|
|
|
@@ -1,2943 +0,0 @@
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_init
|
|
|
|
|
@anchor{gnutls_x509_crl_init}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_init} (gnutls_x509_crl_t * @var{crl})
|
|
|
|
|
@var{crl}: The structure to be initialized
|
|
|
|
|
|
|
|
|
|
This function will initialize a CRL structure. CRL stands for
|
|
|
|
|
Certificate Revocation List. A revocation list usually contains
|
|
|
|
|
lists of certificate serial numbers that have been revoked
|
|
|
|
|
by an Authority. The revocation lists are always signed with
|
|
|
|
|
the authority's private key.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_deinit
|
|
|
|
|
@anchor{gnutls_x509_crl_deinit}
|
|
|
|
|
@deftypefun {void} {gnutls_x509_crl_deinit} (gnutls_x509_crl_t @var{crl})
|
|
|
|
|
@var{crl}: The structure to be initialized
|
|
|
|
|
|
|
|
|
|
This function will deinitialize a CRL structure.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_import
|
|
|
|
|
@anchor{gnutls_x509_crl_import}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_import} (gnutls_x509_crl_t @var{crl}, const gnutls_datum_t * @var{data}, gnutls_x509_crt_fmt_t @var{format})
|
|
|
|
|
@var{crl}: The structure to store the parsed CRL.
|
|
|
|
|
|
|
|
|
|
@var{data}: The DER or PEM encoded CRL.
|
|
|
|
|
|
|
|
|
|
@var{format}: One of DER or PEM
|
|
|
|
|
|
|
|
|
|
This function will convert the given DER or PEM encoded CRL
|
|
|
|
|
to the native gnutls_x509_crl_t format. The output will be stored in 'crl'.
|
|
|
|
|
|
|
|
|
|
If the CRL is PEM encoded it should have a header of "X509 CRL".
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_get_issuer_dn
|
|
|
|
|
@anchor{gnutls_x509_crl_get_issuer_dn}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_get_issuer_dn} (const gnutls_x509_crl_t @var{crl}, char * @var{buf}, size_t * @var{sizeof_buf})
|
|
|
|
|
@var{crl}: should contain a gnutls_x509_crl_t structure
|
|
|
|
|
|
|
|
|
|
@var{buf}: a pointer to a structure to hold the peer's name (may be null)
|
|
|
|
|
|
|
|
|
|
@var{sizeof_buf}: initially holds the size of @code{buf}
|
|
|
|
|
|
|
|
|
|
This function will copy the name of the CRL issuer in the provided buffer. The name
|
|
|
|
|
will be in the form "C=xxxx,O=yyyy,CN=zzzz" as described in RFC2253. The output
|
|
|
|
|
string will be ASCII or UTF-8 encoded, depending on the certificate data.
|
|
|
|
|
|
|
|
|
|
If buf is null then only the size will be filled.
|
|
|
|
|
|
|
|
|
|
Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not long enough, and
|
|
|
|
|
in that case the sizeof_buf will be updated with the required size, and
|
|
|
|
|
0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_get_issuer_dn_by_oid
|
|
|
|
|
@anchor{gnutls_x509_crl_get_issuer_dn_by_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_get_issuer_dn_by_oid} (gnutls_x509_crl_t @var{crl}, const char * @var{oid}, int @var{indx}, unsigned int @var{raw_flag}, void * @var{buf}, size_t * @var{sizeof_buf})
|
|
|
|
|
@var{crl}: should contain a gnutls_x509_crl_t structure
|
|
|
|
|
|
|
|
|
|
@var{oid}: holds an Object Identified in null terminated string
|
|
|
|
|
|
|
|
|
|
@var{indx}: In case multiple same OIDs exist in the RDN, this specifies which to send. Use zero to get the first one.
|
|
|
|
|
|
|
|
|
|
@var{raw_flag}: If non zero returns the raw DER data of the DN part.
|
|
|
|
|
|
|
|
|
|
@var{buf}: a pointer to a structure to hold the peer's name (may be null)
|
|
|
|
|
|
|
|
|
|
@var{sizeof_buf}: initially holds the size of @code{buf}
|
|
|
|
|
|
|
|
|
|
This function will extract the part of the name of the CRL issuer specified
|
|
|
|
|
by the given OID. The output will be encoded as described in RFC2253. The output
|
|
|
|
|
string will be ASCII or UTF-8 encoded, depending on the certificate data.
|
|
|
|
|
|
|
|
|
|
Some helper macros with popular OIDs can be found in gnutls/x509.h
|
|
|
|
|
If raw flag is zero, this function will only return known OIDs as text. Other OIDs
|
|
|
|
|
will be DER encoded, as described in RFC2253 -- in hex format with a '\#' prefix.
|
|
|
|
|
You can check about known OIDs using @code{gnutls_x509_dn_oid_known()}.
|
|
|
|
|
|
|
|
|
|
If buf is null then only the size will be filled.
|
|
|
|
|
|
|
|
|
|
Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not long enough, and
|
|
|
|
|
in that case the sizeof_buf will be updated with the required size,
|
|
|
|
|
and 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_get_dn_oid
|
|
|
|
|
@anchor{gnutls_x509_crl_get_dn_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_get_dn_oid} (gnutls_x509_crl_t @var{crl}, int @var{indx}, void * @var{oid}, size_t * @var{sizeof_oid})
|
|
|
|
|
@var{crl}: should contain a gnutls_x509_crl_t structure
|
|
|
|
|
|
|
|
|
|
@var{indx}: Specifies which DN OID to send. Use zero to get the first one.
|
|
|
|
|
|
|
|
|
|
@var{oid}: a pointer to a structure to hold the name (may be null)
|
|
|
|
|
|
|
|
|
|
@var{sizeof_oid}: initially holds the size of 'oid'
|
|
|
|
|
|
|
|
|
|
This function will extract the requested OID of the name of the CRL issuer, specified
|
|
|
|
|
by the given index.
|
|
|
|
|
|
|
|
|
|
If oid is null then only the size will be filled.
|
|
|
|
|
|
|
|
|
|
Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not long enough, and
|
|
|
|
|
in that case the sizeof_oid will be updated with the required size.
|
|
|
|
|
On success 0 is returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_get_signature_algorithm
|
|
|
|
|
@anchor{gnutls_x509_crl_get_signature_algorithm}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_get_signature_algorithm} (gnutls_x509_crl_t @var{crl})
|
|
|
|
|
@var{crl}: should contain a gnutls_x509_crl_t structure
|
|
|
|
|
|
|
|
|
|
This function will return a value of the gnutls_sign_algorithm_t enumeration that
|
|
|
|
|
is the signature algorithm.
|
|
|
|
|
|
|
|
|
|
Returns a negative value on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_get_signature
|
|
|
|
|
@anchor{gnutls_x509_crl_get_signature}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_get_signature} (gnutls_x509_crl_t @var{crl}, char * @var{sig}, size_t * @var{sizeof_sig})
|
|
|
|
|
@var{crl}: should contain a gnutls_x509_crl_t structure
|
|
|
|
|
|
|
|
|
|
@var{sig}: a pointer where the signature part will be copied (may be null).
|
|
|
|
|
|
|
|
|
|
@var{sizeof_sig}: initially holds the size of @code{sig}
|
|
|
|
|
|
|
|
|
|
This function will extract the signature field of a CRL.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success, and a negative value on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_get_version
|
|
|
|
|
@anchor{gnutls_x509_crl_get_version}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_get_version} (gnutls_x509_crl_t @var{crl})
|
|
|
|
|
@var{crl}: should contain a gnutls_x509_crl_t structure
|
|
|
|
|
|
|
|
|
|
This function will return the version of the specified CRL.
|
|
|
|
|
|
|
|
|
|
Returns a negative value on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_get_this_update
|
|
|
|
|
@anchor{gnutls_x509_crl_get_this_update}
|
|
|
|
|
@deftypefun {time_t} {gnutls_x509_crl_get_this_update} (gnutls_x509_crl_t @var{crl})
|
|
|
|
|
@var{crl}: should contain a gnutls_x509_crl_t structure
|
|
|
|
|
|
|
|
|
|
This function will return the time this CRL was issued.
|
|
|
|
|
|
|
|
|
|
Returns (time_t)-1 on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_get_next_update
|
|
|
|
|
@anchor{gnutls_x509_crl_get_next_update}
|
|
|
|
|
@deftypefun {time_t} {gnutls_x509_crl_get_next_update} (gnutls_x509_crl_t @var{crl})
|
|
|
|
|
@var{crl}: should contain a gnutls_x509_crl_t structure
|
|
|
|
|
|
|
|
|
|
This function will return the time the next CRL will be issued.
|
|
|
|
|
This field is optional in a CRL so it might be normal to get
|
|
|
|
|
an error instead.
|
|
|
|
|
|
|
|
|
|
Returns (time_t)-1 on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_get_crt_count
|
|
|
|
|
@anchor{gnutls_x509_crl_get_crt_count}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_get_crt_count} (gnutls_x509_crl_t @var{crl})
|
|
|
|
|
@var{crl}: should contain a gnutls_x509_crl_t structure
|
|
|
|
|
|
|
|
|
|
This function will return the number of revoked certificates in the
|
|
|
|
|
given CRL.
|
|
|
|
|
|
|
|
|
|
Returns a negative value on failure.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_get_crt_serial
|
|
|
|
|
@anchor{gnutls_x509_crl_get_crt_serial}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_get_crt_serial} (gnutls_x509_crl_t @var{crl}, int @var{indx}, unsigned char * @var{serial}, size_t * @var{serial_size}, time_t * @var{t})
|
|
|
|
|
@var{crl}: should contain a gnutls_x509_crl_t structure
|
|
|
|
|
|
|
|
|
|
@var{indx}: the index of the certificate to extract (starting from 0)
|
|
|
|
|
|
|
|
|
|
@var{serial}: where the serial number will be copied
|
|
|
|
|
|
|
|
|
|
@var{serial_size}: initially holds the size of serial
|
|
|
|
|
|
|
|
|
|
@var{t}: if non null, will hold the time this certificate was revoked
|
|
|
|
|
|
|
|
|
|
This function will return the serial number of the specified, by
|
|
|
|
|
the index, revoked certificate.
|
|
|
|
|
|
|
|
|
|
Returns a negative value on failure.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_export
|
|
|
|
|
@anchor{gnutls_x509_crl_export}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_export} (gnutls_x509_crl_t @var{crl}, gnutls_x509_crt_fmt_t @var{format}, void * @var{output_data}, size_t * @var{output_data_size})
|
|
|
|
|
@var{crl}: Holds the revocation list
|
|
|
|
|
|
|
|
|
|
@var{format}: the format of output params. One of PEM or DER.
|
|
|
|
|
|
|
|
|
|
@var{output_data}: will contain a private key PEM or DER encoded
|
|
|
|
|
|
|
|
|
|
@var{output_data_size}: holds the size of output_data (and will be replaced by the actual size of parameters)
|
|
|
|
|
|
|
|
|
|
This function will export the revocation list to DER or PEM format.
|
|
|
|
|
|
|
|
|
|
If the buffer provided is not long enough to hold the output, then
|
|
|
|
|
GNUTLS_E_SHORT_MEMORY_BUFFER will be returned.
|
|
|
|
|
|
|
|
|
|
If the structure is PEM encoded, it will have a header
|
|
|
|
|
of "BEGIN X509 CRL".
|
|
|
|
|
|
|
|
|
|
Returns 0 on success, and a negative value on failure.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_rdn_get
|
|
|
|
|
@anchor{gnutls_x509_rdn_get}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_rdn_get} (const gnutls_datum_t * @var{idn}, char * @var{buf}, size_t * @var{sizeof_buf})
|
|
|
|
|
@var{idn}: should contain a DER encoded RDN sequence
|
|
|
|
|
|
|
|
|
|
@var{buf}: a pointer to a structure to hold the peer's name
|
|
|
|
|
|
|
|
|
|
@var{sizeof_buf}: holds the size of @code{buf}
|
|
|
|
|
|
|
|
|
|
This function will return the name of the given RDN sequence. The
|
|
|
|
|
name will be in the form "C=xxxx,O=yyyy,CN=zzzz" as described in
|
|
|
|
|
RFC2253.
|
|
|
|
|
|
|
|
|
|
If the provided buffer is not long enough, returns
|
|
|
|
|
GNUTLS_E_SHORT_MEMORY_BUFFER and *sizeof_buf will be updated. On
|
|
|
|
|
success 0 is returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_rdn_get_by_oid
|
|
|
|
|
@anchor{gnutls_x509_rdn_get_by_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_rdn_get_by_oid} (const gnutls_datum_t * @var{idn}, const char * @var{oid}, int @var{indx}, unsigned int @var{raw_flag}, void * @var{buf}, size_t * @var{sizeof_buf})
|
|
|
|
|
@var{idn}: should contain a DER encoded RDN sequence
|
|
|
|
|
|
|
|
|
|
@var{oid}: an Object Identifier
|
|
|
|
|
|
|
|
|
|
@var{indx}: In case multiple same OIDs exist in the RDN indicates which
|
|
|
|
|
to send. Use 0 for the first one.
|
|
|
|
|
|
|
|
|
|
@var{raw_flag}: If non zero then the raw DER data are returned.
|
|
|
|
|
|
|
|
|
|
@var{buf}: a pointer to a structure to hold the peer's name
|
|
|
|
|
|
|
|
|
|
@var{sizeof_buf}: holds the size of @code{buf}
|
|
|
|
|
|
|
|
|
|
This function will return the name of the given Object identifier,
|
|
|
|
|
of the RDN sequence. The name will be encoded using the rules
|
|
|
|
|
from RFC2253.
|
|
|
|
|
|
|
|
|
|
Returns GNUTLS_E_SHORT_MEMORY_BUFFER and updates *sizeof_buf if
|
|
|
|
|
the provided buffer is not long enough, and 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_rdn_get_oid
|
|
|
|
|
@anchor{gnutls_x509_rdn_get_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_rdn_get_oid} (const gnutls_datum_t * @var{idn}, int @var{indx}, void * @var{buf}, size_t * @var{sizeof_buf})
|
|
|
|
|
@var{idn}: should contain a DER encoded RDN sequence
|
|
|
|
|
|
|
|
|
|
@var{indx}: Indicates which OID to return. Use 0 for the first one.
|
|
|
|
|
|
|
|
|
|
This function will return the specified Object identifier, of the
|
|
|
|
|
RDN sequence.
|
|
|
|
|
|
|
|
|
|
Returns GNUTLS_E_SHORT_MEMORY_BUFFER and updates *sizeof_buf if
|
|
|
|
|
the provided buffer is not long enough, and 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_dn_oid_known
|
|
|
|
|
@anchor{gnutls_x509_dn_oid_known}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_dn_oid_known} (const char * @var{oid})
|
|
|
|
|
@var{oid}: holds an Object Identifier in a null terminated string
|
|
|
|
|
|
|
|
|
|
This function will inform about known DN OIDs. This is useful since functions
|
|
|
|
|
like @code{gnutls_x509_crt_set_dn_by_oid()} use the information on known
|
|
|
|
|
OIDs to properly encode their input. Object Identifiers that are not
|
|
|
|
|
known are not encoded by these functions, and their input is stored directly
|
|
|
|
|
into the ASN.1 structure. In that case of unknown OIDs, you have
|
|
|
|
|
the responsibility of DER encoding your data.
|
|
|
|
|
|
|
|
|
|
Returns 1 on known OIDs and 0 otherwise.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_init
|
|
|
|
|
@anchor{gnutls_x509_crt_init}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_init} (gnutls_x509_crt_t * @var{cert})
|
|
|
|
|
@var{cert}: The structure to be initialized
|
|
|
|
|
|
|
|
|
|
This function will initialize an X.509 certificate structure.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_deinit
|
|
|
|
|
@anchor{gnutls_x509_crt_deinit}
|
|
|
|
|
@deftypefun {void} {gnutls_x509_crt_deinit} (gnutls_x509_crt_t @var{cert})
|
|
|
|
|
@var{cert}: The structure to be initialized
|
|
|
|
|
|
|
|
|
|
This function will deinitialize a CRL structure.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_import
|
|
|
|
|
@anchor{gnutls_x509_crt_import}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_import} (gnutls_x509_crt_t @var{cert}, const gnutls_datum_t * @var{data}, gnutls_x509_crt_fmt_t @var{format})
|
|
|
|
|
@var{cert}: The structure to store the parsed certificate.
|
|
|
|
|
|
|
|
|
|
@var{data}: The DER or PEM encoded certificate.
|
|
|
|
|
|
|
|
|
|
@var{format}: One of DER or PEM
|
|
|
|
|
|
|
|
|
|
This function will convert the given DER or PEM encoded Certificate
|
|
|
|
|
to the native gnutls_x509_crt_t format. The output will be stored in @code{cert}.
|
|
|
|
|
|
|
|
|
|
If the Certificate is PEM encoded it should have a header of "X509 CERTIFICATE", or
|
|
|
|
|
"CERTIFICATE".
