mbed TLS library
Dependents: HTTPClient-SSL WS_SERVER
include/polarssl/x509_crt.h@0:137634ff4186, 2015-06-11 (annotated)
- Committer:
- ansond
- Date:
- Thu Jun 11 03:27:03 2015 +0000
- Revision:
- 0:137634ff4186
initial commit
Who changed what in which revision?
User | Revision | Line number | New contents of line |
---|---|---|---|
ansond | 0:137634ff4186 | 1 | /** |
ansond | 0:137634ff4186 | 2 | * \file x509_crt.h |
ansond | 0:137634ff4186 | 3 | * |
ansond | 0:137634ff4186 | 4 | * \brief X.509 certificate parsing and writing |
ansond | 0:137634ff4186 | 5 | * |
ansond | 0:137634ff4186 | 6 | * Copyright (C) 2006-2013, ARM Limited, All Rights Reserved |
ansond | 0:137634ff4186 | 7 | * |
ansond | 0:137634ff4186 | 8 | * This file is part of mbed TLS (https://tls.mbed.org) |
ansond | 0:137634ff4186 | 9 | * |
ansond | 0:137634ff4186 | 10 | * This program is free software; you can redistribute it and/or modify |
ansond | 0:137634ff4186 | 11 | * it under the terms of the GNU General Public License as published by |
ansond | 0:137634ff4186 | 12 | * the Free Software Foundation; either version 2 of the License, or |
ansond | 0:137634ff4186 | 13 | * (at your option) any later version. |
ansond | 0:137634ff4186 | 14 | * |
ansond | 0:137634ff4186 | 15 | * This program is distributed in the hope that it will be useful, |
ansond | 0:137634ff4186 | 16 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
ansond | 0:137634ff4186 | 17 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
ansond | 0:137634ff4186 | 18 | * GNU General Public License for more details. |
ansond | 0:137634ff4186 | 19 | * |
ansond | 0:137634ff4186 | 20 | * You should have received a copy of the GNU General Public License along |
ansond | 0:137634ff4186 | 21 | * with this program; if not, write to the Free Software Foundation, Inc., |
ansond | 0:137634ff4186 | 22 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
ansond | 0:137634ff4186 | 23 | */ |
ansond | 0:137634ff4186 | 24 | #ifndef POLARSSL_X509_CRT_H |
ansond | 0:137634ff4186 | 25 | #define POLARSSL_X509_CRT_H |
ansond | 0:137634ff4186 | 26 | |
ansond | 0:137634ff4186 | 27 | #if !defined(POLARSSL_CONFIG_FILE) |
ansond | 0:137634ff4186 | 28 | #include "config.h" |
ansond | 0:137634ff4186 | 29 | #else |
ansond | 0:137634ff4186 | 30 | #include POLARSSL_CONFIG_FILE |
ansond | 0:137634ff4186 | 31 | #endif |
ansond | 0:137634ff4186 | 32 | |
ansond | 0:137634ff4186 | 33 | #include "x509.h" |
ansond | 0:137634ff4186 | 34 | #include "x509_crl.h" |
ansond | 0:137634ff4186 | 35 | |
ansond | 0:137634ff4186 | 36 | /** |
ansond | 0:137634ff4186 | 37 | * \addtogroup x509_module |
ansond | 0:137634ff4186 | 38 | * \{ |
ansond | 0:137634ff4186 | 39 | */ |
ansond | 0:137634ff4186 | 40 | |
ansond | 0:137634ff4186 | 41 | #ifdef __cplusplus |
ansond | 0:137634ff4186 | 42 | extern "C" { |
ansond | 0:137634ff4186 | 43 | #endif |
ansond | 0:137634ff4186 | 44 | |
ansond | 0:137634ff4186 | 45 | /** |
ansond | 0:137634ff4186 | 46 | * \name Structures and functions for parsing and writing X.509 certificates |
ansond | 0:137634ff4186 | 47 | * \{ |
ansond | 0:137634ff4186 | 48 | */ |
ansond | 0:137634ff4186 | 49 | |
ansond | 0:137634ff4186 | 50 | /** |
ansond | 0:137634ff4186 | 51 | * Container for an X.509 certificate. The certificate may be chained. |
ansond | 0:137634ff4186 | 52 | */ |
ansond | 0:137634ff4186 | 53 | typedef struct _x509_crt |
ansond | 0:137634ff4186 | 54 | { |
ansond | 0:137634ff4186 | 55 | x509_buf raw; /**< The raw certificate data (DER). */ |
ansond | 0:137634ff4186 | 56 | x509_buf tbs; /**< The raw certificate body (DER). The part that is To Be Signed. */ |
ansond | 0:137634ff4186 | 57 | |
ansond | 0:137634ff4186 | 58 | int version; /**< The X.509 version. (1=v1, 2=v2, 3=v3) */ |
