在带有axTLS的libCurl中出现错误"Invalid X509 ASN.1 file“

Question

我在一个嵌入式项目中使用带有axTLS (http://sourceforge.net/projects/axtls/files/1.5.3/ )的libCurl。

在编译axTLS时，我对SSL使用了以下配置：

#
# SSL Library
#
# CONFIG_SSL_SERVER_ONLY is not set
# CONFIG_SSL_CERT_VERIFICATION is not set
# CONFIG_SSL_ENABLE_CLIENT is not set
CONFIG_SSL_FULL_MODE=y
# CONFIG_SSL_SKELETON_MODE is not set
# CONFIG_SSL_PROT_LOW is not set
CONFIG_SSL_PROT_MEDIUM=y
# CONFIG_SSL_PROT_HIGH is not set
CONFIG_SSL_USE_DEFAULT_KEY=y
CONFIG_SSL_PRIVATE_KEY_LOCATION=""
CONFIG_SSL_PRIVATE_KEY_PASSWORD=""
CONFIG_SSL_X509_CERT_LOCATION=""
# CONFIG_SSL_GENERATE_X509_CERT is not set
CONFIG_SSL_X509_COMMON_NAME=""
CONFIG_SSL_X509_ORGANIZATION_NAME=""
CONFIG_SSL_X509_ORGANIZATION_UNIT_NAME=""
CONFIG_SSL_ENABLE_V23_HANDSHAKE=y
CONFIG_SSL_HAS_PEM=y
CONFIG_SSL_USE_PKCS12=y
CONFIG_SSL_EXPIRY_TIME=""
CONFIG_X509_MAX_CA_CERTS=""
CONFIG_SSL_MAX_CERTS=3
CONFIG_SSL_CTX_MUTEXING=y
CONFIG_USE_DEV_URANDOM=y
# CONFIG_WIN32_USE_CRYPTO_LIB is not set
CONFIG_OPENSSL_COMPATIBLE=y
# CONFIG_PERFORMANCE_TESTING is not set
# CONFIG_SSL_TEST is not set
CONFIG_AXTLSWRAP=y
CONFIG_AXHTTPD=y

当我尝试使用HTTPS下载文件时，我收到以下错误：

invalid digest: 2a 86 48 ce 3d 04 03 03 
Error: Invalid X509 ASN.1 file (Unsupported digest)
invalid digest: 2a 86 48 ce 3d 04 03 03 
Error: Invalid X509 ASN.1 file (Unsupported digest)
invalid digest: 2a 86 48 ce 3d 04 03 03 
Error: Invalid X509 ASN.1 file (Unsupported digest)
invalid digest: 2a 86 48 ce 3d 04 03 03 
Error: Invalid X509 ASN.1 file (Unsupported digest)
invalid digest: 2a 86 48 ce 3d 04 03 03 
Error: Invalid X509 ASN.1 file (Unsupported digest)
invalid digest: 2a 86 48 ce 3d 04 03 03 
Error: Invalid X509 ASN.1 file (Unsupported digest)
invalid digest: 2a 86 48 ce 3d 04 03 03 
Error: Invalid X509 ASN.1 file (Unsupported digest)
Error: maximum number of CA certs added (150) - change of compile-time configuration required
Error: maximum number of CA certs added (150) - change of compile-time configuration required
Error: maximum number of CA certs added (150) - change of compile-time configuration required
Error: maximum number of CA certs added (150) - change of compile-time configuration required
Error: maximum number of CA certs added (150) - change of compile-time configuration required
Error: maximum number of CA certs added (150) - change of compile-time configuration required
Error: maximum number of CA certs added (150) - change of compile-time configuration required
Error: maximum number of CA certs added (150) - change of compile-time configuration required
Error: maximum number of CA certs added (150) - change of compile-time configuration required
Error: maximum number of CA certs added (150) - change of compile-time configuration required
Error: maximum number of CA certs added (150) - change of compile-time configuration required
Error: maximum number of CA certs added (150) - change of compile-time configuration required
Error: maximum number of CA certs added (150) - change of compile-time configuration required
Error: maximum number of CA certs added (150) - change of compile-time configuration required
Error: maximum number of CA certs added (150) - change of compile-time configuration required
Error: maximum number of CA certs added (150) - change of compile-time configuration required

为了初始化Curl的选项，我使用了以下代码：

curl_easy_setopt(curl_handle, CURLOPT_URL, MyURL);
curl_easy_setopt(curl_handle, CURLOPT_SSL_VERIFYPEER, 0L);
curl_easy_setopt(curl_handle, CURLOPT_SSL_VERIFYHOST, 0L);
curl_easy_setopt(curl_handle, CURLOPT_WRITEDATA, MyLocalFile);
curl_easy_setopt(curl_handle, CURLOPT_USERAGENT, "MyAgent");
curl_easy_perform(curl_handle);

这是一个非阻塞错误，但我的软件需要很长时间才能开始下载。但是当我创建CONFIG_SSL_GENERATE_X509_CERT=y时，错误变成了阻塞。

那么我该如何修复这个错误呢？

诚挚的问候,

Answer 1

您是否尝试过将代码中的CONFIG_X509_MAX_CA_CERTS="“更改为大于150的值？这似乎就是错误所表明的。如果您知道您有多少个CA证书，则可以将其设置为更高的数字。