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_issuer_dn
|
|
|
|
|
@anchor{gnutls_x509_crt_get_issuer_dn}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_issuer_dn} (gnutls_x509_crt_t @var{cert}, char * @var{buf}, size_t * @var{sizeof_buf})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{buf}: a pointer to a structure to hold the name (may be null)
|
|
|
|
|
|
|
|
|
|
@var{sizeof_buf}: initially holds the size of @code{buf}
|
|
|
|
|
|
|
|
|
|
This function will copy the name of the Certificate issuer in the
|
|
|
|
|
provided buffer. The name will be in the form
|
|
|
|
|
"C=xxxx,O=yyyy,CN=zzzz" as described in RFC2253. The output string
|
|
|
|
|
will be ASCII or UTF-8 encoded, depending on the certificate data.
|
|
|
|
|
|
|
|
|
|
If @code{buf} is null then only the size will be filled.
|
|
|
|
|
|
|
|
|
|
Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
|
|
|
|
|
long enough, and in that case the *sizeof_buf will be updated with
|
|
|
|
|
the required size. On success 0 is returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_issuer_dn_by_oid
|
|
|
|
|
@anchor{gnutls_x509_crt_get_issuer_dn_by_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_issuer_dn_by_oid} (gnutls_x509_crt_t @var{cert}, const char * @var{oid}, int @var{indx}, unsigned int @var{raw_flag}, void * @var{buf}, size_t * @var{sizeof_buf})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{oid}: holds an Object Identified in null terminated string
|
|
|
|
|
|
|
|
|
|
@var{indx}: In case multiple same OIDs exist in the RDN, this specifies which to send. Use zero to get the first one.
|
|
|
|
|
|
|
|
|
|
@var{raw_flag}: If non zero returns the raw DER data of the DN part.
|
|
|
|
|
|
|
|
|
|
@var{buf}: a pointer to a structure to hold the name (may be null)
|
|
|
|
|
|
|
|
|
|
@var{sizeof_buf}: initially holds the size of @code{buf}
|
|
|
|
|
|
|
|
|
|
This function will extract the part of the name of the Certificate
|
|
|
|
|
issuer specified by the given OID. The output, if the raw flag is not
|
|
|
|
|
used, will be encoded as described in RFC2253. Thus a string that is
|
|
|
|
|
ASCII or UTF-8 encoded, depending on the certificate data.
|
|
|
|
|
|
|
|
|
|
Some helper macros with popular OIDs can be found in gnutls/x509.h
|
|
|
|
|
If raw flag is zero, this function will only return known OIDs as
|
|
|
|
|
text. Other OIDs will be DER encoded, as described in RFC2253 --
|
|
|
|
|
in hex format with a '\#' prefix. You can check about known OIDs
|
|
|
|
|
using @code{gnutls_x509_dn_oid_known()}.
|
|
|
|
|
|
|
|
|
|
If @code{buf} is null then only the size will be filled.
|
|
|
|
|
|
|
|
|
|
Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
|
|
|
|
|
long enough, and in that case the *sizeof_buf will be updated with
|
|
|
|
|
the required size. On success 0 is returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_issuer_dn_oid
|
|
|
|
|
@anchor{gnutls_x509_crt_get_issuer_dn_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_issuer_dn_oid} (gnutls_x509_crt_t @var{cert}, int @var{indx}, void * @var{oid}, size_t * @var{sizeof_oid})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{indx}: This specifies which OID to return. Use zero to get the first one.
|
|
|
|
|
|
|
|
|
|
@var{oid}: a pointer to a buffer to hold the OID (may be null)
|
|
|
|
|
|
|
|
|
|
@var{sizeof_oid}: initially holds the size of @code{oid}
|
|
|
|
|
|
|
|
|
|
This function will extract the OIDs of the name of the Certificate
|
|
|
|
|
issuer specified by the given index.
|
|
|
|
|
|
|
|
|
|
If @code{oid} is null then only the size will be filled.
|
|
|
|
|
|
|
|
|
|
Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
|
|
|
|
|
long enough, and in that case the *sizeof_oid will be updated with
|
|
|
|
|
the required size. On success 0 is returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_dn
|
|
|
|
|
@anchor{gnutls_x509_crt_get_dn}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_dn} (gnutls_x509_crt_t @var{cert}, char * @var{buf}, size_t * @var{sizeof_buf})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{buf}: a pointer to a structure to hold the name (may be null)
|
|
|
|
|
|
|
|
|
|
@var{sizeof_buf}: initially holds the size of @code{buf}
|
|
|
|
|
|
|
|
|
|
This function will copy the name of the Certificate in the
|
|
|
|
|
provided buffer. The name will be in the form
|
|
|
|
|
"C=xxxx,O=yyyy,CN=zzzz" as described in RFC2253. The output string
|
|
|
|
|
will be ASCII or UTF-8 encoded, depending on the certificate data.
|
|
|
|
|
|
|
|
|
|
If @code{buf} is null then only the size will be filled.
|
|
|
|
|
|
|
|
|
|
Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
|
|
|
|
|
long enough, and in that case the *sizeof_buf will be updated with
|
|
|
|
|
the required size. On success 0 is returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_dn_by_oid
|
|
|
|
|
@anchor{gnutls_x509_crt_get_dn_by_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_dn_by_oid} (gnutls_x509_crt_t @var{cert}, const char * @var{oid}, int @var{indx}, unsigned int @var{raw_flag}, void * @var{buf}, size_t * @var{sizeof_buf})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{oid}: holds an Object Identified in null terminated string
|
|
|
|
|
|
|
|
|
|
@var{indx}: In case multiple same OIDs exist in the RDN, this specifies which to send. Use zero to get the first one.
|
|
|
|
|
|
|
|
|
|
@var{raw_flag}: If non zero returns the raw DER data of the DN part.
|
|
|
|
|
|
|
|
|
|
@var{buf}: a pointer where the DN part will be copied (may be null).
|
|
|
|
|
|
|
|
|
|
@var{sizeof_buf}: initially holds the size of @code{buf}
|
|
|
|
|
|
|
|
|
|
This function will extract the part of the name of the Certificate
|
|
|
|
|
subject specified by the given OID. The output, if the raw flag is not
|
|
|
|
|
used, will be encoded as described in RFC2253. Thus a string that is
|
|
|
|
|
ASCII or UTF-8 encoded, depending on the certificate data.
|
|
|
|
|
|
|
|
|
|
Some helper macros with popular OIDs can be found in gnutls/x509.h
|
|
|
|
|
If raw flag is zero, this function will only return known OIDs as
|
|
|
|
|
text. Other OIDs will be DER encoded, as described in RFC2253 --
|
|
|
|
|
in hex format with a '\#' prefix. You can check about known OIDs
|
|
|
|
|
using @code{gnutls_x509_dn_oid_known()}.
|
|
|
|
|
|
|
|
|
|
If @code{buf} is null then only the size will be filled.
|
|
|
|
|
|
|
|
|
|
Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
|
|
|
|
|
long enough, and in that case the *sizeof_buf will be updated with
|
|
|
|
|
the required size. On success 0 is returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_dn_oid
|
|
|
|
|
@anchor{gnutls_x509_crt_get_dn_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_dn_oid} (gnutls_x509_crt_t @var{cert}, int @var{indx}, void * @var{oid}, size_t * @var{sizeof_oid})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{indx}: This specifies which OID to return. Use zero to get the first one.
|
|
|
|
|
|
|
|
|
|
@var{oid}: a pointer to a buffer to hold the OID (may be null)
|
|
|
|
|
|
|
|
|
|
@var{sizeof_oid}: initially holds the size of @code{oid}
|
|
|
|
|
|
|
|
|
|
This function will extract the OIDs of the name of the Certificate
|
|
|
|
|
subject specified by the given index.
|
|
|
|
|
|
|
|
|
|
If oid is null then only the size will be filled.
|
|
|
|
|
|
|
|
|
|
Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
|
|
|
|
|
long enough, and in that case the *sizeof_oid will be updated with
|
|
|
|
|
the required size. On success 0 is returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_signature_algorithm
|
|
|
|
|
@anchor{gnutls_x509_crt_get_signature_algorithm}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_signature_algorithm} (gnutls_x509_crt_t @var{cert})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
This function will return a value of the gnutls_sign_algorithm_t enumeration that
|
|
|
|
|
is the signature algorithm.
|
|
|
|
|
|
|
|
|
|
Returns a negative value on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_signature
|
|
|
|
|
@anchor{gnutls_x509_crt_get_signature}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_signature} (gnutls_x509_crt_t @var{cert}, char * @var{sig}, size_t * @var{sizeof_sig})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{sig}: a pointer where the signature part will be copied (may be null).
|
|
|
|
|
|
|
|
|
|
@var{sizeof_sig}: initially holds the size of @code{sig}
|
|
|
|
|
|
|
|
|
|
This function will extract the signature field of a certificate.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success, and a negative value on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_version
|
|
|
|
|
@anchor{gnutls_x509_crt_get_version}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_version} (gnutls_x509_crt_t @var{cert})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
This function will return the version of the specified Certificate.
|
|
|
|
|
|
|
|
|
|
Returns a negative value on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_activation_time
|
|
|
|
|
@anchor{gnutls_x509_crt_get_activation_time}
|
|
|
|
|
@deftypefun {time_t} {gnutls_x509_crt_get_activation_time} (gnutls_x509_crt_t @var{cert})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
This function will return the time this Certificate was or will be activated.
|
|
|
|
|
|
|
|
|
|
Returns (time_t)-1 on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_expiration_time
|
|
|
|
|
@anchor{gnutls_x509_crt_get_expiration_time}
|
|
|
|
|
@deftypefun {time_t} {gnutls_x509_crt_get_expiration_time} (gnutls_x509_crt_t @var{cert})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
This function will return the time this Certificate was or will be expired.
|
|
|
|
|
|
|
|
|
|
Returns (time_t)-1 on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_serial
|
|
|
|
|
@anchor{gnutls_x509_crt_get_serial}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_serial} (gnutls_x509_crt_t @var{cert}, void * @var{result}, size_t * @var{result_size})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{result}: The place where the serial number will be copied
|
|
|
|
|
|
|
|
|
|
@var{result_size}: Holds the size of the result field.
|
|
|
|
|
|
|
|
|
|
This function will return the X.509 certificate's serial number.
|
|
|
|
|
This is obtained by the X509 Certificate serialNumber
|
|
|
|
|
field. Serial is not always a 32 or 64bit number. Some CAs use
|
|
|
|
|
large serial numbers, thus it may be wise to handle it as something
|
|
|
|
|
opaque.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success and a negative value in case of an error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_subject_key_id
|
|
|
|
|
@anchor{gnutls_x509_crt_get_subject_key_id}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_subject_key_id} (gnutls_x509_crt_t @var{cert}, void * @var{ret}, size_t * @var{ret_size}, unsigned int * @var{critical})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{ret}: The place where the identifier will be copied
|
|
|
|
|
|
|
|
|
|
@var{ret_size}: Holds the size of the result field.
|
|
|
|
|
|
|
|
|
|
@var{critical}: will be non zero if the extension is marked as critical (may be null)
|
|
|
|
|
|
|
|
|
|
This function will return the X.509v3 certificate's subject key identifier.
|
|
|
|
|
This is obtained by the X.509 Subject Key identifier extension
|
|
|
|
|
field (2.5.29.14).
|
|
|
|
|
|
|
|
|
|
Returns 0 on success and a negative value in case of an error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_authority_key_id
|
|
|
|
|
@anchor{gnutls_x509_crt_get_authority_key_id}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_authority_key_id} (gnutls_x509_crt_t @var{cert}, void * @var{ret}, size_t * @var{ret_size}, unsigned int * @var{critical})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{critical}: will be non zero if the extension is marked as critical (may be null)
|
|
|
|
|
|
|
|
|
|
This function will return the X.509v3 certificate authority's key identifier.
|
|
|
|
|
This is obtained by the X.509 Authority Key identifier extension
|
|
|
|
|
field (2.5.29.35). Note that this function only returns the keyIdentifier
|
|
|
|
|
field of the extension.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success and a negative value in case of an error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_pk_algorithm
|
|
|
|
|
@anchor{gnutls_x509_crt_get_pk_algorithm}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_pk_algorithm} (gnutls_x509_crt_t @var{cert}, unsigned int * @var{bits})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{bits}: if bits is non null it will hold the size of the parameters' in bits
|
|
|
|
|
|
|
|
|
|
This function will return the public key algorithm of an X.509
|
|
|
|
|
certificate.
|
|
|
|
|
|
|
|
|
|
If bits is non null, it should have enough size to hold the parameters
|
|
|
|
|
size in bits. For RSA the bits returned is the modulus.
|
|
|
|
|
For DSA the bits returned are of the public
|
|
|
|
|
exponent.
|
|
|
|
|
|
|
|
|
|
Returns a member of the gnutls_pk_algorithm_t enumeration on success,
|
|
|
|
|
or a negative value on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_subject_alt_name
|
|
|
|
|
@anchor{gnutls_x509_crt_get_subject_alt_name}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_subject_alt_name} (gnutls_x509_crt_t @var{cert}, unsigned int @var{seq}, void * @var{ret}, size_t * @var{ret_size}, unsigned int * @var{critical})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{seq}: specifies the sequence number of the alt name (0 for the first one, 1 for the second etc.)
|
|
|
|
|
|
|
|
|
|
@var{ret}: is the place where the alternative name will be copied to
|
|
|
|
|
|
|
|
|
|
@var{ret_size}: holds the size of ret.
|
|
|
|
|
|
|
|
|
|
@var{critical}: will be non zero if the extension is marked as critical (may be null)
|
|
|
|
|
|
|
|
|
|
This function will return the alternative names, contained in the
|
|
|
|
|
given certificate.
|
|
|
|
|
|
|
|
|
|
This is specified in X509v3 Certificate Extensions. GNUTLS will
|
|
|
|
|
return the Alternative name (2.5.29.17), or a negative error code.
|
|
|
|
|
|
|
|
|
|
When the SAN type is otherName, it will extract the data in the
|
|
|
|
|
otherName's value field, and @code{GNUTLS_SAN_OTHERNAME} is returned.
|
|
|
|
|
You may use @code{gnutls_x509_crt_get_subject_alt_othername_oid()} to get
|
|
|
|
|
the corresponding OID and the "virtual" SAN types (e.g.,
|
|
|
|
|
@code{GNUTLS_SAN_OTHERNAME_XMPP}).
|
|
|
|
|
|
|
|
|
|
If an otherName OID is known, the data will be decoded. Otherwise
|
|
|
|
|
the returned data will be DER encoded, and you will have to decode
|
|
|
|
|
it yourself. Currently, only the RFC 3920 id-on-xmppAddr SAN is
|
|
|
|
|
recognized.
|
|
|
|
|
|
|
|
|
|
Returns the alternative subject name type on success. The type is
|
|
|
|
|
one of the enumerated gnutls_x509_subject_alt_name_t. It will
|
|
|
|
|
return @code{GNUTLS_E_SHORT_MEMORY_BUFFER} if @code{ret_size} is not large
|
|
|
|
|
enough to hold the value. In that case @code{ret_size} will be updated
|
|
|
|
|
with the required size. If the certificate does not have an
|
|
|
|
|
Alternative name with the specified sequence number then
|
|
|
|
|
@code{GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE} is returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_subject_alt_name2
|
|
|
|
|
@anchor{gnutls_x509_crt_get_subject_alt_name2}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_subject_alt_name2} (gnutls_x509_crt_t @var{cert}, unsigned int @var{seq}, void * @var{ret}, size_t * @var{ret_size}, unsigned int* @var{ret_type}, unsigned int * @var{critical})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{seq}: specifies the sequence number of the alt name (0 for the first one, 1 for the second etc.)
|
|
|
|
|
|
|
|
|
|
@var{ret}: is the place where the alternative name will be copied to
|
|
|
|
|
|
|
|
|
|
@var{ret_size}: holds the size of ret.
|
|
|
|
|
|
|
|
|
|
@var{ret_type}: holds the type of the alternative name (one of gnutls_x509_subject_alt_name_t).
|
|
|
|
|
|
|
|
|
|
@var{critical}: will be non zero if the extension is marked as critical (may be null)
|
|
|
|
|
|
|
|
|
|
This function will return the alternative names, contained in the
|
|
|
|
|
given certificate. It is the same as @code{gnutls_x509_crt_get_subject_alt_name()}
|
|
|
|
|
except for the fact that it will return the type of the alternative
|
|
|
|
|
name in @code{ret_type} even if the function fails for some reason (i.e.
|
|
|
|
|
the buffer provided is not enough).
|
|
|
|
|
|
|
|
|
|
The return values are the same as with @code{gnutls_x509_crt_get_subject_alt_name()}.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_subject_alt_othername_oid
|
|
|
|
|
@anchor{gnutls_x509_crt_get_subject_alt_othername_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_subject_alt_othername_oid} (gnutls_x509_crt_t @var{cert}, unsigned int @var{seq}, void * @var{ret}, size_t * @var{ret_size})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{seq}: specifies the sequence number of the alt name (0 for the first one, 1 for the second etc.)
|
|
|
|
|
|
|
|
|
|
@var{ret}: is the place where the otherName OID will be copied to
|
|
|
|
|
|
|
|
|
|
@var{ret_size}: holds the size of ret.
|
|
|
|
|
|
|
|
|
|
This function will extract the type OID of an otherName Subject
|
|
|
|
|
Alternative Name, contained in the given certificate, and return
|
|
|
|
|
the type as an enumerated element.
|
|
|
|
|
|
|
|
|
|
This function is only useful if
|
|
|
|
|
@code{gnutls_x509_crt_get_subject_alt_name()} returned
|
|
|
|
|
@code{GNUTLS_SAN_OTHERNAME}.
|
|
|
|
|
|
|
|
|
|
Returns the alternative subject name type on success. The type is
|
|
|
|
|
one of the enumerated gnutls_x509_subject_alt_name_t. For
|
|
|
|
|
supported OIDs, it will return one of the virtual
|
|
|
|
|
(GNUTLS_SAN_OTHERNAME_*) types, e.g. @code{GNUTLS_SAN_OTHERNAME_XMPP},
|
|
|
|
|
and @code{GNUTLS_SAN_OTHERNAME} for unknown OIDs. It will return
|
|
|
|
|
@code{GNUTLS_E_SHORT_MEMORY_BUFFER} if @code{ret_size} is not large enough to
|
|
|
|
|
hold the value. In that case @code{ret_size} will be updated with the
|
|
|
|
|
required size. If the certificate does not have an Alternative
|
|
|
|
|
name with the specified sequence number and with the otherName type
|
|
|
|
|
then @code{GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE} is returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_basic_constraints
|
|
|
|
|
@anchor{gnutls_x509_crt_get_basic_constraints}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_basic_constraints} (gnutls_x509_crt_t @var{cert}, unsigned int * @var{critical}, int * @var{ca}, int * @var{pathlen})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{critical}: will be non zero if the extension is marked as critical
|
|
|
|
|
|
|
|
|
|
@var{ca}: pointer to output integer indicating CA status, may be NULL,
|
|
|
|
|
value is 1 if the certificate CA flag is set, 0 otherwise.
|
|
|
|
|
|
|
|
|
|
@var{pathlen}: pointer to output integer indicating path length (may be
|
|
|
|
|
NULL), non-negative values indicate a present pathLenConstraint
|
|
|
|
|
field and the actual value, -1 indicate that the field is absent.
|
|
|
|
|
|
|
|
|
|
This function will read the certificate's basic constraints, and
|
|
|
|
|
return the certificates CA status. It reads the basicConstraints
|
|
|
|
|
X.509 extension (2.5.29.19).
