[PATCH pve-common v2 02/16] certificate: add helper to verify that a certificate was signed by a ca

[Shannon Sterz <s.sterz@proxmox.com>]

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 src/PVE/Certificate.pm | 46 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/src/PVE/Certificate.pm b/src/PVE/Certificate.pm
index b8415e2..91b3c4d 100644
--- a/src/PVE/Certificate.pm
+++ b/src/PVE/Certificate.pm
@@ -260,6 +260,52 @@ sub assert_certificate_matches_key {
     return 1;
 }
 
+=head3 check_certificate_signed_by_ca()
+
+Checks whether the certificate at C<$cert_path> is signed by the CA certificate
+located at C<$ca_path>.
+
+=cut
+
+sub check_certificate_signed_by_ca {
+    my ($cert_path, $ca_path) = @_;
+    my @cleanup;
+
+    my $result = eval {
+        my $ca_cert = $read_certificate->($ca_path);
+        push @cleanup, sub { Net::SSLeay::X509_free($ca_cert) };
+
+        my $cert = $read_certificate->($cert_path);
+        push @cleanup, sub { Net::SSLeay::X509_free($cert) };
+
+        my $store = Net::SSLeay::X509_STORE_new()
+            or ssl_die("Could not create an SSL store to check if ca signed certificate");
+        push @cleanup, sub { Net::SSLeay::X509_STORE_free($store) };
+
+        Net::SSLeay::X509_STORE_add_cert($store, $ca_cert)
+            or ssl_die("Could not load ca certificate into context.");
+
+        my $ctx = Net::SSLeay::X509_STORE_CTX_new()
+            or ssl_die("Could not create an SSL context to check if ca signed certificate");
+        push @cleanup, sub { Net::SSLeay::X509_STORE_CTX_free($ctx) };
+
+        Net::SSLeay::X509_STORE_CTX_init($ctx, $store, $cert, 0)
+            or ssl_die("Could not initialize an SSL context to check if ca signed certificate");
+
+        Net::SSLeay::X509_verify_cert($ctx);
+    };
+
+    my $err = $@;
+
+    while (my $cleanup_fn = pop @cleanup) {
+        $cleanup_fn->();
+    }
+
+    die $err if $err;
+
+    return $result == 1;
+}
+
 sub get_certificate_info {
     my ($cert_path) = @_;
 
-- 
2.47.3