ansond | 0:137634ff4186 | 59 | x509_buf serial; /**< Unique id for certificate issued by a specific CA. */ |
ansond | 0:137634ff4186 | 60 | x509_buf sig_oid1; /**< Signature algorithm, e.g. sha1RSA */ |
ansond | 0:137634ff4186 | 61 | |
ansond | 0:137634ff4186 | 62 | x509_buf issuer_raw; /**< The raw issuer data (DER). Used for quick comparison. */ |
ansond | 0:137634ff4186 | 63 | x509_buf subject_raw; /**< The raw subject data (DER). Used for quick comparison. */ |
ansond | 0:137634ff4186 | 64 | |
ansond | 0:137634ff4186 | 65 | x509_name issuer; /**< The parsed issuer data (named information object). */ |
ansond | 0:137634ff4186 | 66 | x509_name subject; /**< The parsed subject data (named information object). */ |
ansond | 0:137634ff4186 | 67 | |
ansond | 0:137634ff4186 | 68 | x509_time valid_from; /**< Start time of certificate validity. */ |
ansond | 0:137634ff4186 | 69 | x509_time valid_to; /**< End time of certificate validity. */ |
ansond | 0:137634ff4186 | 70 | |
ansond | 0:137634ff4186 | 71 | pk_context pk; /**< Container for the public key context. */ |
ansond | 0:137634ff4186 | 72 | |
ansond | 0:137634ff4186 | 73 | x509_buf issuer_id; /**< Optional X.509 v2/v3 issuer unique identifier. */ |
ansond | 0:137634ff4186 | 74 | x509_buf subject_id; /**< Optional X.509 v2/v3 subject unique identifier. */ |
ansond | 0:137634ff4186 | 75 | x509_buf v3_ext; /**< Optional X.509 v3 extensions. */ |
ansond | 0:137634ff4186 | 76 | x509_sequence subject_alt_names; /**< Optional list of Subject Alternative Names (Only dNSName supported). */ |
ansond | 0:137634ff4186 | 77 | |
ansond | 0:137634ff4186 | 78 | int ext_types; /**< Bit string containing detected and parsed extensions */ |
ansond | 0:137634ff4186 | 79 | int ca_istrue; /**< Optional Basic Constraint extension value: 1 if this certificate belongs to a CA, 0 otherwise. */ |
ansond | 0:137634ff4186 | 80 | int max_pathlen; /**< Optional Basic Constraint extension value: The maximum path length to the root certificate. Path length is 1 higher than RFC 5280 'meaning', so 1+ */ |
ansond | 0:137634ff4186 | 81 | |
ansond | 0:137634ff4186 | 82 | unsigned char key_usage; /**< Optional key usage extension value: See the values in x509.h */ |
ansond | 0:137634ff4186 | 83 | |
ansond | 0:137634ff4186 | 84 | x509_sequence ext_key_usage; /**< Optional list of extended key usage OIDs. */ |
ansond | 0:137634ff4186 | 85 | |
ansond | 0:137634ff4186 | 86 | unsigned char ns_cert_type; /**< Optional Netscape certificate type extension value: See the values in x509.h */ |
ansond | 0:137634ff4186 | 87 | |
ansond | 0:137634ff4186 | 88 | x509_buf sig_oid2; /**< Signature algorithm. Must match sig_oid1. */ |
ansond | 0:137634ff4186 | 89 | x509_buf sig; /**< Signature: hash of the tbs part signed with the private key. */ |
ansond | 0:137634ff4186 | 90 | md_type_t sig_md; /**< Internal representation of the MD algorithm of the signature algorithm, e.g. POLARSSL_MD_SHA256 */ |
ansond | 0:137634ff4186 | 91 | pk_type_t sig_pk; /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. POLARSSL_PK_RSA */ |
ansond | 0:137634ff4186 | 92 | void *sig_opts; /**< Signature options to be passed to pk_verify_ext(), e.g. for RSASSA-PSS */ |
ansond | 0:137634ff4186 | 93 | |
ansond | 0:137634ff4186 | 94 | struct _x509_crt *next; /**< Next certificate in the CA-chain. */ |
ansond | 0:137634ff4186 | 95 | } |
ansond | 0:137634ff4186 | 96 | x509_crt; |
ansond | 0:137634ff4186 | 97 | |
ansond | 0:137634ff4186 | 98 | #define X509_CRT_VERSION_1 0 |
ansond | 0:137634ff4186 | 99 | #define X509_CRT_VERSION_2 1 |
ansond | 0:137634ff4186 | 100 | #define X509_CRT_VERSION_3 2 |
ansond | 0:137634ff4186 | 101 | |
ansond | 0:137634ff4186 | 102 | #define X509_RFC5280_MAX_SERIAL_LEN 32 |
ansond | 0:137634ff4186 | 103 | #define X509_RFC5280_UTC_TIME_LEN 15 |
ansond | 0:137634ff4186 | 104 | |