|
|
|
|
|
|
|
|
|
|
@strong{Return value:} If the certificate is a CA a positive value will be
|
|
|
|
|
returned, or zero if the certificate does not have CA flag set. A
|
|
|
|
|
negative value may be returned in case of errors. If the
|
|
|
|
|
certificate does not contain the basicConstraints extension
|
|
|
|
|
GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_ca_status
|
|
|
|
|
@anchor{gnutls_x509_crt_get_ca_status}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_ca_status} (gnutls_x509_crt_t @var{cert}, unsigned int * @var{critical})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{critical}: will be non zero if the extension is marked as critical
|
|
|
|
|
|
|
|
|
|
This function will return certificates CA status, by reading the
|
|
|
|
|
basicConstraints X.509 extension (2.5.29.19). If the certificate is
|
|
|
|
|
a CA a positive value will be returned, or zero if the certificate
|
|
|
|
|
does not have CA flag set.
|
|
|
|
|
|
|
|
|
|
Use @code{gnutls_x509_crt_get_basic_constraints()} if you want to read the
|
|
|
|
|
pathLenConstraint field too.
|
|
|
|
|
|
|
|
|
|
A negative value may be returned in case of parsing error.
|
|
|
|
|
If the certificate does not contain the basicConstraints extension
|
|
|
|
|
GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_key_usage
|
|
|
|
|
@anchor{gnutls_x509_crt_get_key_usage}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_key_usage} (gnutls_x509_crt_t @var{cert}, unsigned int * @var{key_usage}, unsigned int * @var{critical})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{key_usage}: where the key usage bits will be stored
|
|
|
|
|
|
|
|
|
|
@var{critical}: will be non zero if the extension is marked as critical
|
|
|
|
|
|
|
|
|
|
This function will return certificate's key usage, by reading the
|
|
|
|
|
keyUsage X.509 extension (2.5.29.15). The key usage value will ORed values of the:
|
|
|
|
|
GNUTLS_KEY_DIGITAL_SIGNATURE, GNUTLS_KEY_NON_REPUDIATION,
|
|
|
|
|
GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DATA_ENCIPHERMENT,
|
|
|
|
|
GNUTLS_KEY_KEY_AGREEMENT, GNUTLS_KEY_KEY_CERT_SIGN,
|
|
|
|
|
GNUTLS_KEY_CRL_SIGN, GNUTLS_KEY_ENCIPHER_ONLY,
|
|
|
|
|
GNUTLS_KEY_DECIPHER_ONLY.
|
|
|
|
|
|
|
|
|
|
A negative value may be returned in case of parsing error.
|
|
|
|
|
If the certificate does not contain the keyUsage extension
|
|
|
|
|
GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_proxy
|
|
|
|
|
@anchor{gnutls_x509_crt_get_proxy}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_proxy} (gnutls_x509_crt_t @var{cert}, unsigned int * @var{critical}, int * @var{pathlen}, char ** @var{policyLanguage}, char ** @var{policy}, size_t * @var{sizeof_policy})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{critical}: will be non zero if the extension is marked as critical
|
|
|
|
|
|
|
|
|
|
@var{pathlen}: pointer to output integer indicating path length (may be
|
|
|
|
|
NULL), non-negative values indicate a present pCPathLenConstraint
|
|
|
|
|
field and the actual value, -1 indicate that the field is absent.
|
|
|
|
|
|
|
|
|
|
This function will read the certificate's basic constraints, and
|
|
|
|
|
return the certificates CA status. It reads the basicConstraints
|
|
|
|
|
X.509 extension (2.5.29.19).
|
|
|
|
|
|
|
|
|
|
@strong{Return value:} If the certificate is a CA a positive value will be
|
|
|
|
|
returned, or zero if the certificate does not have CA flag set. A
|
|
|
|
|
negative value may be returned in case of errors. If the
|
|
|
|
|
certificate does not contain the basicConstraints extension
|
|
|
|
|
GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_extension_by_oid
|
|
|
|
|
@anchor{gnutls_x509_crt_get_extension_by_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_extension_by_oid} (gnutls_x509_crt_t @var{cert}, const char * @var{oid}, int @var{indx}, void * @var{buf}, size_t * @var{sizeof_buf}, unsigned int * @var{critical})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{oid}: holds an Object Identified in null terminated string
|
|
|
|
|
|
|
|
|
|
@var{indx}: In case multiple same OIDs exist in the extensions, this specifies which to send. Use zero to get the first one.
|
|
|
|
|
|
|
|
|
|
@var{buf}: a pointer to a structure to hold the name (may be null)
|
|
|
|
|
|
|
|
|
|
@var{sizeof_buf}: initially holds the size of @code{buf}
|
|
|
|
|
|
|
|
|
|
@var{critical}: will be non zero if the extension is marked as critical
|
|
|
|
|
|
|
|
|
|
This function will return the extension specified by the OID in the certificate.
|
|
|
|
|
The extensions will be returned as binary data DER encoded, in the provided
|
|
|
|
|
buffer.
|
|
|
|
|
|
|
|
|
|
A negative value may be returned in case of parsing error.
|
|
|
|
|
If the certificate does not contain the specified extension
|
|
|
|
|
GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_extension_oid
|
|
|
|
|
@anchor{gnutls_x509_crt_get_extension_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_extension_oid} (gnutls_x509_crt_t @var{cert}, int @var{indx}, void * @var{oid}, size_t * @var{sizeof_oid})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{indx}: Specifies which extension OID to send. Use zero to get the first one.
|
|
|
|
|
|
|
|
|
|
@var{oid}: a pointer to a structure to hold the OID (may be null)
|
|
|
|
|
|
|
|
|
|
@var{sizeof_oid}: initially holds the size of @code{oid}
|
|
|
|
|
|
|
|
|
|
This function will return the requested extension OID in the certificate.
|
|
|
|
|
The extension OID will be stored as a string in the provided buffer.
|
|
|
|
|
|
|
|
|
|
A negative value may be returned in case of parsing error.
|
|
|
|
|
If your have reached the last extension available
|
|
|
|
|
GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_extension_info
|
|
|
|
|
@anchor{gnutls_x509_crt_get_extension_info}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_extension_info} (gnutls_x509_crt_t @var{cert}, int @var{indx}, void * @var{oid}, size_t * @var{sizeof_oid}, int * @var{critical})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{indx}: Specifies which extension OID to send. Use zero to get the first one.
|
|
|
|
|
|
|
|
|
|
@var{oid}: a pointer to a structure to hold the OID
|
|
|
|
|
|
|
|
|
|
@var{sizeof_oid}: initially holds the size of @code{oid}
|
|
|
|
|
|
|
|
|
|
@var{critical}: output variable with critical flag, may be NULL.
|
|
|
|
|
|
|
|
|
|
This function will return the requested extension OID in the
|
|
|
|
|
certificate, and the critical flag for it. The extension OID will
|
|
|
|
|
be stored as a string in the provided buffer. Use
|
|
|
|
|
@code{gnutls_x509_crt_get_extension_data()} to extract the data.
|
|
|
|
|
|
|
|
|
|
Return 0 on success. A negative value may be returned in case of
|
|
|
|
|
parsing error. If you have reached the last extension available
|
|
|
|
|
GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_extension_data
|
|
|
|
|
@anchor{gnutls_x509_crt_get_extension_data}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_extension_data} (gnutls_x509_crt_t @var{cert}, int @var{indx}, void * @var{data}, size_t * @var{sizeof_data})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{indx}: Specifies which extension OID to send. Use zero to get the first one.
|
|
|
|
|
|
|
|
|
|
@var{data}: a pointer to a structure to hold the data (may be null)
|
|
|
|
|
|
|
|
|
|
@var{sizeof_data}: initially holds the size of @code{oid}
|
|
|
|
|
|
|
|
|
|
This function will return the requested extension data in the
|
|
|
|
|
certificate. The extension data will be stored as a string in the
|
|
|
|
|
provided buffer.
|
|
|
|
|
|
|
|
|
|
Use @code{gnutls_x509_crt_get_extension_info()} to extract the OID and
|
|
|
|
|
critical flag. Use @code{gnutls_x509_crt_get_extension_by_oid()} instead,
|
|
|
|
|
if you want to get data indexed by the extension OID rather than
|
|
|
|
|
sequence.
|
|
|
|
|
|
|
|
|
|
Return 0 on success. A negative value may be returned in case of
|
|
|
|
|
parsing error. If you have reached the last extension available
|
|
|
|
|
GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_raw_issuer_dn
|
|
|
|
|
@anchor{gnutls_x509_crt_get_raw_issuer_dn}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_raw_issuer_dn} (gnutls_x509_crt_t @var{cert}, gnutls_datum_t * @var{start})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{start}: will hold the starting point of the DN
|
|
|
|
|
|
|
|
|
|
This function will return a pointer to the DER encoded DN structure
|
|
|
|
|
and the length.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success or a negative value on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_raw_dn
|
|
|
|
|
@anchor{gnutls_x509_crt_get_raw_dn}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_raw_dn} (gnutls_x509_crt_t @var{cert}, gnutls_datum_t * @var{start})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{start}: will hold the starting point of the DN
|
|
|
|
|
|
|
|
|
|
This function will return a pointer to the DER encoded DN structure and
|
|
|
|
|
the length.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success, or a negative value on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_subject
|
|
|
|
|
@anchor{gnutls_x509_crt_get_subject}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_subject} (gnutls_x509_crt_t @var{cert}, gnutls_x509_dn_t * @var{dn})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{dn}: output variable with pointer to opaque DN.
|
|
|
|
|
|
|
|
|
|
Return the Certificate's Subject DN as an opaque data type. You
|
|
|
|
|
may use @code{gnutls_x509_dn_get_rdn_ava()} to decode the DN.
|
|
|
|
|
|
|
|
|
|
@strong{Returns:} Returns 0 on success, or an error code.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_issuer
|
|
|
|
|
@anchor{gnutls_x509_crt_get_issuer}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_issuer} (gnutls_x509_crt_t @var{cert}, gnutls_x509_dn_t * @var{dn})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{dn}: output variable with pointer to opaque DN
|
|
|
|
|
|
|
|
|
|
Return the Certificate's Issuer DN as an opaque data type. You may
|
|
|
|
|
use @code{gnutls_x509_dn_get_rdn_ava()} to decode the DN.
|
|
|
|
|
|
|
|
|
|
Note that @code{dn} points into the @code{cert} object, and thus you may not
|
|
|
|
|
deallocate @code{cert} and continue to access @code{dn}.
|
|
|
|
|
|
|
|
|
|
@strong{Returns:} Returns 0 on success, or an error code.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_dn_get_rdn_ava
|
|
|
|
|
@anchor{gnutls_x509_dn_get_rdn_ava}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_dn_get_rdn_ava} (gnutls_x509_dn_t @var{dn}, int @var{irdn}, int @var{iava}, gnutls_x509_ava_st * @var{ava})
|
|
|
|
|
@var{dn}: input variable with opaque DN pointer
|
|
|
|
|
|
|
|
|
|
@var{irdn}: index of RDN
|
|
|
|
|
|
|
|
|
|
@var{iava}: index of AVA.
|
|
|
|
|
|
|
|
|
|
@var{ava}: Pointer to structure which will hold output information.
|
|
|
|
|
|
|
|
|
|
Get pointers to data within the DN.
|
|
|
|
|
|
|
|
|
|
Note that @code{ava} will contain pointers into the @code{dn} structure, so you
|
|
|
|
|
should not modify any data or deallocate it. Note also that the DN
|
|
|
|
|
in turn points into the original certificate structure, and thus
|
|
|
|
|
you may not deallocate the certificate and continue to access @code{dn}.
|
|
|
|
|
|
|
|
|
|
@strong{Returns:} Returns 0 on success, or an error code.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_fingerprint
|
|
|
|
|
@anchor{gnutls_x509_crt_get_fingerprint}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_fingerprint} (gnutls_x509_crt_t @var{cert}, gnutls_digest_algorithm_t @var{algo}, void * @var{buf}, size_t * @var{sizeof_buf})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{algo}: is a digest algorithm
|
|
|
|
|
|
|
|
|
|
@var{buf}: a pointer to a structure to hold the fingerprint (may be null)
|
|
|
|
|
|
|
|
|
|
@var{sizeof_buf}: initially holds the size of @code{buf}
|
|
|
|
|
|
|
|
|
|
This function will calculate and copy the certificate's fingerprint
|
|
|
|
|
in the provided buffer.
|
|
|
|
|
|
|
|
|
|
If the buffer is null then only the size will be filled.
|
|
|
|
|
|
|
|
|
|
@strong{Returns:} @code{GNUTLS_E_SHORT_MEMORY_BUFFER} if the provided buffer is
|
|
|
|
|
not long enough, and in that case the *sizeof_buf will be updated
|
|
|
|
|
with the required size. On success 0 is returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_export
|
|
|
|
|
@anchor{gnutls_x509_crt_export}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_export} (gnutls_x509_crt_t @var{cert}, gnutls_x509_crt_fmt_t @var{format}, void * @var{output_data}, size_t * @var{output_data_size})
|
|
|
|
|
@var{cert}: Holds the certificate
|
|
|
|
|
|
|
|
|
|
@var{format}: the format of output params. One of PEM or DER.
|
|
|
|
|
|
|
|
|
|
@var{output_data}: will contain a certificate PEM or DER encoded
|
|
|
|
|
|
|
|
|
|
@var{output_data_size}: holds the size of output_data (and will be
|
|
|
|
|
replaced by the actual size of parameters)
|
|
|
|
|
|
|
|
|
|
This function will export the certificate to DER or PEM format.
|
|
|
|
|
|
|
|
|
|
If the buffer provided is not long enough to hold the output, then
|
|
|
|
|
*output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
|
|
|
|
|
be returned.
|
|
|
|
|
|
|
|
|
|
If the structure is PEM encoded, it will have a header
|
|
|
|
|
of "BEGIN CERTIFICATE".
|
|
|
|
|
|
|
|
|
|
@strong{Return value:} In case of failure a negative value will be
|
|
|
|
|
returned, and 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_key_id
|
|
|
|
|
@anchor{gnutls_x509_crt_get_key_id}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_key_id} (gnutls_x509_crt_t @var{crt}, unsigned int @var{flags}, unsigned char * @var{output_data}, size_t * @var{output_data_size})
|
|
|
|
|
@var{crt}: Holds the certificate
|
|
|
|
|
|
|
|
|
|
@var{flags}: should be 0 for now
|
|
|
|
|
|
|
|
|
|
@var{output_data}: will contain the key ID
|
|
|
|
|
|
|
|
|
|
@var{output_data_size}: holds the size of output_data (and will be
|
|
|
|
|
replaced by the actual size of parameters)
|
|
|
|
|
|
|
|
|
|
This function will return a unique ID the depends on the public
|
|
|
|
|
key parameters. This ID can be used in checking whether a
|
|
|
|
|
certificate corresponds to the given private key.
|
|
|
|
|
|
|
|
|
|
If the buffer provided is not long enough to hold the output, then
|
|
|
|
|
*output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
|
|
|
|
|
be returned. The output will normally be a SHA-1 hash output,
|
|
|
|
|
which is 20 bytes.
|
|
|
|
|
|
|
|
|
|
@strong{Return value:} In case of failure a negative value will be
|
|
|
|
|
returned, and 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_check_revocation
|
|
|
|
|
@anchor{gnutls_x509_crt_check_revocation}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_check_revocation} (gnutls_x509_crt_t @var{cert}, const gnutls_x509_crl_t * @var{crl_list}, int @var{crl_list_length})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{crl_list}: should contain a list of gnutls_x509_crl_t structures
|
|
|
|
|
|
|
|
|
|
@var{crl_list_length}: the length of the crl_list
|
|
|
|
|
|
|
|
|
|
This function will return check if the given certificate is
|
|
|
|
|
revoked. It is assumed that the CRLs have been verified before.
|
|
|
|
|
|
|
|
|
|
@strong{Returns:} 0 if the certificate is NOT revoked, and 1 if it is. A
|
|
|
|
|
negative value is returned on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_verify_data
|
|
|
|
|
@anchor{gnutls_x509_crt_verify_data}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_verify_data} (gnutls_x509_crt_t @var{crt}, unsigned int @var{flags}, const gnutls_datum_t * @var{data}, const gnutls_datum_t * @var{signature})
|
|
|
|
|
@var{crt}: Holds the certificate
|
|
|
|
|
|
|
|
|
|
@var{flags}: should be 0 for now
|
|
|
|
|
|
|
|
|
|
@var{data}: holds the data to be signed
|
|
|
|
|
|
|
|
|
|
@var{signature}: contains the signature
|
|
|
|
|
|
|
|
|
|
This function will verify the given signed data, using the
|
|
|
|
|
parameters from the certificate.
|
|
|
|
|
|
|
|
|
|
@strong{Returns:} In case of a verification failure 0 is returned, and 1 on
|
|
|
|
|
success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_crl_dist_points
|
|
|
|
|
@anchor{gnutls_x509_crt_get_crl_dist_points}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_crl_dist_points} (gnutls_x509_crt_t @var{cert}, unsigned int @var{seq}, void * @var{ret}, size_t * @var{ret_size}, unsigned int * @var{reason_flags}, unsigned int * @var{critical})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{seq}: specifies the sequence number of the distribution point (0 for the first one, 1 for the second etc.)
|
|
|
|
|
|
|
|
|
|
@var{ret}: is the place where the distribution point will be copied to
|
|
|
|
|
|
|
|
|
|
@var{ret_size}: holds the size of ret.
|
|
|
|
|
|
|
|
|
|
@var{reason_flags}: Revocation reasons flags.
|
|
|
|
|
|
|
|
|
|
@var{critical}: will be non zero if the extension is marked as critical (may be null)
|
|
|
|
|
|
|
|
|
|
This function will return the CRL distribution points (2.5.29.31),
|
|
|
|
|
contained in the given certificate.
|
|
|
|
|
|
|
|
|
|
@code{reason_flags} should be an ORed sequence of
|
|
|
|
|
GNUTLS_CRL_REASON_UNUSED, GNUTLS_CRL_REASON_KEY_COMPROMISE,
|
|
|
|
|
GNUTLS_CRL_REASON_CA_COMPROMISE,
|
|
|
|
|
GNUTLS_CRL_REASON_AFFILIATION_CHANGED,
|
|
|
|
|
GNUTLS_CRL_REASON_SUPERSEEDED,
|
|
|
|
|
GNUTLS_CRL_REASON_CESSATION_OF_OPERATION,
|
|
|
|
|
GNUTLS_CRL_REASON_CERTIFICATE_HOLD,
|
|
|
|
|
GNUTLS_CRL_REASON_PRIVILEGE_WITHDRAWN,
|
|
|
|
|
GNUTLS_CRL_REASON_AA_COMPROMISE, or zero for all possible reasons.
