1. 可以获取x509证书的ct和ev状态。2. hostname不匹配，不认为是非法证书。

platform/src/ssl_utils.cpp

@@ -1607,6 +1607,52 @@ char * ssl_x509_to_pem(X509 * crt)
 	BIO_free(bio);
 	return ret;
 }
+char* ssl_x509_get_extension(X509 *cert, int ext_NID)
+{
+	int loc=0;
+	X509_EXTENSION *ex=NULL;
+	ASN1_OBJECT *obj=NULL;
+	BUF_MEM *bptr = NULL;
+	char *buf = NULL;
+	BIO *bio=NULL;
+	char buff[1024];
+	int ret=0;
+
+	loc=X509_get_ext_by_NID(cert, ext_NID, -1);
+	if(loc<0)
+	{
+		goto leave;
+	}
+	ex = X509_get_ext(cert, loc);
+	if(ex==NULL)
+	{
+		goto leave;
+	}
+	obj = X509_EXTENSION_get_object(ex);
+	OBJ_obj2txt(buff, 1024, obj, 0);
+
+	bio = BIO_new(BIO_s_mem());
+	if (!X509V3_EXT_print(bio, ex, 0, 0))
+	{
+		fprintf(stderr, "Error in reading extensions");
+		goto leave;
+	}
+	ret=BIO_flush(bio);
+	if(ret!=1)
+	{
+		goto leave;
+	}
+	BIO_get_mem_ptr(bio, &bptr);
+
+	//bptr->data is not NULL terminated - add null character
+	buf = (char *) malloc((bptr->length + 1) * sizeof(char));
+	memcpy(buf, bptr->data, bptr->length);
+	buf[bptr->length] = '\0';
+leave:
+	BIO_free_all(bio);
+	return buf;
+}
+
 
 /*
  * Print SSL_SESSION data to a newly allocated string.