x509_crt_verify_child方法里用到的这四个方法如果返回值不为0,分别表示什么意思？ 1 mbedtls_x509_time_is_future(&child->valid_from); 2 x509_profile_check_md_alg(profile, child->sig_md); 3 x509_profile_check_pk_alg(profile, child->sig_pk); 4 x509_profile_check_key(profile, child->sig_p

返回值和所代表的意思分别是：

 1.MBEDTLS_X509_BADCERT_FUTURE /**< The certificate validity starts in the future. */   
 2.MBEDTLS_X509_BADCERT_BAD_MD   /**< The certificate is signed with an unacceptable hash. */   
 3.MBEDTLS_X509_BADCERT_BAD_PK/**< The certificate is signed with an unacceptable PK alg (eg RSA vs ECDSA). */      
 4. MBEDTLS_X509_BADCERT_BAD_KEY    /**< The certificate is signed with an unacceptable key (eg bad curve, RSA too short). */

这些都是用于传输层和应用层之间的加密的功能，比如你说的X509是权威机构CA颁发的认证，你那边客户端可以联网上CA确认你连的是不是真正的阿里的服务器。有兴趣可以参考http://freeloda.blog.51cto.com/2033581/1216176