|
|
|
|
|
|
|
|
|
|
This is specified in X509v3 Certificate Extensions. GNUTLS will
|
|
|
|
|
return the distribution point type, or a negative error code on
|
|
|
|
|
error.
|
|
|
|
|
|
|
|
|
|
Returns @code{GNUTLS_E_SHORT_MEMORY_BUFFER} and updates &@code{ret_size} if
|
|
|
|
|
&@code{ret_size} is not enough to hold the distribution point, or the
|
|
|
|
|
type of the distribution point if everything was ok. The type is
|
|
|
|
|
one of the enumerated @code{gnutls_x509_subject_alt_name_t}. If the
|
|
|
|
|
certificate does not have an Alternative name with the specified
|
|
|
|
|
sequence number then @code{GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE} is
|
|
|
|
|
returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_key_purpose_oid
|
|
|
|
|
@anchor{gnutls_x509_crt_get_key_purpose_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_key_purpose_oid} (gnutls_x509_crt_t @var{cert}, int @var{indx}, void * @var{oid}, size_t * @var{sizeof_oid}, unsigned int * @var{critical})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{indx}: This specifies which OID to return. Use zero to get the first one.
|
|
|
|
|
|
|
|
|
|
@var{oid}: a pointer to a buffer to hold the OID (may be null)
|
|
|
|
|
|
|
|
|
|
@var{sizeof_oid}: initially holds the size of @code{oid}
|
|
|
|
|
|
|
|
|
|
This function will extract the key purpose OIDs of the Certificate
|
|
|
|
|
specified by the given index. These are stored in the Extended Key
|
|
|
|
|
Usage extension (2.5.29.37) See the GNUTLS_KP_* definitions for
|
|
|
|
|
human readable names.
|
|
|
|
|
|
|
|
|
|
If @code{oid} is null then only the size will be filled.
|
|
|
|
|
|
|
|
|
|
@strong{Returns:} @code{GNUTLS_E_SHORT_MEMORY_BUFFER} if the provided buffer is
|
|
|
|
|
not long enough, and in that case the *sizeof_oid will be updated
|
|
|
|
|
with the required size. On success 0 is returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_pk_rsa_raw
|
|
|
|
|
@anchor{gnutls_x509_crt_get_pk_rsa_raw}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_pk_rsa_raw} (gnutls_x509_crt_t @var{crt}, gnutls_datum_t * @var{m}, gnutls_datum_t * @var{e})
|
|
|
|
|
@var{crt}: Holds the certificate
|
|
|
|
|
|
|
|
|
|
@var{m}: will hold the modulus
|
|
|
|
|
|
|
|
|
|
@var{e}: will hold the public exponent
|
|
|
|
|
|
|
|
|
|
This function will export the RSA public key's parameters found in
|
|
|
|
|
the given structure. The new parameters will be allocated using
|
|
|
|
|
@code{gnutls_malloc()} and will be stored in the appropriate datum.
|
|
|
|
|
|
|
|
|
|
@strong{Returns:} @code{GNUTLS_E_SUCCESS} on success, otherwise an error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_get_pk_dsa_raw
|
|
|
|
|
@anchor{gnutls_x509_crt_get_pk_dsa_raw}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_get_pk_dsa_raw} (gnutls_x509_crt_t @var{crt}, gnutls_datum_t * @var{p}, gnutls_datum_t * @var{q}, gnutls_datum_t * @var{g}, gnutls_datum_t * @var{y})
|
|
|
|
|
@var{crt}: Holds the certificate
|
|
|
|
|
|
|
|
|
|
@var{p}: will hold the p
|
|
|
|
|
|
|
|
|
|
@var{q}: will hold the q
|
|
|
|
|
|
|
|
|
|
@var{g}: will hold the g
|
|
|
|
|
|
|
|
|
|
@var{y}: will hold the y
|
|
|
|
|
|
|
|
|
|
This function will export the DSA public key's parameters found in
|
|
|
|
|
the given certificate. The new parameters will be allocated using
|
|
|
|
|
@code{gnutls_malloc()} and will be stored in the appropriate datum.
|
|
|
|
|
|
|
|
|
|
@strong{Returns:} @code{GNUTLS_E_SUCCESS} on success, otherwise an error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_list_import
|
|
|
|
|
@anchor{gnutls_x509_crt_list_import}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_list_import} (gnutls_x509_crt_t * @var{certs}, unsigned int * @var{cert_max}, const gnutls_datum_t * @var{data}, gnutls_x509_crt_fmt_t @var{format}, unsigned int @var{flags})
|
|
|
|
|
@var{certs}: The structures to store the parsed certificate. Must not be initialized.
|
|
|
|
|
|
|
|
|
|
@var{cert_max}: Initially must hold the maximum number of certs. It will be updated with the number of certs available.
|
|
|
|
|
|
|
|
|
|
@var{data}: The PEM encoded certificate.
|
|
|
|
|
|
|
|
|
|
@var{format}: One of DER or PEM.
|
|
|
|
|
|
|
|
|
|
@var{flags}: must be zero or an OR'd sequence of gnutls_certificate_import_flags.
|
|
|
|
|
|
|
|
|
|
This function will convert the given PEM encoded certificate list
|
|
|
|
|
to the native gnutls_x509_crt_t format. The output will be stored
|
|
|
|
|
in @code{certs}. They will be automatically initialized.
|
|
|
|
|
|
|
|
|
|
If the Certificate is PEM encoded it should have a header of "X509
|
|
|
|
|
CERTIFICATE", or "CERTIFICATE".
|
|
|
|
|
|
|
|
|
|
@strong{Returns:} the number of certificates read or a negative error value.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_check_hostname
|
|
|
|
|
@anchor{gnutls_x509_crt_check_hostname}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_check_hostname} (gnutls_x509_crt_t @var{cert}, const char * @var{hostname})
|
|
|
|
|
@var{cert}: should contain an gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{hostname}: A null terminated string that contains a DNS name
|
|
|
|
|
|
|
|
|
|
This function will check if the given certificate's subject
|
|
|
|
|
matches the given hostname. This is a basic implementation of the
|
|
|
|
|
matching described in RFC2818 (HTTPS), which takes into account
|
|
|
|
|
wildcards, and the DNSName/IPAddress subject alternative name PKIX
|
|
|
|
|
extension.
|
|
|
|
|
|
|
|
|
|
Returns non zero for a successful match, and zero on failure.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_check_issuer
|
|
|
|
|
@anchor{gnutls_x509_crt_check_issuer}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_check_issuer} (gnutls_x509_crt_t @var{cert}, gnutls_x509_crt_t @var{issuer})
|
|
|
|
|
@var{cert}: is the certificate to be checked
|
|
|
|
|
|
|
|
|
|
@var{issuer}: is the certificate of a possible issuer
|
|
|
|
|
|
|
|
|
|
This function will check if the given certificate was issued by the
|
|
|
|
|
given issuer. It will return true (1) if the given certificate is issued
|
|
|
|
|
by the given issuer, and false (0) if not.
|
|
|
|
|
|
|
|
|
|
A negative value is returned in case of an error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_list_verify
|
|
|
|
|
@anchor{gnutls_x509_crt_list_verify}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_list_verify} (const gnutls_x509_crt_t * @var{cert_list}, int @var{cert_list_length}, const gnutls_x509_crt_t * @var{CA_list}, int @var{CA_list_length}, const gnutls_x509_crl_t * @var{CRL_list}, int @var{CRL_list_length}, unsigned int @var{flags}, unsigned int * @var{verify})
|
|
|
|
|
@var{cert_list}: is the certificate list to be verified
|
|
|
|
|
|
|
|
|
|
@var{cert_list_length}: holds the number of certificate in cert_list
|
|
|
|
|
|
|
|
|
|
@var{CA_list}: is the CA list which will be used in verification
|
|
|
|
|
|
|
|
|
|
@var{CA_list_length}: holds the number of CA certificate in CA_list
|
|
|
|
|
|
|
|
|
|
@var{CRL_list}: holds a list of CRLs.
|
|
|
|
|
|
|
|
|
|
@var{CRL_list_length}: the length of CRL list.
|
|
|
|
|
|
|
|
|
|
@var{flags}: Flags that may be used to change the verification algorithm. Use OR of the gnutls_certificate_verify_flags enumerations.
|
|
|
|
|
|
|
|
|
|
@var{verify}: will hold the certificate verification output.
|
|
|
|
|
|
|
|
|
|
This function will try to verify the given certificate list and return its status.
|
|
|
|
|
Note that expiration and activation dates are not checked
|
|
|
|
|
by this function, you should check them using the appropriate functions.
|
|
|
|
|
|
|
|
|
|
If no flags are specified (0), this function will use the
|
|
|
|
|
basicConstraints (2.5.29.19) PKIX extension. This means that only a certificate
|
|
|
|
|
authority is allowed to sign a certificate.
|
|
|
|
|
|
|
|
|
|
You must also check the peer's name in order to check if the verified
|
|
|
|
|
certificate belongs to the actual peer.
|
|
|
|
|
|
|
|
|
|
The certificate verification output will be put in @code{verify} and will be
|
|
|
|
|
one or more of the gnutls_certificate_status_t enumerated elements bitwise or'd.
|
|
|
|
|
For a more detailed verification status use @code{gnutls_x509_crt_verify()} per list
|
|
|
|
|
element.
|
|
|
|
|
|
|
|
|
|
@strong{GNUTLS_CERT_INVALID:} the certificate chain is not valid.
|
|
|
|
|
|
|
|
|
|
@strong{GNUTLS_CERT_REVOKED:} a certificate in the chain has been revoked.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success and a negative value in case of an error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_verify
|
|
|
|
|
@anchor{gnutls_x509_crt_verify}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_verify} (gnutls_x509_crt_t @var{cert}, const gnutls_x509_crt_t * @var{CA_list}, int @var{CA_list_length}, unsigned int @var{flags}, unsigned int * @var{verify})
|
|
|
|
|
@var{cert}: is the certificate to be verified
|
|
|
|
|
|
|
|
|
|
@var{CA_list}: is one certificate that is considered to be trusted one
|
|
|
|
|
|
|
|
|
|
@var{CA_list_length}: holds the number of CA certificate in CA_list
|
|
|
|
|
|
|
|
|
|
@var{flags}: Flags that may be used to change the verification algorithm. Use OR of the gnutls_certificate_verify_flags enumerations.
|
|
|
|
|
|
|
|
|
|
@var{verify}: will hold the certificate verification output.
|
|
|
|
|
|
|
|
|
|
This function will try to verify the given certificate and return its status.
|
|
|
|
|
The verification output in this functions cannot be GNUTLS_CERT_NOT_VALID.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success and a negative value in case of an error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_check_issuer
|
|
|
|
|
@anchor{gnutls_x509_crl_check_issuer}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_check_issuer} (gnutls_x509_crl_t @var{cert}, gnutls_x509_crt_t @var{issuer})
|
|
|
|
|
@var{issuer}: is the certificate of a possible issuer
|
|
|
|
|
|
|
|
|
|
This function will check if the given CRL was issued by the
|
|
|
|
|
given issuer certificate. It will return true (1) if the given CRL was issued
|
|
|
|
|
by the given issuer, and false (0) if not.
|
|
|
|
|
|
|
|
|
|
A negative value is returned in case of an error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_verify
|
|
|
|
|
@anchor{gnutls_x509_crl_verify}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_verify} (gnutls_x509_crl_t @var{crl}, const gnutls_x509_crt_t * @var{CA_list}, int @var{CA_list_length}, unsigned int @var{flags}, unsigned int * @var{verify})
|
|
|
|
|
@var{crl}: is the crl to be verified
|
|
|
|
|
|
|
|
|
|
@var{CA_list}: is a certificate list that is considered to be trusted one
|
|
|
|
|
|
|
|
|
|
@var{CA_list_length}: holds the number of CA certificates in CA_list
|
|
|
|
|
|
|
|
|
|
@var{flags}: Flags that may be used to change the verification algorithm. Use OR of the gnutls_certificate_verify_flags enumerations.
|
|
|
|
|
|
|
|
|
|
@var{verify}: will hold the crl verification output.
|
|
|
|
|
|
|
|
|
|
This function will try to verify the given crl and return its status.
|
|
|
|
|
See @code{gnutls_x509_crt_list_verify()} for a detailed description of
|
|
|
|
|
return values.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success and a negative value in case of an error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_privkey_init
|
|
|
|
|
@anchor{gnutls_x509_privkey_init}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_privkey_init} (gnutls_x509_privkey_t * @var{key})
|
|
|
|
|
@var{key}: The structure to be initialized
|
|
|
|
|
|
|
|
|
|
This function will initialize an private key structure.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_privkey_deinit
|
|
|
|
|
@anchor{gnutls_x509_privkey_deinit}
|
|
|
|
|
@deftypefun {void} {gnutls_x509_privkey_deinit} (gnutls_x509_privkey_t @var{key})
|
|
|
|
|
@var{key}: The structure to be initialized
|
|
|
|
|
|
|
|
|
|
This function will deinitialize a private key structure.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_privkey_cpy
|
|
|
|
|
@anchor{gnutls_x509_privkey_cpy}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_privkey_cpy} (gnutls_x509_privkey_t @var{dst}, gnutls_x509_privkey_t @var{src})
|
|
|
|
|
@var{dst}: The destination key, which should be initialized.
|
|
|
|
|
|
|
|
|
|
@var{src}: The source key
|
|
|
|
|
|
|
|
|
|
This function will copy a private key from source to destination key.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_privkey_import
|
|
|
|
|
@anchor{gnutls_x509_privkey_import}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_privkey_import} (gnutls_x509_privkey_t @var{key}, const gnutls_datum_t * @var{data}, gnutls_x509_crt_fmt_t @var{format})
|
|
|
|
|
@var{key}: The structure to store the parsed key
|
|
|
|
|
|
|
|
|
|
@var{data}: The DER or PEM encoded certificate.
|
|
|
|
|
|
|
|
|
|
@var{format}: One of DER or PEM
|
|
|
|
|
|
|
|
|
|
This function will convert the given DER or PEM encoded key
|
|
|
|
|
to the native gnutls_x509_privkey_t format. The output will be stored in @code{key} .
|
|
|
|
|
|
|
|
|
|
If the key is PEM encoded it should have a header of "RSA PRIVATE KEY", or
|
|
|
|
|
"DSA PRIVATE KEY".
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_privkey_import_rsa_raw
|
|
|
|
|
@anchor{gnutls_x509_privkey_import_rsa_raw}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_privkey_import_rsa_raw} (gnutls_x509_privkey_t @var{key}, const gnutls_datum_t * @var{m}, const gnutls_datum_t * @var{e}, const gnutls_datum_t * @var{d}, const gnutls_datum_t * @var{p}, const gnutls_datum_t * @var{q}, const gnutls_datum_t * @var{u})
|
|
|
|
|
@var{key}: The structure to store the parsed key
|
|
|
|
|
|
|
|
|
|
@var{m}: holds the modulus
|
|
|
|
|
|
|
|
|
|
@var{e}: holds the public exponent
|
|
|
|
|
|
|
|
|
|
@var{d}: holds the private exponent
|
|
|
|
|
|
|
|
|
|
@var{p}: holds the first prime (p)
|
|
|
|
|
|
|
|
|
|
@var{q}: holds the second prime (q)
|
|
|
|
|
|
|
|
|
|
@var{u}: holds the coefficient
|
|
|
|
|
|
|
|
|
|
This function will convert the given RSA raw parameters
|
|
|
|
|
to the native gnutls_x509_privkey_t format. The output will be stored in @code{key}.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_privkey_import_dsa_raw
|
|
|
|
|
@anchor{gnutls_x509_privkey_import_dsa_raw}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_privkey_import_dsa_raw} (gnutls_x509_privkey_t @var{key}, const gnutls_datum_t * @var{p}, const gnutls_datum_t * @var{q}, const gnutls_datum_t * @var{g}, const gnutls_datum_t * @var{y}, const gnutls_datum_t * @var{x})
|
|
|
|
|
@var{key}: The structure to store the parsed key
|
|
|
|
|
|
|
|
|
|
@var{p}: holds the p
|
|
|
|
|
|
|
|
|
|
@var{q}: holds the q
|
|
|
|
|
|
|
|
|
|
@var{g}: holds the g
|
|
|
|
|
|
|
|
|
|
@var{y}: holds the y
|
|
|
|
|
|
|
|
|
|
@var{x}: holds the x
|
|
|
|
|
|
|
|
|
|
This function will convert the given DSA raw parameters
|
|
|
|
|
to the native gnutls_x509_privkey_t format. The output will be stored in @code{key}.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_privkey_get_pk_algorithm
|
|
|
|
|
@anchor{gnutls_x509_privkey_get_pk_algorithm}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_privkey_get_pk_algorithm} (gnutls_x509_privkey_t @var{key})
|
|
|
|
|
@var{key}: should contain a gnutls_x509_privkey_t structure
|
|
|
|
|
|
|
|
|
|
This function will return the public key algorithm of a private
|
|
|
|
|
key.
|
|
|
|
|
|
|
|
|
|
Returns a member of the gnutls_pk_algorithm_t enumeration on success,
|
|
|
|
|
or a negative value on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_privkey_export
|
|
|
|
|
@anchor{gnutls_x509_privkey_export}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_privkey_export} (gnutls_x509_privkey_t @var{key}, gnutls_x509_crt_fmt_t @var{format}, void * @var{output_data}, size_t * @var{output_data_size})
|
|
|
|
|
@var{key}: Holds the key
|
|
|
|
|
|
|
|
|
|
@var{format}: the format of output params. One of PEM or DER.
|
|
|
|
|
|
|
|
|
|
@var{output_data}: will contain a private key PEM or DER encoded
|
|
|
|
|
|
|
|
|
|
@var{output_data_size}: holds the size of output_data (and will be
|
|
|
|
|
replaced by the actual size of parameters)
|
|
|
|
|
|
|
|
|
|
This function will export the private key to a PKCS1 structure for
|
|
|
|
|
RSA keys, or an integer sequence for DSA keys. The DSA keys are in
|
|
|
|
|
the same format with the parameters used by openssl.
|
|
|
|
|
|
|
|
|
|
If the buffer provided is not long enough to hold the output, then
|
|
|
|
|
*output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
|
|
|
|
|
be returned.
|
|
|
|
|
|
|
|
|
|
If the structure is PEM encoded, it will have a header
|
|
|
|
|
of "BEGIN RSA PRIVATE KEY".