ansond | 0:137634ff4186 | 105 | /** |
ansond | 0:137634ff4186 | 106 | * Container for writing a certificate (CRT) |
ansond | 0:137634ff4186 | 107 | */ |
ansond | 0:137634ff4186 | 108 | typedef struct _x509write_cert |
ansond | 0:137634ff4186 | 109 | { |
ansond | 0:137634ff4186 | 110 | int version; |
ansond | 0:137634ff4186 | 111 | mpi serial; |
ansond | 0:137634ff4186 | 112 | pk_context *subject_key; |
ansond | 0:137634ff4186 | 113 | pk_context *issuer_key; |
ansond | 0:137634ff4186 | 114 | asn1_named_data *subject; |
ansond | 0:137634ff4186 | 115 | asn1_named_data *issuer; |
ansond | 0:137634ff4186 | 116 | md_type_t md_alg; |
ansond | 0:137634ff4186 | 117 | char not_before[X509_RFC5280_UTC_TIME_LEN + 1]; |
ansond | 0:137634ff4186 | 118 | char not_after[X509_RFC5280_UTC_TIME_LEN + 1]; |
ansond | 0:137634ff4186 | 119 | asn1_named_data *extensions; |
ansond | 0:137634ff4186 | 120 | } |
ansond | 0:137634ff4186 | 121 | x509write_cert; |
ansond | 0:137634ff4186 | 122 | |
ansond | 0:137634ff4186 | 123 | #if defined(POLARSSL_X509_CRT_PARSE_C) |
ansond | 0:137634ff4186 | 124 | /** |
ansond | 0:137634ff4186 | 125 | * \brief Parse a single DER formatted certificate and add it |
ansond | 0:137634ff4186 | 126 | * to the chained list. |
ansond | 0:137634ff4186 | 127 | * |
ansond | 0:137634ff4186 | 128 | * \param chain points to the start of the chain |
ansond | 0:137634ff4186 | 129 | * \param buf buffer holding the certificate DER data |
ansond | 0:137634ff4186 | 130 | * \param buflen size of the buffer |
ansond | 0:137634ff4186 | 131 | * |
ansond | 0:137634ff4186 | 132 | * \return 0 if successful, or a specific X509 or PEM error code |
ansond | 0:137634ff4186 | 133 | */ |
ansond | 0:137634ff4186 | 134 | int x509_crt_parse_der( x509_crt *chain, const unsigned char *buf, |
ansond | 0:137634ff4186 | 135 | size_t buflen ); |
ansond | 0:137634ff4186 | 136 | |
ansond | 0:137634ff4186 | 137 | /** |
ansond | 0:137634ff4186 | 138 | * \brief Parse one or more certificates and add them |
ansond | 0:137634ff4186 | 139 | * to the chained list. Parses permissively. If some |
ansond | 0:137634ff4186 | 140 | * certificates can be parsed, the result is the number |
ansond | 0:137634ff4186 | 141 | * of failed certificates it encountered. If none complete |
ansond | 0:137634ff4186 | 142 | * correctly, the first error is returned. |
ansond | 0:137634ff4186 | 143 | * |
ansond | 0:137634ff4186 | 144 | * \param chain points to the start of the chain |
ansond | 0:137634ff4186 | 145 | * \param buf buffer holding the certificate data |
ansond | 0:137634ff4186 | 146 | * \param buflen size of the buffer |
ansond | 0:137634ff4186 | 147 | * |
ansond | 0:137634ff4186 | 148 | * \return 0 if all certificates parsed successfully, a positive number |
ansond | 0:137634ff4186 | 149 | * if partly successful or a specific X509 or PEM error code |
ansond | 0:137634ff4186 | 150 | */ |
ansond | 0:137634ff4186 | 151 | int x509_crt_parse( x509_crt *chain, const unsigned char *buf, size_t buflen ); |
ansond | 0:137634ff4186 | 152 | |
ansond | 0:137634ff4186 | 153 | #if defined(POLARSSL_FS_IO) |
ansond | 0:137634ff4186 | 154 | /** |
ansond | 0:137634ff4186 | 155 | * \brief Load one or more certificates and add them |
ansond | 0:137634ff4186 | 156 | * to the chained list. Parses permissively. If some |
ansond | 0:137634ff4186 | 157 | * certificates can be parsed, the result is the number |
ansond | 0:137634ff4186 | 158 | * of failed certificates it encountered. If none complete |
ansond | 0:137634ff4186 | 159 | * correctly, the first error is returned. |
ansond | 0:137634ff4186 | 160 | * |
ansond | 0:137634ff4186 | 161 | * \param chain points to the start of the chain |
ansond | 0:137634ff4186 | 162 | * \param path filename to read the certificates from |
ansond | 0:137634ff4186 | 163 | * |
