a:49:74:7e:33:61:ad:e4:e7:
         03:18:54:f6:ea:59:c6:da:64:6f:52:cf:67:4f:dd:c1:a8:65:
         45:92:0f:6b:18:44:ca:b6:f5:48:43:9f:de:dc:09:f8:ee:28:
         a3:45:ed:65:ec:c3:b3:a3:38:19
```
可以看到，signature algorithm 的 OID 是 `1.2.156.10197.1.501` 即 SM2_WITH_SM3, 是正确的。
但是 签名值是一个裸的 64 字节的坐标值，而不是 DER 格式的 BITSTRING.

Saroth/smbedtls

内容风险标识

评论 (1)

Saroth/smbedtls .gitee-modal { width: 500px !important; }

内容风险标识