|
|
|
|
|
|
|
|
|
|
@strong{Return value:} In case of failure a negative value will be
|
|
|
|
|
returned, and 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_privkey_export_rsa_raw
|
|
|
|
|
@anchor{gnutls_x509_privkey_export_rsa_raw}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_privkey_export_rsa_raw} (gnutls_x509_privkey_t @var{key}, gnutls_datum_t * @var{m}, gnutls_datum_t * @var{e}, gnutls_datum_t * @var{d}, gnutls_datum_t * @var{p}, gnutls_datum_t * @var{q}, gnutls_datum_t * @var{u})
|
|
|
|
|
@var{key}: a structure that holds the rsa parameters
|
|
|
|
|
|
|
|
|
|
@var{m}: will hold the modulus
|
|
|
|
|
|
|
|
|
|
@var{e}: will hold the public exponent
|
|
|
|
|
|
|
|
|
|
@var{d}: will hold the private exponent
|
|
|
|
|
|
|
|
|
|
@var{p}: will hold the first prime (p)
|
|
|
|
|
|
|
|
|
|
@var{q}: will hold the second prime (q)
|
|
|
|
|
|
|
|
|
|
@var{u}: will hold the coefficient
|
|
|
|
|
|
|
|
|
|
This function will export the RSA private key's parameters found in the given
|
|
|
|
|
structure. The new parameters will be allocated using
|
|
|
|
|
@code{gnutls_malloc()} and will be stored in the appropriate datum.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_privkey_export_dsa_raw
|
|
|
|
|
@anchor{gnutls_x509_privkey_export_dsa_raw}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_privkey_export_dsa_raw} (gnutls_x509_privkey_t @var{key}, gnutls_datum_t * @var{p}, gnutls_datum_t * @var{q}, gnutls_datum_t * @var{g}, gnutls_datum_t * @var{y}, gnutls_datum_t * @var{x})
|
|
|
|
|
@var{p}: will hold the p
|
|
|
|
|
|
|
|
|
|
@var{q}: will hold the q
|
|
|
|
|
|
|
|
|
|
@var{g}: will hold the g
|
|
|
|
|
|
|
|
|
|
@var{y}: will hold the y
|
|
|
|
|
|
|
|
|
|
@var{x}: will hold the x
|
|
|
|
|
|
|
|
|
|
This function will export the DSA private key's parameters found in the given
|
|
|
|
|
structure. The new parameters will be allocated using
|
|
|
|
|
@code{gnutls_malloc()} and will be stored in the appropriate datum.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_privkey_generate
|
|
|
|
|
@anchor{gnutls_x509_privkey_generate}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_privkey_generate} (gnutls_x509_privkey_t @var{key}, gnutls_pk_algorithm_t @var{algo}, unsigned int @var{bits}, unsigned int @var{flags})
|
|
|
|
|
@var{key}: should contain a gnutls_x509_privkey_t structure
|
|
|
|
|
|
|
|
|
|
@var{algo}: is one of RSA or DSA.
|
|
|
|
|
|
|
|
|
|
@var{bits}: the size of the modulus
|
|
|
|
|
|
|
|
|
|
@var{flags}: unused for now. Must be 0.
|
|
|
|
|
|
|
|
|
|
This function will generate a random private key. Note that
|
|
|
|
|
this function must be called on an empty private key.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success or a negative value on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_privkey_get_key_id
|
|
|
|
|
@anchor{gnutls_x509_privkey_get_key_id}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_privkey_get_key_id} (gnutls_x509_privkey_t @var{key}, unsigned int @var{flags}, unsigned char * @var{output_data}, size_t * @var{output_data_size})
|
|
|
|
|
@var{key}: Holds the key
|
|
|
|
|
|
|
|
|
|
@var{flags}: should be 0 for now
|
|
|
|
|
|
|
|
|
|
@var{output_data}: will contain the key ID
|
|
|
|
|
|
|
|
|
|
@var{output_data_size}: holds the size of output_data (and will be
|
|
|
|
|
replaced by the actual size of parameters)
|
|
|
|
|
|
|
|
|
|
This function will return a unique ID the depends on the public key
|
|
|
|
|
parameters. This ID can be used in checking whether a certificate
|
|
|
|
|
corresponds to the given key.
|
|
|
|
|
|
|
|
|
|
If the buffer provided is not long enough to hold the output, then
|
|
|
|
|
*output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
|
|
|
|
|
be returned. The output will normally be a SHA-1 hash output,
|
|
|
|
|
which is 20 bytes.
|
|
|
|
|
|
|
|
|
|
@strong{Return value:} In case of failure a negative value will be
|
|
|
|
|
returned, and 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_privkey_sign_data
|
|
|
|
|
@anchor{gnutls_x509_privkey_sign_data}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_privkey_sign_data} (gnutls_x509_privkey_t @var{key}, gnutls_digest_algorithm_t @var{digest}, unsigned int @var{flags}, const gnutls_datum_t * @var{data}, void * @var{signature}, size_t * @var{signature_size})
|
|
|
|
|
@var{key}: Holds the key
|
|
|
|
|
|
|
|
|
|
@var{digest}: should be MD5 or SHA1
|
|
|
|
|
|
|
|
|
|
@var{flags}: should be 0 for now
|
|
|
|
|
|
|
|
|
|
@var{data}: holds the data to be signed
|
|
|
|
|
|
|
|
|
|
@var{signature}: will contain the signature
|
|
|
|
|
|
|
|
|
|
@var{signature_size}: holds the size of signature (and will be replaced
|
|
|
|
|
by the new size)
|
|
|
|
|
|
|
|
|
|
This function will sign the given data using a signature algorithm
|
|
|
|
|
supported by the private key. Signature algorithms are always used
|
|
|
|
|
together with a hash functions. Different hash functions may be
|
|
|
|
|
used for the RSA algorithm, but only SHA-1 for the DSA keys.
|
|
|
|
|
|
|
|
|
|
If the buffer provided is not long enough to hold the output, then
|
|
|
|
|
*signature_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
|
|
|
|
|
be returned.
|
|
|
|
|
|
|
|
|
|
In case of failure a negative value will be returned, and
|
|
|
|
|
0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_privkey_sign_hash
|
|
|
|
|
@anchor{gnutls_x509_privkey_sign_hash}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_privkey_sign_hash} (gnutls_x509_privkey_t @var{key}, const gnutls_datum_t * @var{hash}, gnutls_datum_t * @var{signature})
|
|
|
|
|
@var{key}: Holds the key
|
|
|
|
|
|
|
|
|
|
@var{hash}: holds the data to be signed
|
|
|
|
|
|
|
|
|
|
@var{signature}: will contain newly allocated signature
|
|
|
|
|
|
|
|
|
|
This function will sign the given hash using the private key.
|
|
|
|
|
|
|
|
|
|
@strong{Return value:} In case of failure a negative value will be returned,
|
|
|
|
|
and 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_privkey_verify_data
|
|
|
|
|
@anchor{gnutls_x509_privkey_verify_data}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_privkey_verify_data} (gnutls_x509_privkey_t @var{key}, unsigned int @var{flags}, const gnutls_datum_t * @var{data}, const gnutls_datum_t * @var{signature})
|
|
|
|
|
@var{key}: Holds the key
|
|
|
|
|
|
|
|
|
|
@var{flags}: should be 0 for now
|
|
|
|
|
|
|
|
|
|
@var{data}: holds the data to be signed
|
|
|
|
|
|
|
|
|
|
@var{signature}: contains the signature
|
|
|
|
|
|
|
|
|
|
This function will verify the given signed data, using the parameters in the
|
|
|
|
|
private key.
|
|
|
|
|
|
|
|
|
|
In case of a verification failure 0 is returned, and
|
|
|
|
|
1 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_privkey_fix
|
|
|
|
|
@anchor{gnutls_x509_privkey_fix}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_privkey_fix} (gnutls_x509_privkey_t @var{key})
|
|
|
|
|
@var{key}: Holds the key
|
|
|
|
|
|
|
|
|
|
This function will recalculate the secondary parameters in a key.
|
|
|
|
|
In RSA keys, this can be the coefficient and exponent1,2.
|
|
|
|
|
|
|
|
|
|
@strong{Return value:} In case of failure a negative value will be
|
|
|
|
|
returned, and 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs7_init
|
|
|
|
|
@anchor{gnutls_pkcs7_init}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs7_init} (gnutls_pkcs7_t * @var{pkcs7})
|
|
|
|
|
@var{pkcs7}: The structure to be initialized
|
|
|
|
|
|
|
|
|
|
This function will initialize a PKCS7 structure. PKCS7 structures
|
|
|
|
|
usually contain lists of X.509 Certificates and X.509 Certificate
|
|
|
|
|
revocation lists.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs7_deinit
|
|
|
|
|
@anchor{gnutls_pkcs7_deinit}
|
|
|
|
|
@deftypefun {void} {gnutls_pkcs7_deinit} (gnutls_pkcs7_t @var{pkcs7})
|
|
|
|
|
@var{pkcs7}: The structure to be initialized
|
|
|
|
|
|
|
|
|
|
This function will deinitialize a PKCS7 structure.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs7_import
|
|
|
|
|
@anchor{gnutls_pkcs7_import}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs7_import} (gnutls_pkcs7_t @var{pkcs7}, const gnutls_datum_t * @var{data}, gnutls_x509_crt_fmt_t @var{format})
|
|
|
|
|
@var{pkcs7}: The structure to store the parsed PKCS7.
|
|
|
|
|
|
|
|
|
|
@var{data}: The DER or PEM encoded PKCS7.
|
|
|
|
|
|
|
|
|
|
@var{format}: One of DER or PEM
|
|
|
|
|
|
|
|
|
|
This function will convert the given DER or PEM encoded PKCS7
|
|
|
|
|
to the native gnutls_pkcs7_t format. The output will be stored in 'pkcs7'.
|
|
|
|
|
|
|
|
|
|
If the PKCS7 is PEM encoded it should have a header of "PKCS7".
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs7_get_crt_raw
|
|
|
|
|
@anchor{gnutls_pkcs7_get_crt_raw}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs7_get_crt_raw} (gnutls_pkcs7_t @var{pkcs7}, int @var{indx}, void * @var{certificate}, size_t * @var{certificate_size})
|
|
|
|
|
@var{indx}: contains the index of the certificate to extract
|
|
|
|
|
|
|
|
|
|
@var{certificate}: the contents of the certificate will be copied there (may be null)
|
|
|
|
|
|
|
|
|
|
@var{certificate_size}: should hold the size of the certificate
|
|
|
|
|
|
|
|
|
|
This function will return a certificate of the PKCS7 or RFC2630 certificate set.
|
|
|
|
|
Returns 0 on success. If the provided buffer is not long enough,
|
|
|
|
|
then @code{certificate_size} is updated and GNUTLS_E_SHORT_MEMORY_BUFFER is returned.
|
|
|
|
|
|
|
|
|
|
After the last certificate has been read GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
|
|
|
|
|
will be returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs7_get_crt_count
|
|
|
|
|
@anchor{gnutls_pkcs7_get_crt_count}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs7_get_crt_count} (gnutls_pkcs7_t @var{pkcs7})
|
|
|
|
|
This function will return the number of certifcates in the PKCS7 or
|
|
|
|
|
RFC2630 certificate set.
|
|
|
|
|
|
|
|
|
|
Returns a negative value on failure.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs7_export
|
|
|
|
|
@anchor{gnutls_pkcs7_export}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs7_export} (gnutls_pkcs7_t @var{pkcs7}, gnutls_x509_crt_fmt_t @var{format}, void * @var{output_data}, size_t * @var{output_data_size})
|
|
|
|
|
@var{pkcs7}: Holds the pkcs7 structure
|
|
|
|
|
|
|
|
|
|
@var{format}: the format of output params. One of PEM or DER.
|
|
|
|
|
|
|
|
|
|
@var{output_data}: will contain a structure PEM or DER encoded
|
|
|
|
|
|
|
|
|
|
@var{output_data_size}: holds the size of output_data (and will be
|
|
|
|
|
replaced by the actual size of parameters)
|
|
|
|
|
|
|
|
|
|
This function will export the pkcs7 structure to DER or PEM format.
|
|
|
|
|
|
|
|
|
|
If the buffer provided is not long enough to hold the output, then
|
|
|
|
|
*output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
|
|
|
|
|
be returned.
|
|
|
|
|
|
|
|
|
|
If the structure is PEM encoded, it will have a header
|
|
|
|
|
of "BEGIN PKCS7".
|
|
|
|
|
|
|
|
|
|
@strong{Return value:} In case of failure a negative value will be
|
|
|
|
|
returned, and 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs7_set_crt_raw
|
|
|
|
|
@anchor{gnutls_pkcs7_set_crt_raw}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs7_set_crt_raw} (gnutls_pkcs7_t @var{pkcs7}, const gnutls_datum_t * @var{crt})
|
|
|
|
|
@var{crt}: the DER encoded certificate to be added
|
|
|
|
|
|
|
|
|
|
This function will add a certificate to the PKCS7 or RFC2630 certificate set.
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs7_set_crt
|
|
|
|
|
@anchor{gnutls_pkcs7_set_crt}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs7_set_crt} (gnutls_pkcs7_t @var{pkcs7}, gnutls_x509_crt_t @var{crt})
|
|
|
|
|
@var{crt}: the certificate to be copied.
|
|
|
|
|
|
|
|
|
|
This function will add a parsed certificate to the PKCS7 or RFC2630 certificate set.
|
|
|
|
|
This is a wrapper function over @code{gnutls_pkcs7_set_crt_raw()} .
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs7_delete_crt
|
|
|
|
|
@anchor{gnutls_pkcs7_delete_crt}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs7_delete_crt} (gnutls_pkcs7_t @var{pkcs7}, int @var{indx})
|
|
|
|
|
@var{indx}: the index of the certificate to delete
|
|
|
|
|
|
|
|
|
|
This function will delete a certificate from a PKCS7 or RFC2630 certificate set.
|
|
|
|
|
Index starts from 0. Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs7_get_crl_raw
|
|
|
|
|
@anchor{gnutls_pkcs7_get_crl_raw}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs7_get_crl_raw} (gnutls_pkcs7_t @var{pkcs7}, int @var{indx}, void * @var{crl}, size_t * @var{crl_size})
|
|
|
|
|
@var{indx}: contains the index of the crl to extract
|
|
|
|
|
|
|
|
|
|
@var{crl}: the contents of the crl will be copied there (may be null)
|
|
|
|
|
|
|
|
|
|
@var{crl_size}: should hold the size of the crl
|
|
|
|
|
|
|
|
|
|
This function will return a crl of the PKCS7 or RFC2630 crl set.
|
|
|
|
|
Returns 0 on success. If the provided buffer is not long enough,
|
|
|
|
|
then @code{crl_size} is updated and GNUTLS_E_SHORT_MEMORY_BUFFER is returned.
|
|
|
|
|
|
|
|
|
|
After the last crl has been read GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
|
|
|
|
|
will be returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs7_get_crl_count
|
|
|
|
|
@anchor{gnutls_pkcs7_get_crl_count}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs7_get_crl_count} (gnutls_pkcs7_t @var{pkcs7})
|
|
|
|
|
This function will return the number of certifcates in the PKCS7 or
|
|
|
|
|
RFC2630 crl set.
|
|
|
|
|
|
|
|
|
|
Returns a negative value on failure.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs7_set_crl_raw
|
|
|
|
|
@anchor{gnutls_pkcs7_set_crl_raw}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs7_set_crl_raw} (gnutls_pkcs7_t @var{pkcs7}, const gnutls_datum_t * @var{crl})
|
|
|
|
|
@var{crl}: the DER encoded crl to be added
|
|
|
|
|
|
|
|
|
|
This function will add a crl to the PKCS7 or RFC2630 crl set.
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs7_set_crl
|
|
|
|
|
@anchor{gnutls_pkcs7_set_crl}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs7_set_crl} (gnutls_pkcs7_t @var{pkcs7}, gnutls_x509_crl_t @var{crl})
|
|
|
|
|
@var{crl}: the DER encoded crl to be added
|
|
|
|
|
|
|
|
|
|
This function will add a parsed crl to the PKCS7 or RFC2630 crl set.
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs7_delete_crl
|
|
|
|
|
@anchor{gnutls_pkcs7_delete_crl}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs7_delete_crl} (gnutls_pkcs7_t @var{pkcs7}, int @var{indx})
|
|
|
|
|
@var{indx}: the index of the crl to delete
|
|
|
|
|
|
|
|
|
|
This function will delete a crl from a PKCS7 or RFC2630 crl set.
|
|
|
|
|
Index starts from 0. Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crq_init
|
|
|
|
|
@anchor{gnutls_x509_crq_init}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crq_init} (gnutls_x509_crq_t * @var{crq})
|
|
|
|
|
@var{crq}: The structure to be initialized
|
|
|
|
|
|
|
|
|
|
This function will initialize a PKCS10 certificate request structure.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crq_deinit
|
|
|
|
|
@anchor{gnutls_x509_crq_deinit}
|
|
|
|
|
@deftypefun {void} {gnutls_x509_crq_deinit} (gnutls_x509_crq_t @var{crq})
|
|
|
|
|
@var{crq}: The structure to be initialized
|
|
|
|
|
|
|
|
|
|
This function will deinitialize a CRL structure.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crq_import
|
|
|
|
|
@anchor{gnutls_x509_crq_import}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crq_import} (gnutls_x509_crq_t @var{crq}, const gnutls_datum_t * @var{data}, gnutls_x509_crt_fmt_t @var{format})
|
|
|
|
|
@var{crq}: The structure to store the parsed certificate request.
|
|
|
|
|
|
|
|
|
|
@var{data}: The DER or PEM encoded certificate.
|
|
|
|
|
|
|
|
|
|
@var{format}: One of DER or PEM
|
|
|
|
|
|
|
|
|
|
This function will convert the given DER or PEM encoded Certificate
|
|
|
|
|
to the native gnutls_x509_crq_t format. The output will be stored in @code{cert}.
|
|
|
|
|
|
|
|
|
|
If the Certificate is PEM encoded it should have a header of "NEW CERTIFICATE REQUEST".
