src/qt/paymentserver.cpp
void PaymentServer::LoadRootCAs(X509_STORE* _store)
{
    if (PaymentServer::certStore == NULL)
        atexit(PaymentServer::freeCertStore);
    else
        freeCertStore();

    // Unit tests mostly use this, to pass in fake root CAs:
    if (_store)
    {
        PaymentServer::certStore = _store;
        return;
    }

    // Normal execution, use either -rootcertificates or system certs:
    PaymentServer::certStore = X509_STORE_new();

    // Note: use "-system-" default here so that users can pass -rootcertificates=""
    // and get 'I don't like X.509 certificates, don't trust anybody' behavior:
    QString certFile = QString::fromStdString(GetArg("-rootcertificates", "-system-"));

    if (certFile.isEmpty())
        return; // Empty store

    QList<QSslCertificate> certList;

    if (certFile != "-system-")
    {
        certList = QSslCertificate::fromPath(certFile);
        // Use those certificates when fetching payment requests, too:
        QSslSocket::setDefaultCaCertificates(certList);
    }
    else
        certList = QSslSocket::systemCaCertificates ();

    int nRootCerts = 0;
    const QDateTime currentTime = QDateTime::currentDateTime();
    foreach (const QSslCertificate& cert, certList)
    {
        if (currentTime < cert.effectiveDate() || currentTime > cert.expiryDate()) {
            ReportInvalidCertificate(cert);
            continue;
        }
#if QT_VERSION >= 0x050000
        if (cert.isBlacklisted()) {
            ReportInvalidCertificate(cert);
            continue;
        }
#endif
        QByteArray certData = cert.toDer();
        const unsigned char *data = (const unsigned char *)certData.data();

        X509* x509 = d2i_X509(0, &data, certData.size());
        if (x509 && X509_STORE_add_cert(PaymentServer::certStore, x509))
        {
            // Note: X509_STORE_free will free the X509* objects when
            // the PaymentServer is destroyed
            ++nRootCerts;
        }
        else
        {
            ReportInvalidCertificate(cert);
            continue;
        }
    }
    qWarning() << "PaymentServer::LoadRootCAs : Loaded " << nRootCerts << " root certificates";

    // Project for another day:
    // Fetch certificate revocation lists, and add them to certStore.
    // Issues to consider:
    //   performance (start a thread to fetch in background?)
    //   privacy (fetch through tor/proxy so IP address isn't revealed)
    //   would it be easier to just use a compiled-in blacklist?
    //    or use Qt's blacklist?
    //   "certificate stapling" with server-side caching is more efficient
}
//
// Load OpenSSL's list of root certificate authorities
//
Load OpenSSL's list of root certificate authorities
Load OpenSSL ' s list of root certificate authorities
void PaymentServer::LoadRootCAs(X509_STORE* _store)
{
    if (PaymentServer::certStore == NULL)
        atexit(PaymentServer::freeCertStore);
    else
        freeCertStore();
    if (_store)
    {
        PaymentServer::certStore = _store;
        return;
    }
    PaymentServer::certStore = X509_STORE_new();
    QString certFile = QString::fromStdString(GetArg("-rootcertificates", "-system-"));
    if (certFile.isEmpty())
        return; 
    QList<QSslCertificate> certList;
    if (certFile != "-system-")
    {
        certList = QSslCertificate::fromPath(certFile);
        QSslSocket::setDefaultCaCertificates(certList);
    }
    else
        certList = QSslSocket::systemCaCertificates ();
    int nRootCerts = 0;
    const QDateTime currentTime = QDateTime::currentDateTime();
    foreach (const QSslCertificate& cert, certList)
    {
        if (currentTime < cert.effectiveDate() || currentTime > cert.expiryDate()) {
            ReportInvalidCertificate(cert);
            continue;
        }
#if QT_VERSION >= 0x050000
        if (cert.isBlacklisted()) {
            ReportInvalidCertificate(cert);
            continue;
        }
#endif
        QByteArray certData = cert.toDer();
        const unsigned char *data = (const unsigned char *)certData.data();
        X509* x509 = d2i_X509(0, &data, certData.size());
        if (x509 && X509_STORE_add_cert(PaymentServer::certStore, x509))
        {
            ++nRootCerts;
        }
        else
        {
            ReportInvalidCertificate(cert);
            continue;
        }
    }
    qWarning() << "PaymentServer::LoadRootCAs : Loaded " << nRootCerts << " root certificates";
}
void PaymentServer :: LoadRootCAs ( X509_STORE * _store ) { if ( PaymentServer :: certStore == NULL ) atexit ( PaymentServer :: freeCertStore ) ; else freeCertStore ( ) ; if ( _store ) { PaymentServer :: certStore = _store ; return ; } PaymentServer :: certStore = X509_STORE_new ( ) ; QString certFile = QString :: fromStdString ( GetArg ( " " , " " ) ) ; if ( certFile . isEmpty ( ) ) return ; QList < QSslCertificate > certList ; if ( certFile != " " ) { certList = QSslCertificate :: fromPath ( certFile ) ; QSslSocket :: setDefaultCaCertificates ( certList ) ; } else certList = QSslSocket :: systemCaCertificates ( ) ; int nRootCerts = 0 ; const QDateTime currentTime = QDateTime :: currentDateTime ( ) ; foreach ( const QSslCertificate & cert , certList ) { if ( currentTime < cert . effectiveDate ( ) || currentTime > cert . expiryDate ( ) ) { ReportInvalidCertificate ( cert ) ; continue ; } #if QT_VERSION >= 0x050000 if ( cert . isBlacklisted ( ) ) { ReportInvalidCertificate ( cert ) ; continue ; } #endif QByteArray certData = cert . toDer ( ) ; const unsigned char * data = ( const unsigned char * ) certData . data ( ) ; X509 * x509 = d2i_X509 ( 0 , & data , certData . size ( ) ) ; if ( x509 && X509_STORE_add_cert ( PaymentServer :: certStore , x509 ) ) { ++ nRootCerts ; } else { ReportInvalidCertificate ( cert ) ; continue ; } } qWarning ( ) << " " << nRootCerts << " " ; }
Load OpenSSL's list of root certificate authorities
Load OpenSSL ' s list of root certificate authorities
// Unit tests mostly use this, to pass in fake root CAs: // Normal execution, use either -rootcertificates or system certs: // Note: use "-system-" default here so that users can pass -rootcertificates="" // and get 'I don't like X.509 certificates, don't trust anybody' behavior: // Empty store // Use those certificates when fetching payment requests, too: // Note: X509_STORE_free will free the X509* objects when // the PaymentServer is destroyed // Project for another day: // Fetch certificate revocation lists, and add them to certStore. // Issues to consider: //   performance (start a thread to fetch in background?) //   privacy (fetch through tor/proxy so IP address isn't revealed) //   would it be easier to just use a compiled-in blacklist? //    or use Qt's blacklist? //   "certificate stapling" with server-side caching is more efficient