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crq_get_dn
|
|
|
|
|
@anchor{gnutls_x509_crq_get_dn}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crq_get_dn} (gnutls_x509_crq_t @var{crq}, char * @var{buf}, size_t * @var{sizeof_buf})
|
|
|
|
|
@var{crq}: should contain a gnutls_x509_crq_t structure
|
|
|
|
|
|
|
|
|
|
@var{buf}: a pointer to a structure to hold the name (may be null)
|
|
|
|
|
|
|
|
|
|
@var{sizeof_buf}: initially holds the size of @code{buf}
|
|
|
|
|
|
|
|
|
|
This function will copy the name of the Certificate request
|
|
|
|
|
subject in the provided buffer. The name will be in the form
|
|
|
|
|
"C=xxxx,O=yyyy,CN=zzzz" as described in RFC2253. The output string
|
|
|
|
|
will be ASCII or UTF-8 encoded, depending on the certificate data.
|
|
|
|
|
|
|
|
|
|
If @code{buf} is null then only the size will be filled.
|
|
|
|
|
|
|
|
|
|
Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
|
|
|
|
|
long enough, and in that case the *sizeof_buf will be updated with
|
|
|
|
|
the required size. On success 0 is returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crq_get_dn_by_oid
|
|
|
|
|
@anchor{gnutls_x509_crq_get_dn_by_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crq_get_dn_by_oid} (gnutls_x509_crq_t @var{crq}, const char * @var{oid}, int @var{indx}, unsigned int @var{raw_flag}, void * @var{buf}, size_t * @var{sizeof_buf})
|
|
|
|
|
@var{crq}: should contain a gnutls_x509_crq_t structure
|
|
|
|
|
|
|
|
|
|
@var{oid}: holds an Object Identified in null terminated string
|
|
|
|
|
|
|
|
|
|
@var{indx}: In case multiple same OIDs exist in the RDN, this specifies
|
|
|
|
|
which to send. Use zero to get the first one.
|
|
|
|
|
|
|
|
|
|
@var{raw_flag}: If non zero returns the raw DER data of the DN part.
|
|
|
|
|
|
|
|
|
|
@var{buf}: a pointer to a structure to hold the name (may be null)
|
|
|
|
|
|
|
|
|
|
@var{sizeof_buf}: initially holds the size of @code{buf}
|
|
|
|
|
|
|
|
|
|
This function will extract the part of the name of the Certificate
|
|
|
|
|
request subject, specified by the given OID. The output will be
|
|
|
|
|
encoded as described in RFC2253. The output string will be ASCII
|
|
|
|
|
or UTF-8 encoded, depending on the certificate data.
|
|
|
|
|
|
|
|
|
|
Some helper macros with popular OIDs can be found in gnutls/x509.h
|
|
|
|
|
If raw flag is zero, this function will only return known OIDs as
|
|
|
|
|
text. Other OIDs will be DER encoded, as described in RFC2253 --
|
|
|
|
|
in hex format with a '\#' prefix. You can check about known OIDs
|
|
|
|
|
using @code{gnutls_x509_dn_oid_known()}.
|
|
|
|
|
|
|
|
|
|
If @code{buf} is null then only the size will be filled.
|
|
|
|
|
|
|
|
|
|
Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
|
|
|
|
|
long enough, and in that case the *sizeof_buf will be updated with
|
|
|
|
|
the required size. On success 0 is returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crq_get_dn_oid
|
|
|
|
|
@anchor{gnutls_x509_crq_get_dn_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crq_get_dn_oid} (gnutls_x509_crq_t @var{crq}, int @var{indx}, void * @var{oid}, size_t * @var{sizeof_oid})
|
|
|
|
|
@var{crq}: should contain a gnutls_x509_crq_t structure
|
|
|
|
|
|
|
|
|
|
@var{indx}: Specifies which DN OID to send. Use zero to get the first one.
|
|
|
|
|
|
|
|
|
|
@var{oid}: a pointer to a structure to hold the name (may be null)
|
|
|
|
|
|
|
|
|
|
@var{sizeof_oid}: initially holds the size of @code{oid}
|
|
|
|
|
|
|
|
|
|
This function will extract the requested OID of the name of the
|
|
|
|
|
Certificate request subject, specified by the given index.
|
|
|
|
|
|
|
|
|
|
If oid is null then only the size will be filled.
|
|
|
|
|
|
|
|
|
|
Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
|
|
|
|
|
long enough, and in that case the *sizeof_oid will be updated with
|
|
|
|
|
the required size. On success 0 is returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crq_get_challenge_password
|
|
|
|
|
@anchor{gnutls_x509_crq_get_challenge_password}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crq_get_challenge_password} (gnutls_x509_crq_t @var{crq}, char * @var{pass}, size_t * @var{sizeof_pass})
|
|
|
|
|
@var{crq}: should contain a gnutls_x509_crq_t structure
|
|
|
|
|
|
|
|
|
|
@var{pass}: will hold a null terminated password
|
|
|
|
|
|
|
|
|
|
@var{sizeof_pass}: Initially holds the size of @code{pass}.
|
|
|
|
|
|
|
|
|
|
This function will return the challenge password in the
|
|
|
|
|
request.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crq_set_attribute_by_oid
|
|
|
|
|
@anchor{gnutls_x509_crq_set_attribute_by_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crq_set_attribute_by_oid} (gnutls_x509_crq_t @var{crq}, const char * @var{oid}, void * @var{buf}, size_t @var{sizeof_buf})
|
|
|
|
|
@var{crq}: should contain a gnutls_x509_crq_t structure
|
|
|
|
|
|
|
|
|
|
@var{oid}: holds an Object Identified in null terminated string
|
|
|
|
|
|
|
|
|
|
@var{buf}: a pointer to a structure that holds the attribute data
|
|
|
|
|
|
|
|
|
|
@var{sizeof_buf}: holds the size of @code{buf}
|
|
|
|
|
|
|
|
|
|
This function will set the attribute in the certificate request specified
|
|
|
|
|
by the given Object ID. The attribute must be be DER encoded.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crq_get_attribute_by_oid
|
|
|
|
|
@anchor{gnutls_x509_crq_get_attribute_by_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crq_get_attribute_by_oid} (gnutls_x509_crq_t @var{crq}, const char * @var{oid}, int @var{indx}, void * @var{buf}, size_t * @var{sizeof_buf})
|
|
|
|
|
@var{crq}: should contain a gnutls_x509_crq_t structure
|
|
|
|
|
|
|
|
|
|
@var{oid}: holds an Object Identified in null terminated string
|
|
|
|
|
|
|
|
|
|
@var{indx}: In case multiple same OIDs exist in the attribute list, this specifies
|
|
|
|
|
which to send. Use zero to get the first one.
|
|
|
|
|
|
|
|
|
|
@var{buf}: a pointer to a structure to hold the attribute data (may be null)
|
|
|
|
|
|
|
|
|
|
@var{sizeof_buf}: initially holds the size of @code{buf}
|
|
|
|
|
|
|
|
|
|
This function will return the attribute in the certificate request specified
|
|
|
|
|
by the given Object ID. The attribute will be DER encoded.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crq_set_dn_by_oid
|
|
|
|
|
@anchor{gnutls_x509_crq_set_dn_by_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crq_set_dn_by_oid} (gnutls_x509_crq_t @var{crq}, const char * @var{oid}, unsigned int @var{raw_flag}, const void * @var{data}, unsigned int @var{sizeof_data})
|
|
|
|
|
@var{crq}: should contain a gnutls_x509_crq_t structure
|
|
|
|
|
|
|
|
|
|
@var{oid}: holds an Object Identifier in a null terminated string
|
|
|
|
|
|
|
|
|
|
@var{raw_flag}: must be 0, or 1 if the data are DER encoded
|
|
|
|
|
|
|
|
|
|
@var{data}: a pointer to the input data
|
|
|
|
|
|
|
|
|
|
@var{sizeof_data}: holds the size of @code{data}
|
|
|
|
|
|
|
|
|
|
This function will set the part of the name of the Certificate request subject, specified
|
|
|
|
|
by the given OID. The input string should be ASCII or UTF-8 encoded.
|
|
|
|
|
|
|
|
|
|
Some helper macros with popular OIDs can be found in gnutls/x509.h
|
|
|
|
|
With this function you can only set the known OIDs. You can test
|
|
|
|
|
for known OIDs using @code{gnutls_x509_dn_oid_known()}. For OIDs that are
|
|
|
|
|
not known (by gnutls) you should properly DER encode your data, and
|
|
|
|
|
call this function with raw_flag set.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crq_set_version
|
|
|
|
|
@anchor{gnutls_x509_crq_set_version}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crq_set_version} (gnutls_x509_crq_t @var{crq}, unsigned int @var{version})
|
|
|
|
|
@var{crq}: should contain a gnutls_x509_crq_t structure
|
|
|
|
|
|
|
|
|
|
@var{version}: holds the version number. For v1 Requests must be 1.
|
|
|
|
|
|
|
|
|
|
This function will set the version of the certificate request. For
|
|
|
|
|
version 1 requests this must be one.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crq_get_version
|
|
|
|
|
@anchor{gnutls_x509_crq_get_version}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crq_get_version} (gnutls_x509_crq_t @var{crq})
|
|
|
|
|
@var{crq}: should contain a gnutls_x509_crq_t structure
|
|
|
|
|
|
|
|
|
|
This function will return the version of the specified Certificate request.
|
|
|
|
|
|
|
|
|
|
Returns a negative value on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crq_set_key
|
|
|
|
|
@anchor{gnutls_x509_crq_set_key}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crq_set_key} (gnutls_x509_crq_t @var{crq}, gnutls_x509_privkey_t @var{key})
|
|
|
|
|
@var{crq}: should contain a gnutls_x509_crq_t structure
|
|
|
|
|
|
|
|
|
|
@var{key}: holds a private key
|
|
|
|
|
|
|
|
|
|
This function will set the public parameters from the given private key to the
|
|
|
|
|
request. Only RSA keys are currently supported.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crq_set_challenge_password
|
|
|
|
|
@anchor{gnutls_x509_crq_set_challenge_password}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crq_set_challenge_password} (gnutls_x509_crq_t @var{crq}, const char * @var{pass})
|
|
|
|
|
@var{crq}: should contain a gnutls_x509_crq_t structure
|
|
|
|
|
|
|
|
|
|
@var{pass}: holds a null terminated password
|
|
|
|
|
|
|
|
|
|
This function will set a challenge password to be used when revoking the request.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crq_sign2
|
|
|
|
|
@anchor{gnutls_x509_crq_sign2}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crq_sign2} (gnutls_x509_crq_t @var{crq}, gnutls_x509_privkey_t @var{key}, gnutls_digest_algorithm_t @var{dig}, unsigned int @var{flags})
|
|
|
|
|
@var{crq}: should contain a gnutls_x509_crq_t structure
|
|
|
|
|
|
|
|
|
|
@var{key}: holds a private key
|
|
|
|
|
|
|
|
|
|
@var{dig}: The message digest to use. GNUTLS_DIG_SHA1 is the safe choice unless you know what you're doing.
|
|
|
|
|
|
|
|
|
|
@var{flags}: must be 0
|
|
|
|
|
|
|
|
|
|
This function will sign the certificate request with a private key.
|
|
|
|
|
This must be the same key as the one used in @code{gnutls_x509_crt_set_key()} since a
|
|
|
|
|
certificate request is self signed.
|
|
|
|
|
|
|
|
|
|
This must be the last step in a certificate request generation since all
|
|
|
|
|
the previously set parameters are now signed.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crq_sign
|
|
|
|
|
@anchor{gnutls_x509_crq_sign}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crq_sign} (gnutls_x509_crq_t @var{crq}, gnutls_x509_privkey_t @var{key})
|
|
|
|
|
@var{crq}: should contain a gnutls_x509_crq_t structure
|
|
|
|
|
|
|
|
|
|
@var{key}: holds a private key
|
|
|
|
|
|
|
|
|
|
This function is the same a @code{gnutls_x509_crq_sign2()} with no flags, and
|
|
|
|
|
SHA1 as the hash algorithm.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crq_export
|
|
|
|
|
@anchor{gnutls_x509_crq_export}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crq_export} (gnutls_x509_crq_t @var{crq}, gnutls_x509_crt_fmt_t @var{format}, void * @var{output_data}, size_t * @var{output_data_size})
|
|
|
|
|
@var{crq}: Holds the request
|
|
|
|
|
|
|
|
|
|
@var{format}: the format of output params. One of PEM or DER.
|
|
|
|
|
|
|
|
|
|
@var{output_data}: will contain a certificate request PEM or DER encoded
|
|
|
|
|
|
|
|
|
|
@var{output_data_size}: holds the size of output_data (and will be
|
|
|
|
|
replaced by the actual size of parameters)
|
|
|
|
|
|
|
|
|
|
This function will export the certificate request to a PKCS10
|
|
|
|
|
|
|
|
|
|
If the buffer provided is not long enough to hold the output, then
|
|
|
|
|
GNUTLS_E_SHORT_MEMORY_BUFFER will be returned and
|
|
|
|
|
*output_data_size will be updated.
|
|
|
|
|
|
|
|
|
|
If the structure is PEM encoded, it will have a header of "BEGIN
|
|
|
|
|
NEW CERTIFICATE REQUEST".
|
|
|
|
|
|
|
|
|
|
@strong{Return value:} In case of failure a negative value will be
|
|
|
|
|
returned, and 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crq_get_pk_algorithm
|
|
|
|
|
@anchor{gnutls_x509_crq_get_pk_algorithm}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crq_get_pk_algorithm} (gnutls_x509_crq_t @var{crq}, unsigned int * @var{bits})
|
|
|
|
|
@var{crq}: should contain a gnutls_x509_crq_t structure
|
|
|
|
|
|
|
|
|
|
@var{bits}: if bits is non null it will hold the size of the parameters' in bits
|
|
|
|
|
|
|
|
|
|
This function will return the public key algorithm of a PKCS \@code{10}
|
|
|
|
|
certificate request.
|
|
|
|
|
|
|
|
|
|
If bits is non null, it should have enough size to hold the parameters
|
|
|
|
|
size in bits. For RSA the bits returned is the modulus.
|
|
|
|
|
For DSA the bits returned are of the public
|
|
|
|
|
exponent.
|
|
|
|
|
|
|
|
|
|
Returns a member of the gnutls_pk_algorithm_t enumeration on success,
|
|
|
|
|
or a negative value on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_privkey_export_pkcs8
|
|
|
|
|
@anchor{gnutls_x509_privkey_export_pkcs8}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_privkey_export_pkcs8} (gnutls_x509_privkey_t @var{key}, gnutls_x509_crt_fmt_t @var{format}, const char * @var{password}, unsigned int @var{flags}, void * @var{output_data}, size_t * @var{output_data_size})
|
|
|
|
|
@var{key}: Holds the key
|
|
|
|
|
|
|
|
|
|
@var{format}: the format of output params. One of PEM or DER.
|
|
|
|
|
|
|
|
|
|
@var{password}: the password that will be used to encrypt the key.
|
|
|
|
|
|
|
|
|
|
@var{flags}: an ORed sequence of gnutls_pkcs_encrypt_flags_t
|
|
|
|
|
|
|
|
|
|
@var{output_data}: will contain a private key PEM or DER encoded
|
|
|
|
|
|
|
|
|
|
@var{output_data_size}: holds the size of output_data (and will be
|
|
|
|
|
replaced by the actual size of parameters)
|
|
|
|
|
|
|
|
|
|
This function will export the private key to a PKCS8 structure.
|
|
|
|
|
Both RSA and DSA keys can be exported. For DSA keys we use
|
|
|
|
|
PKCS @code{11} definitions. If the flags do not specify the encryption
|
|
|
|
|
cipher, then the default 3DES (PBES2) will be used.
|
|
|
|
|
|
|
|
|
|
The @code{password} can be either ASCII or UTF-8 in the default PBES2
|
|
|
|
|
encryption schemas, or ASCII for the PKCS12 schemas.
|
|
|
|
|
|
|
|
|
|
If the buffer provided is not long enough to hold the output, then
|
|
|
|
|
*output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
|
|
|
|
|
be returned.
|
|
|
|
|
|
|
|
|
|
If the structure is PEM encoded, it will have a header
|
|
|
|
|
of "BEGIN ENCRYPTED PRIVATE KEY" or "BEGIN PRIVATE KEY" if
|
|
|
|
|
encryption is not used.
|
|
|
|
|
|
|
|
|
|
@strong{Return value:} In case of failure a negative value will be
|
|
|
|
|
returned, and 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_privkey_import_pkcs8
|
|
|
|
|
@anchor{gnutls_x509_privkey_import_pkcs8}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_privkey_import_pkcs8} (gnutls_x509_privkey_t @var{key}, const gnutls_datum_t * @var{data}, gnutls_x509_crt_fmt_t @var{format}, const char * @var{password}, unsigned int @var{flags})
|
|
|
|
|
@var{key}: The structure to store the parsed key
|
|
|
|
|
|
|
|
|
|
@var{data}: The DER or PEM encoded key.
|
|
|
|
|
|
|
|
|
|
@var{format}: One of DER or PEM
|
|
|
|
|
|
|
|
|
|
@var{password}: the password to decrypt the key (if it is encrypted).
|
|
|
|
|
|
|
|
|
|
@var{flags}: 0 if encrypted or GNUTLS_PKCS_PLAIN if not encrypted.
|
|
|
|
|
|
|
|
|
|
This function will convert the given DER or PEM encoded PKCS8 2.0 encrypted key
|
|
|
|
|
to the native gnutls_x509_privkey_t format. The output will be stored in @code{key}.
|
|
|
|
|
Both RSA and DSA keys can be imported, and flags can only be used to indicate
|
|
|
|
|
an unencrypted key.
|
|
|
|
|
|
|
|
|
|
The @code{password} can be either ASCII or UTF-8 in the default PBES2
|
|
|
|
|
encryption schemas, or ASCII for the PKCS12 schemas.
|
|
|
|
|
|
|
|
|
|
If the Certificate is PEM encoded it should have a header of "ENCRYPTED PRIVATE KEY",
|
|
|
|
|
or "PRIVATE KEY". You only need to specify the flags if the key is DER encoded, since
|
|
|
|
|
in that case the encryption status cannot be auto-detected.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_init
|
|
|
|
|
@anchor{gnutls_pkcs12_init}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs12_init} (gnutls_pkcs12_t * @var{pkcs12})
|
|
|
|
|
@var{pkcs12}: The structure to be initialized
|
|
|
|
|
|
|
|
|
|
This function will initialize a PKCS12 structure. PKCS12 structures
|
|
|
|
|
usually contain lists of X.509 Certificates and X.509 Certificate
|
|
|
|
|
revocation lists.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_deinit
|
|
|
|
|
@anchor{gnutls_pkcs12_deinit}
|
|
|
|
|
@deftypefun {void} {gnutls_pkcs12_deinit} (gnutls_pkcs12_t @var{pkcs12})
|
|
|
|
|
@var{pkcs12}: The structure to be initialized
|
|
|
|
|
|
|
|
|
|
This function will deinitialize a PKCS12 structure.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_import
|
|
|
|
|
@anchor{gnutls_pkcs12_import}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs12_import} (gnutls_pkcs12_t @var{pkcs12}, const gnutls_datum_t * @var{data}, gnutls_x509_crt_fmt_t @var{format}, unsigned int @var{flags})
|
|
|
|
|
@var{pkcs12}: The structure to store the parsed PKCS12.
|
|
|
|
|
|
|
|
|
|
@var{data}: The DER or PEM encoded PKCS12.
|
|
|
|
|
|
|
|
|
|
@var{format}: One of DER or PEM
|
|
|
|
|
|
|
|
|
|
@var{flags}: an ORed sequence of gnutls_privkey_pkcs8_flags
|
|
|
|
|
|
|
|
|
|
This function will convert the given DER or PEM encoded PKCS12
|
|
|
|
|
to the native gnutls_pkcs12_t format. The output will be stored in 'pkcs12'.
|
|
|
|
|
|
|
|
|
|
If the PKCS12 is PEM encoded it should have a header of "PKCS12".
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_export
|
|
|
|
|
@anchor{gnutls_pkcs12_export}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs12_export} (gnutls_pkcs12_t @var{pkcs12}, gnutls_x509_crt_fmt_t @var{format}, void * @var{output_data}, size_t * @var{output_data_size})
|
|
|
|
|
@var{pkcs12}: Holds the pkcs12 structure
|
|
|
|
|
|
|
|
|
|
@var{format}: the format of output params. One of PEM or DER.
|
|
|
|
|
|
|
|
|
|
@var{output_data}: will contain a structure PEM or DER encoded
|
|
|
|
|
|
|
|
|
|
@var{output_data_size}: holds the size of output_data (and will be
|
|
|
|
|
replaced by the actual size of parameters)
|
|
|
|
|
|
|
|
|
|
This function will export the pkcs12 structure to DER or PEM format.
|
|
|
|
|
|
|
|
|
|
If the buffer provided is not long enough to hold the output, then
|
|
|
|
|
*output_data_size will be updated and GNUTLS_E_SHORT_MEMORY_BUFFER
|
|
|
|
|
will be returned.
|
|
|
|
|
|
|
|
|
|
If the structure is PEM encoded, it will have a header
|
|
|
|
|
of "BEGIN PKCS12".
|
|
|
|
|
|
|
|
|
|
@strong{Return value:} In case of failure a negative value will be
|
|
|
|
|
returned, and 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_get_bag
|
|
|
|
|
@anchor{gnutls_pkcs12_get_bag}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs12_get_bag} (gnutls_pkcs12_t @var{pkcs12}, int @var{indx}, gnutls_pkcs12_bag_t @var{bag})
|
|
|
|
|
@var{pkcs12}: should contain a gnutls_pkcs12_t structure
|
|
|
|
|
|
|
|
|
|
@var{indx}: contains the index of the bag to extract
|
|
|
|
|
|
|
|
|
|
@var{bag}: An initialized bag, where the contents of the bag will be copied
|
|
|
|
|
|
|
|
|
|
This function will return a Bag from the PKCS12 structure.
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
|
|
|
|
|
After the last Bag has been read GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
|
|
|
|
|
will be returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_set_bag
|
|
|
|
|
@anchor{gnutls_pkcs12_set_bag}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs12_set_bag} (gnutls_pkcs12_t @var{pkcs12}, gnutls_pkcs12_bag_t @var{bag})
|
|
|
|
|
@var{pkcs12}: should contain a gnutls_pkcs12_t structure
|
|
|
|
|
|
|
|
|
|
@var{bag}: An initialized bag
|
|
|
|
|
|
|
|
|
|
This function will insert a Bag into the PKCS12 structure.
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_generate_mac
|
|
|
|
|
@anchor{gnutls_pkcs12_generate_mac}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs12_generate_mac} (gnutls_pkcs12_t @var{pkcs12}, const char * @var{pass})
|
|
|
|
|
@var{pkcs12}: should contain a gnutls_pkcs12_t structure
|
|
|
|
|
|
|
|
|
|
@var{pass}: The password for the MAC
|
|
|
|
|
|
|
|
|
|
This function will generate a MAC for the PKCS12 structure.
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_verify_mac
|
|
|
|
|
@anchor{gnutls_pkcs12_verify_mac}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs12_verify_mac} (gnutls_pkcs12_t @var{pkcs12}, const char * @var{pass})
|
|
|
|
|
@var{pkcs12}: should contain a gnutls_pkcs12_t structure
|
|
|
|
|
|
|
|
|
|
@var{pass}: The password for the MAC
|
|
|
|
|
|
|
|
|
|
This function will verify the MAC for the PKCS12 structure.
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_bag_init
|
|
|
|
|
@anchor{gnutls_pkcs12_bag_init}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs12_bag_init} (gnutls_pkcs12_bag_t * @var{bag})
|
|
|
|
|
@var{bag}: The structure to be initialized
|
|
|
|
|
|
|
|
|
|
This function will initialize a PKCS12 bag structure. PKCS12 Bags
|
|
|
|
|
usually contain private keys, lists of X.509 Certificates and X.509 Certificate
|
|
|
|
|
revocation lists.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_bag_deinit
|
|
|
|
|
@anchor{gnutls_pkcs12_bag_deinit}
|
|
|
|
|
@deftypefun {void} {gnutls_pkcs12_bag_deinit} (gnutls_pkcs12_bag_t @var{bag})
|
|
|
|
|
@var{bag}: The structure to be initialized
|
|
|
|
|
|
|
|
|
|
This function will deinitialize a PKCS12 Bag structure.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_bag_get_type
|
|
|
|
|
@anchor{gnutls_pkcs12_bag_get_type}
|
|
|
|
|
@deftypefun {gnutls_pkcs12_bag_type_t} {gnutls_pkcs12_bag_get_type} (gnutls_pkcs12_bag_t @var{bag}, int @var{indx})
|
|
|
|
|
@var{bag}: The bag
|
|
|
|
|
|
|
|
|
|
@var{indx}: The element of the bag to get the type
|
|
|
|
|
|
|
|
|
|
This function will return the bag's type. One of the gnutls_pkcs12_bag_type_t
|
|
|
|
|
enumerations.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_bag_get_count
|
|
|
|
|
@anchor{gnutls_pkcs12_bag_get_count}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs12_bag_get_count} (gnutls_pkcs12_bag_t @var{bag})
|
|
|
|
|
@var{bag}: The bag
|
|
|
|
|
|
|
|
|
|
This function will return the number of the elements withing the bag.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_bag_get_data
|
|
|
|
|
@anchor{gnutls_pkcs12_bag_get_data}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs12_bag_get_data} (gnutls_pkcs12_bag_t @var{bag}, int @var{indx}, gnutls_datum_t * @var{data})
|
|
|
|
|
@var{bag}: The bag
|
|
|
|
|
|
|
|
|
|
@var{indx}: The element of the bag to get the data from
|
|
|
|
|
|
|
|
|
|
@var{data}: where the bag's data will be. Should be treated as constant.
|
|
|
|
|
|
|
|
|
|
This function will return the bag's data. The data is a constant
|
|
|
|
|
that is stored into the bag. Should not be accessed after the bag
|
|
|
|
|
is deleted.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success and a negative error code on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_bag_set_data
|
|
|
|
|
@anchor{gnutls_pkcs12_bag_set_data}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs12_bag_set_data} (gnutls_pkcs12_bag_t @var{bag}, gnutls_pkcs12_bag_type_t @var{type}, const gnutls_datum_t * @var{data})
|
|
|
|
|
@var{bag}: The bag
|
|
|
|
|
|
|
|
|
|
@var{type}: The data's type
|
|
|
|
|
|
|
|
|
|
@var{data}: the data to be copied.
|
|
|
|
|
|
|
|
|
|
This function will insert the given data of the given type into the
|
|
|
|
|
bag.
|
|
|
|
|
|
|
|
|
|
Returns the index of the added bag on success, or a negative
|
|
|
|
|
value on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_bag_set_crt
|
|
|
|
|
@anchor{gnutls_pkcs12_bag_set_crt}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs12_bag_set_crt} (gnutls_pkcs12_bag_t @var{bag}, gnutls_x509_crt_t @var{crt})
|
|
|
|
|
@var{bag}: The bag
|
|
|
|
|
|
|
|
|
|
@var{crt}: the certificate to be copied.
|
|
|
|
|
|
|
|
|
|
This function will insert the given certificate into the
|
|
|
|
|
bag. This is just a wrapper over @code{gnutls_pkcs12_bag_set_data()}.
|
|
|
|
|
|
|
|
|
|
Returns the index of the added bag on success, or a negative
|
|
|
|
|
value on failure.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_bag_set_crl
|
|
|
|
|
@anchor{gnutls_pkcs12_bag_set_crl}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs12_bag_set_crl} (gnutls_pkcs12_bag_t @var{bag}, gnutls_x509_crl_t @var{crl})
|
|
|
|
|
@var{bag}: The bag
|
|
|
|
|
|
|
|
|
|
@var{crl}: the CRL to be copied.
|
|
|
|
|
|
|
|
|
|
This function will insert the given CRL into the
|
|
|
|
|
bag. This is just a wrapper over @code{gnutls_pkcs12_bag_set_data()}.
|
|
|
|
|
|
|
|
|
|
Returns the index of the added bag on success, or a negative
|
|
|
|
|
value on failure.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_bag_set_key_id
|
|
|
|
|
@anchor{gnutls_pkcs12_bag_set_key_id}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs12_bag_set_key_id} (gnutls_pkcs12_bag_t @var{bag}, int @var{indx}, const gnutls_datum_t * @var{id})
|
|
|
|
|
@var{bag}: The bag
|
|
|
|
|
|
|
|
|
|
@var{indx}: The bag's element to add the id
|
|
|
|
|
|
|
|
|
|
@var{id}: the ID
|
|
|
|
|
|
|
|
|
|
This function will add the given key ID, to the specified, by the index, bag
|
|
|
|
|
element. The key ID will be encoded as a 'Local key identifier' bag attribute,
|
|
|
|
|
which is usually used to distinguish the local private key and the certificate pair.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success, or a negative value on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_bag_get_key_id
|
|
|
|
|
@anchor{gnutls_pkcs12_bag_get_key_id}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs12_bag_get_key_id} (gnutls_pkcs12_bag_t @var{bag}, int @var{indx}, gnutls_datum_t * @var{id})
|
|
|
|
|
@var{bag}: The bag
|
|
|
|
|
|
|
|
|
|
@var{indx}: The bag's element to add the id
|
|
|
|
|
|
|
|
|
|
@var{id}: where the ID will be copied (to be treated as const)
|
|
|
|
|
|
|
|
|
|
This function will return the key ID, of the specified bag element.
|
|
|
|
|
The key ID is usually used to distinguish the local private key and the certificate pair.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success, or a negative value on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_bag_get_friendly_name
|
|
|
|
|
@anchor{gnutls_pkcs12_bag_get_friendly_name}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs12_bag_get_friendly_name} (gnutls_pkcs12_bag_t @var{bag}, int @var{indx}, char ** @var{name})
|
|
|
|
|
@var{bag}: The bag
|
|
|
|
|
|
|
|
|
|
@var{indx}: The bag's element to add the id
|
|
|
|
|
|
|
|
|
|
@var{name}: will hold a pointer to the name (to be treated as const)
|
|
|
|
|
|
|
|
|
|
This function will return the friendly name, of the specified bag element.
|
|
|
|
|
The key ID is usually used to distinguish the local private key and the certificate pair.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success, or a negative value on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_bag_set_friendly_name
|
|
|
|
|
@anchor{gnutls_pkcs12_bag_set_friendly_name}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs12_bag_set_friendly_name} (gnutls_pkcs12_bag_t @var{bag}, int @var{indx}, const char * @var{name})
|
|
|
|
|
@var{bag}: The bag
|
|
|
|
|
|
|
|
|
|
@var{indx}: The bag's element to add the id
|
|
|
|
|
|
|
|
|
|
@var{name}: the name
|
|
|
|
|
|
|
|
|
|
This function will add the given key friendly name, to the specified, by the index, bag
|
|
|
|
|
element. The name will be encoded as a 'Friendly name' bag attribute,
|
|
|
|
|
which is usually used to set a user name to the local private key and the certificate pair.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success, or a negative value on error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_bag_decrypt
|
|
|
|
|
@anchor{gnutls_pkcs12_bag_decrypt}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs12_bag_decrypt} (gnutls_pkcs12_bag_t @var{bag}, const char * @var{pass})
|
|
|
|
|
@var{bag}: The bag
|
|
|
|
|
|
|
|
|
|
@var{pass}: The password used for encryption. This can only be ASCII.
|
|
|
|
|
|
|
|
|
|
This function will decrypt the given encrypted bag and return 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_pkcs12_bag_encrypt
|
|
|
|
|
@anchor{gnutls_pkcs12_bag_encrypt}
|
|
|
|
|
@deftypefun {int} {gnutls_pkcs12_bag_encrypt} (gnutls_pkcs12_bag_t @var{bag}, const char * @var{pass}, unsigned int @var{flags})
|
|
|
|
|
@var{bag}: The bag
|
|
|
|
|
|
|
|
|
|
@var{pass}: The password used for encryption. This can only be ASCII.
|
|
|
|
|
|
|
|
|
|
@var{flags}: should be one of gnutls_pkcs_encrypt_flags_t elements bitwise or'd
|
|
|
|
|
|
|
|
|
|
This function will encrypt the given bag and return 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_set_dn_by_oid
|
|
|
|
|
@anchor{gnutls_x509_crt_set_dn_by_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_set_dn_by_oid} (gnutls_x509_crt_t @var{crt}, const char * @var{oid}, unsigned int @var{raw_flag}, const void * @var{name}, unsigned int @var{sizeof_name})
|
|
|
|
|
@var{crt}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{oid}: holds an Object Identifier in a null terminated string
|
|
|
|
|
|
|
|
|
|
@var{raw_flag}: must be 0, or 1 if the data are DER encoded
|
|
|
|
|
|
|
|
|
|
@var{name}: a pointer to the name
|
|
|
|
|
|
|
|
|
|
@var{sizeof_name}: holds the size of @code{name}
|
|
|
|
|
|
|
|
|
|
This function will set the part of the name of the Certificate subject, specified
|
|
|
|
|
by the given OID. The input string should be ASCII or UTF-8 encoded.
|
|
|
|
|
|
|
|
|
|
Some helper macros with popular OIDs can be found in gnutls/x509.h
|
|
|
|
|
With this function you can only set the known OIDs. You can test
|
|
|
|
|
for known OIDs using @code{gnutls_x509_dn_oid_known()}. For OIDs that are
|
|
|
|
|
not known (by gnutls) you should properly DER encode your data, and
|
|
|
|
|
call this function with raw_flag set.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_set_issuer_dn_by_oid
|
|
|
|
|
@anchor{gnutls_x509_crt_set_issuer_dn_by_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_set_issuer_dn_by_oid} (gnutls_x509_crt_t @var{crt}, const char * @var{oid}, unsigned int @var{raw_flag}, const void * @var{name}, unsigned int @var{sizeof_name})
|
|
|
|
|
@var{crt}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{oid}: holds an Object Identifier in a null terminated string
|
|
|
|
|
|
|
|
|
|
@var{raw_flag}: must be 0, or 1 if the data are DER encoded
|
|
|
|
|
|
|
|
|
|
@var{name}: a pointer to the name
|
|
|
|
|
|
|
|
|
|
@var{sizeof_name}: holds the size of @code{name}
|
|
|
|
|
|
|
|
|
|
This function will set the part of the name of the Certificate issuer, specified
|
|
|
|
|
by the given OID. The input string should be ASCII or UTF-8 encoded.
|
|
|
|
|
|
|
|
|
|
Some helper macros with popular OIDs can be found in gnutls/x509.h
|
|
|
|
|
With this function you can only set the known OIDs. You can test
|
|
|
|
|
for known OIDs using @code{gnutls_x509_dn_oid_known()}. For OIDs that are
|
|
|
|
|
not known (by gnutls) you should properly DER encode your data, and
|
|
|
|
|
call this function with raw_flag set.
|
|
|
|
|
|
|
|
|
|
Normally you do not need to call this function, since the signing
|
|
|
|
|
operation will copy the signer's name as the issuer of the certificate.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_set_proxy_dn
|
|
|
|
|
@anchor{gnutls_x509_crt_set_proxy_dn}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_set_proxy_dn} (gnutls_x509_crt_t @var{crt}, gnutls_x509_crt_t @var{eecrt}, unsigned int @var{raw_flag}, const void * @var{name}, unsigned int @var{sizeof_name})
|
|
|
|
|
@var{crt}: a gnutls_x509_crt_t structure with the new proxy cert
|
|
|
|
|
|
|
|
|
|
@var{eecrt}: the end entity certificate that will be issuing the proxy
|
|
|
|
|
|
|
|
|
|
@var{raw_flag}: must be 0, or 1 if the CN is DER encoded
|
|
|
|
|
|
|
|
|
|
@var{name}: a pointer to the CN name, may be NULL (but MUST then be added later)
|
|
|
|
|
|
|
|
|
|
@var{sizeof_name}: holds the size of @code{name}
|
|
|
|
|
|
|
|
|
|
This function will set the subject in @code{crt} to the end entity's
|
|
|
|
|
@code{eecrt} subject name, and add a single Common Name component @code{name}
|
|
|
|
|
of size @code{sizeof_name}. This corresponds to the required proxy
|
|
|
|
|
certificate naming style. Note that if @code{name} is @code{NULL}, you MUST
|
|
|
|
|
set it later by using @code{gnutls_x509_crt_set_dn_by_oid()} or similar.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_set_version
|
|
|
|
|
@anchor{gnutls_x509_crt_set_version}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_set_version} (gnutls_x509_crt_t @var{crt}, unsigned int @var{version})
|
|
|
|
|
@var{crt}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{version}: holds the version number. For X.509v1 certificates must be 1.
|
|
|
|
|
|
|
|
|
|
This function will set the version of the certificate. This must
|
|
|
|
|
be one for X.509 version 1, and so on. Plain certificates without
|
|
|
|
|
extensions must have version set to one.
|
|
|
|
|
|
|
|
|
|
To create well-formed certificates, you must specify version 3 if
|
|
|
|
|
you use any certificate extensions. Extensions are created by
|
|
|
|
|
functions such as gnutls_x509_crt_set_subject_alternative_name or
|
|
|
|
|
gnutls_x509_crt_set_key_usage.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_set_key
|
|
|
|
|
@anchor{gnutls_x509_crt_set_key}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_set_key} (gnutls_x509_crt_t @var{crt}, gnutls_x509_privkey_t @var{key})
|
|
|
|
|
@var{crt}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{key}: holds a private key
|
|
|
|
|
|
|
|
|
|
This function will set the public parameters from the given private key to the
|
|
|
|
|
certificate. Only RSA keys are currently supported.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_set_crq
|
|
|
|
|
@anchor{gnutls_x509_crt_set_crq}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_set_crq} (gnutls_x509_crt_t @var{crt}, gnutls_x509_crq_t @var{crq})
|
|
|
|
|
@var{crt}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{crq}: holds a certificate request
|
|
|
|
|
|
|
|
|
|
This function will set the name and public parameters from the given certificate request to the
|
|
|
|
|
certificate. Only RSA keys are currently supported.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_set_extension_by_oid
|
|
|
|
|
@anchor{gnutls_x509_crt_set_extension_by_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_set_extension_by_oid} (gnutls_x509_crt_t @var{crt}, const char * @var{oid}, const void * @var{buf}, size_t @var{sizeof_buf}, unsigned int @var{critical})
|
|
|
|
|
@var{crt}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{oid}: holds an Object Identified in null terminated string
|
|
|
|
|
|
|
|
|
|
@var{buf}: a pointer to a DER encoded data
|
|
|
|
|
|
|
|
|
|
@var{sizeof_buf}: holds the size of @code{buf}
|
|
|
|
|
|
|
|
|
|
@var{critical}: should be non zero if the extension is to be marked as critical
|
|
|
|
|
|
|
|
|
|
This function will set an the extension, by the specified OID, in the certificate.
|
|
|
|
|
The extension data should be binary data DER encoded.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success and a negative value in case of an error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_set_basic_constraints
|
|
|
|
|
@anchor{gnutls_x509_crt_set_basic_constraints}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_set_basic_constraints} (gnutls_x509_crt_t @var{crt}, unsigned int @var{ca}, int @var{pathLenConstraint})
|
|
|
|
|
@var{crt}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{ca}: true(1) or false(0). Depending on the Certificate authority status.
|
|
|
|
|
|
|
|
|
|
@var{pathLenConstraint}: non-negative values indicate maximum length of path,
|
|
|
|
|
and negative values indicate that the pathLenConstraints field should
|
|
|
|
|
not be present.
|
|
|
|
|
|
|
|
|
|
This function will set the basicConstraints certificate extension.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_set_ca_status
|
|
|
|
|
@anchor{gnutls_x509_crt_set_ca_status}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_set_ca_status} (gnutls_x509_crt_t @var{crt}, unsigned int @var{ca})
|
|
|
|
|
@var{crt}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{ca}: true(1) or false(0). Depending on the Certificate authority status.
|
|
|
|
|
|
|
|
|
|
This function will set the basicConstraints certificate extension.
|
|
|
|
|
Use @code{gnutls_x509_crt_set_basic_constraints()} if you want to control
|
|
|
|
|
the pathLenConstraint field too.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_set_key_usage
|
|
|
|
|
@anchor{gnutls_x509_crt_set_key_usage}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_set_key_usage} (gnutls_x509_crt_t @var{crt}, unsigned int @var{usage})
|
|
|
|
|
@var{crt}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{usage}: an ORed sequence of the GNUTLS_KEY_* elements.
|
|
|
|
|
|
|
|
|
|
This function will set the keyUsage certificate extension.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_set_subject_alternative_name
|
|
|
|
|
@anchor{gnutls_x509_crt_set_subject_alternative_name}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_set_subject_alternative_name} (gnutls_x509_crt_t @var{crt}, gnutls_x509_subject_alt_name_t @var{type}, const char * @var{data_string})
|
|
|
|
|
@var{crt}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{type}: is one of the gnutls_x509_subject_alt_name_t enumerations
|
|
|
|
|
|
|
|
|
|
@var{data_string}: The data to be set
|
|
|
|
|
|
|
|
|
|
This function will set the subject alternative name certificate extension.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_set_proxy
|
|
|
|
|
@anchor{gnutls_x509_crt_set_proxy}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_set_proxy} (gnutls_x509_crt_t @var{crt}, int @var{pathLenConstraint}, const char * @var{policyLanguage}, const char * @var{policy}, size_t @var{sizeof_policy})
|
|
|
|
|
@var{crt}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{pathLenConstraint}: non-negative values indicate maximum length of path,
|
|
|
|
|
and negative values indicate that the pathLenConstraints field should
|
|
|
|
|
not be present.
|
|
|
|
|
|
|
|
|
|
@var{policyLanguage}: OID describing the language of @code{policy}.
|
|
|
|
|
|
|
|
|
|
@var{policy}: opaque byte array with policy language, can be @code{NULL}
|
|
|
|
|
|
|
|
|
|
@var{sizeof_policy}: size of @code{policy}.
|
|
|
|
|
|
|
|
|
|
This function will set the proxyCertInfo extension.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_sign2
|
|
|
|
|
@anchor{gnutls_x509_crt_sign2}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_sign2} (gnutls_x509_crt_t @var{crt}, gnutls_x509_crt_t @var{issuer}, gnutls_x509_privkey_t @var{issuer_key}, gnutls_digest_algorithm_t @var{dig}, unsigned int @var{flags})
|
|
|
|
|
@var{crt}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{issuer}: is the certificate of the certificate issuer
|
|
|
|
|
|
|
|
|
|
@var{issuer_key}: holds the issuer's private key
|
|
|
|
|
|
|
|
|
|
@var{dig}: The message digest to use. GNUTLS_DIG_SHA1 is the safe choice unless you know what you're doing.
|
|
|
|
|
|
|
|
|
|
@var{flags}: must be 0
|
|
|
|
|
|
|
|
|
|
This function will sign the certificate with the issuer's private key, and
|
|
|
|
|
will copy the issuer's information into the certificate.
|
|
|
|
|
|
|
|
|
|
This must be the last step in a certificate generation since all
|
|
|
|
|
the previously set parameters are now signed.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_sign
|
|
|
|
|
@anchor{gnutls_x509_crt_sign}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_sign} (gnutls_x509_crt_t @var{crt}, gnutls_x509_crt_t @var{issuer}, gnutls_x509_privkey_t @var{issuer_key})
|
|
|
|
|
@var{crt}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{issuer}: is the certificate of the certificate issuer
|
|
|
|
|
|
|
|
|
|
@var{issuer_key}: holds the issuer's private key
|
|
|
|
|
|
|
|
|
|
This function is the same a @code{gnutls_x509_crt_sign2()} with no flags, and
|
|
|
|
|
SHA1 as the hash algorithm.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_set_activation_time
|
|
|
|
|
@anchor{gnutls_x509_crt_set_activation_time}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_set_activation_time} (gnutls_x509_crt_t @var{cert}, time_t @var{act_time})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{act_time}: The actual time
|
|
|
|
|
|
|
|
|
|
This function will set the time this Certificate was or will be activated.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success, or a negative value in case of an error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_set_expiration_time
|
|
|
|
|
@anchor{gnutls_x509_crt_set_expiration_time}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_set_expiration_time} (gnutls_x509_crt_t @var{cert}, time_t @var{exp_time})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{exp_time}: The actual time
|
|
|
|
|
|
|
|
|
|
This function will set the time this Certificate will expire.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success, or a negative value in case of an error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_set_serial
|
|
|
|
|
@anchor{gnutls_x509_crt_set_serial}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_set_serial} (gnutls_x509_crt_t @var{cert}, const void * @var{serial}, size_t @var{serial_size})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{serial}: The serial number
|
|
|
|
|
|
|
|
|
|
@var{serial_size}: Holds the size of the serial field.
|
|
|
|
|
|
|
|
|
|
This function will set the X.509 certificate's serial number.
|
|
|
|
|
Serial is not always a 32 or 64bit number. Some CAs use
|
|
|
|
|
large serial numbers, thus it may be wise to handle it as something
|
|
|
|
|
opaque.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success, or a negative value in case of an error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_set_crl_dist_points
|
|
|
|
|
@anchor{gnutls_x509_crt_set_crl_dist_points}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_set_crl_dist_points} (gnutls_x509_crt_t @var{crt}, gnutls_x509_subject_alt_name_t @var{type}, const void * @var{data_string}, unsigned int @var{reason_flags})
|
|
|
|
|
@var{crt}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{type}: is one of the gnutls_x509_subject_alt_name_t enumerations
|
|
|
|
|
|
|
|
|
|
@var{data_string}: The data to be set
|
|
|
|
|
|
|
|
|
|
@var{reason_flags}: revocation reasons
|
|
|
|
|
|
|
|
|
|
This function will set the CRL distribution points certificate extension.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_cpy_crl_dist_points
|
|
|
|
|
@anchor{gnutls_x509_crt_cpy_crl_dist_points}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_cpy_crl_dist_points} (gnutls_x509_crt_t @var{dst}, gnutls_x509_crt_t @var{src})
|
|
|
|
|
@var{dst}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{src}: the certificate where the dist points will be copied from
|
|
|
|
|
|
|
|
|
|
This function will copy the CRL distribution points certificate
|
|
|
|
|
extension, from the source to the destination certificate.
|
|
|
|
|
This may be useful to copy from a CA certificate to issued ones.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_set_subject_key_id
|
|
|
|
|
@anchor{gnutls_x509_crt_set_subject_key_id}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_set_subject_key_id} (gnutls_x509_crt_t @var{cert}, const void * @var{id}, size_t @var{id_size})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{id}: The key ID
|
|
|
|
|
|
|
|
|
|
@var{id_size}: Holds the size of the serial field.
|
|
|
|
|
|
|
|
|
|
This function will set the X.509 certificate's subject key ID extension.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success, or a negative value in case of an error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_set_authority_key_id
|
|
|
|
|
@anchor{gnutls_x509_crt_set_authority_key_id}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_set_authority_key_id} (gnutls_x509_crt_t @var{cert}, const void * @var{id}, size_t @var{id_size})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{id}: The key ID
|
|
|
|
|
|
|
|
|
|
@var{id_size}: Holds the size of the serial field.
|
|
|
|
|
|
|
|
|
|
This function will set the X.509 certificate's authority key ID extension.
|
|
|
|
|
Only the keyIdentifier field can be set with this function.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success, or a negative value in case of an error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_set_key_purpose_oid
|
|
|
|
|
@anchor{gnutls_x509_crt_set_key_purpose_oid}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_set_key_purpose_oid} (gnutls_x509_crt_t @var{cert}, const void * @var{oid}, unsigned int @var{critical})
|
|
|
|
|
@var{cert}: should contain a gnutls_x509_crt_t structure
|
|
|
|
|
|
|
|
|
|
@var{oid}: a pointer to a null terminated string that holds the OID
|
|
|
|
|
|
|
|
|
|
@var{critical}: Whether this extension will be critical or not
|
|
|
|
|
|
|
|
|
|
This function will set the key purpose OIDs of the Certificate.
|
|
|
|
|
These are stored in the Extended Key Usage extension (2.5.29.37)
|
|
|
|
|
See the GNUTLS_KP_* definitions for human readable names.
|
|
|
|
|
|
|
|
|
|
Subsequent calls to this function will append OIDs to the OID list.
|
|
|
|
|
|
|
|
|
|
On success 0 is returned.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_set_version
|
|
|
|
|
@anchor{gnutls_x509_crl_set_version}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_set_version} (gnutls_x509_crl_t @var{crl}, unsigned int @var{version})
|
|
|
|
|
@var{crl}: should contain a gnutls_x509_crl_t structure
|
|
|
|
|
|
|
|
|
|
@var{version}: holds the version number. For CRLv1 crls must be 1.
|
|
|
|
|
|
|
|
|
|
This function will set the version of the CRL. This
|
|
|
|
|
must be one for CRL version 1, and so on. The CRLs generated
|
|
|
|
|
by gnutls should have a version number of 2.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_sign2
|
|
|
|
|
@anchor{gnutls_x509_crl_sign2}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_sign2} (gnutls_x509_crl_t @var{crl}, gnutls_x509_crt_t @var{issuer}, gnutls_x509_privkey_t @var{issuer_key}, gnutls_digest_algorithm_t @var{dig}, unsigned int @var{flags})
|
|
|
|
|
@var{crl}: should contain a gnutls_x509_crl_t structure
|
|
|
|
|
|
|
|
|
|
@var{issuer}: is the certificate of the certificate issuer
|
|
|
|
|
|
|
|
|
|
@var{issuer_key}: holds the issuer's private key
|
|
|
|
|
|
|
|
|
|
@var{dig}: The message digest to use. GNUTLS_DIG_SHA1 is the safe choice unless you know what you're doing.
|
|
|
|
|
|
|
|
|
|
@var{flags}: must be 0
|
|
|
|
|
|
|
|
|
|
This function will sign the CRL with the issuer's private key, and
|
|
|
|
|
will copy the issuer's information into the CRL.
|
|
|
|
|
|
|
|
|
|
This must be the last step in a certificate CRL since all
|
|
|
|
|
the previously set parameters are now signed.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_sign
|
|
|
|
|
@anchor{gnutls_x509_crl_sign}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_sign} (gnutls_x509_crl_t @var{crl}, gnutls_x509_crt_t @var{issuer}, gnutls_x509_privkey_t @var{issuer_key})
|
|
|
|
|
@var{crl}: should contain a gnutls_x509_crl_t structure
|
|
|
|
|
|
|
|
|
|
@var{issuer}: is the certificate of the certificate issuer
|
|
|
|
|
|
|
|
|
|
@var{issuer_key}: holds the issuer's private key
|
|
|
|
|
|
|
|
|
|
This function is the same a @code{gnutls_x509_crl_sign2()} with no flags, and
|
|
|
|
|
SHA1 as the hash algorithm.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_set_this_update
|
|
|
|
|
@anchor{gnutls_x509_crl_set_this_update}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_set_this_update} (gnutls_x509_crl_t @var{crl}, time_t @var{act_time})
|
|
|
|
|
@var{crl}: should contain a gnutls_x509_crl_t structure
|
|
|
|
|
|
|
|
|
|
@var{act_time}: The actual time
|
|
|
|
|
|
|
|
|
|
This function will set the time this CRL was issued.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success, or a negative value in case of an error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_set_next_update
|
|
|
|
|
@anchor{gnutls_x509_crl_set_next_update}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_set_next_update} (gnutls_x509_crl_t @var{crl}, time_t @var{exp_time})
|
|
|
|
|
@var{crl}: should contain a gnutls_x509_crl_t structure
|
|
|
|
|
|
|
|
|
|
@var{exp_time}: The actual time
|
|
|
|
|
|
|
|
|
|
This function will set the time this CRL will be updated.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success, or a negative value in case of an error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_set_crt_serial
|
|
|
|
|
@anchor{gnutls_x509_crl_set_crt_serial}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_set_crt_serial} (gnutls_x509_crl_t @var{crl}, const void * @var{serial}, size_t @var{serial_size}, time_t @var{revocation_time})
|
|
|
|
|
@var{crl}: should contain a gnutls_x509_crl_t structure
|
|
|
|
|
|
|
|
|
|
@var{serial}: The revoked certificate's serial number
|
|
|
|
|
|
|
|
|
|
@var{serial_size}: Holds the size of the serial field.
|
|
|
|
|
|
|
|
|
|
@var{revocation_time}: The time this certificate was revoked
|
|
|
|
|
|
|
|
|
|
This function will set a revoked certificate's serial number to the CRL.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success, or a negative value in case of an error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_set_crt
|
|
|
|
|
@anchor{gnutls_x509_crl_set_crt}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_set_crt} (gnutls_x509_crl_t @var{crl}, gnutls_x509_crt_t @var{crt}, time_t @var{revocation_time})
|
|
|
|
|
@var{crl}: should contain a gnutls_x509_crl_t structure
|
|
|
|
|
|
|
|
|
|
@var{crt}: should contain a gnutls_x509_crt_t structure with the revoked certificate
|
|
|
|
|
|
|
|
|
|
@var{revocation_time}: The time this certificate was revoked
|
|
|
|
|
|
|
|
|
|
This function will set a revoked certificate's serial number to the CRL.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success, or a negative value in case of an error.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crt_print
|
|
|
|
|
@anchor{gnutls_x509_crt_print}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crt_print} (gnutls_x509_crt_t @var{cert}, gnutls_certificate_print_formats_t @var{format}, gnutls_datum_t * @var{out})
|
|
|
|
|
@var{cert}: The structure to be printed
|
|
|
|
|
|
|
|
|
|
@var{format}: Indicate the format to use
|
|
|
|
|
|
|
|
|
|
@var{out}: Newly allocated datum with zero terminated string.
|
|
|
|
|
|
|
|
|
|
This function will pretty print a X.509 certificate, suitable for
|
|
|
|
|
display to a human.
|
|
|
|
|
|
|
|
|
|
If the format is @code{GNUTLS_X509_CRT_FULL} then all fields of the
|
|
|
|
|
certificate will be output, on multiple lines. The
|
|
|
|
|
@code{GNUTLS_X509_CRT_ONELINE} format will generate one line with some
|
|
|
|
|
selected fields, which is useful for logging purposes.
|
|
|
|
|
|
|
|
|
|
The output @code{out} needs to be deallocate using @code{gnutls_free()}.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
|
|
|
|
@subheading gnutls_x509_crl_print
|
|
|
|
|
@anchor{gnutls_x509_crl_print}
|
|
|
|
|
@deftypefun {int} {gnutls_x509_crl_print} (gnutls_x509_crl_t @var{crl}, gnutls_certificate_print_formats_t @var{format}, gnutls_datum_t * @var{out})
|
|
|
|
|
@var{crl}: The structure to be printed
|
|
|
|
|
|
|
|
|
|
@var{format}: Indicate the format to use
|
|
|
|
|
|
|
|
|
|
@var{out}: Newly allocated datum with zero terminated string.
|
|
|
|
|
|
|
|
|
|
This function will pretty print a X.509 certificate revocation
|
|
|
|
|
list, suitable for display to a human.
|
|
|
|
|
|
|
|
|
|
The output @code{out} needs to be deallocate using @code{gnutls_free()}.
|
|
|
|
|
|
|
|
|
|
Returns 0 on success.
|
|
|
|
|
@end deftypefun
|
|
|
|
|
|
Christian Grothoff committed