ansond | 0:137634ff4186 | 164 | * \return 0 if all certificates parsed successfully, a positive number |
ansond | 0:137634ff4186 | 165 | * if partly successful or a specific X509 or PEM error code |
ansond | 0:137634ff4186 | 166 | */ |
ansond | 0:137634ff4186 | 167 | int x509_crt_parse_file( x509_crt *chain, const char *path ); |
ansond | 0:137634ff4186 | 168 | |
ansond | 0:137634ff4186 | 169 | /** |
ansond | 0:137634ff4186 | 170 | * \brief Load one or more certificate files from a path and add them |
ansond | 0:137634ff4186 | 171 | * to the chained list. Parses permissively. If some |
ansond | 0:137634ff4186 | 172 | * certificates can be parsed, the result is the number |
ansond | 0:137634ff4186 | 173 | * of failed certificates it encountered. If none complete |
ansond | 0:137634ff4186 | 174 | * correctly, the first error is returned. |
ansond | 0:137634ff4186 | 175 | * |
ansond | 0:137634ff4186 | 176 | * \warning This function is NOT thread-safe unless |
ansond | 0:137634ff4186 | 177 | * POLARSSL_THREADING_PTHREADS is defined. If you're using an |
ansond | 0:137634ff4186 | 178 | * alternative threading implementation, you should either use |
ansond | 0:137634ff4186 | 179 | * this function only in the main thread, or mutex it. |
ansond | 0:137634ff4186 | 180 | * |
ansond | 0:137634ff4186 | 181 | * \param chain points to the start of the chain |
ansond | 0:137634ff4186 | 182 | * \param path directory / folder to read the certificate files from |
ansond | 0:137634ff4186 | 183 | * |
ansond | 0:137634ff4186 | 184 | * \return 0 if all certificates parsed successfully, a positive number |
ansond | 0:137634ff4186 | 185 | * if partly successful or a specific X509 or PEM error code |
ansond | 0:137634ff4186 | 186 | */ |
ansond | 0:137634ff4186 | 187 | int x509_crt_parse_path( x509_crt *chain, const char *path ); |
ansond | 0:137634ff4186 | 188 | #endif /* POLARSSL_FS_IO */ |
ansond | 0:137634ff4186 | 189 | |
ansond | 0:137634ff4186 | 190 | /** |
ansond | 0:137634ff4186 | 191 | * \brief Returns an informational string about the |
ansond | 0:137634ff4186 | 192 | * certificate. |
ansond | 0:137634ff4186 | 193 | * |
ansond | 0:137634ff4186 | 194 | * \param buf Buffer to write to |
ansond | 0:137634ff4186 | 195 | * \param size Maximum size of buffer |
ansond | 0:137634ff4186 | 196 | * \param prefix A line prefix |
ansond | 0:137634ff4186 | 197 | * \param crt The X509 certificate to represent |
ansond | 0:137634ff4186 | 198 | * |
ansond | 0:137634ff4186 | 199 | * \return The amount of data written to the buffer, or -1 in |
ansond | 0:137634ff4186 | 200 | * case of an error. |
ansond | 0:137634ff4186 | 201 | */ |
ansond | 0:137634ff4186 | 202 | int x509_crt_info( char *buf, size_t size, const char *prefix, |
ansond | 0:137634ff4186 | 203 | const x509_crt *crt ); |
ansond | 0:137634ff4186 | 204 | |
ansond | 0:137634ff4186 | 205 | /** |
ansond | 0:137634ff4186 | 206 | * \brief Returns an informational string about the |
ansond | 0:137634ff4186 | 207 | * verification status of a certificate. |
ansond | 0:137634ff4186 | 208 | * |
ansond | 0:137634ff4186 | 209 | * \param buf Buffer to write to |
ansond | 0:137634ff4186 | 210 | * \param size Maximum size of buffer |
ansond | 0:137634ff4186 | 211 | * \param prefix A line prefix |
ansond | 0:137634ff4186 | 212 | * \param flags Verification flags created by x509_crt_verify() |
ansond | 0:137634ff4186 | 213 | * |
ansond | 0:137634ff4186 | 214 | * \return The amount of data written to the buffer, or -1 in |
ansond | 0:137634ff4186 | 215 | * case of an error. |
ansond | 0:137634ff4186 | 216 | */ |
ansond | 0:137634ff4186 | 217 | int x509_crt_verify_info( char *buf, size_t size, const char *prefix, |
ansond | 0:137634ff4186 | 218 | int flags ); |
ansond | 0:137634ff4186 | 219 | |
ansond | 0:137634ff4186 | 220 | /** |
ansond | 0:137634ff4186 | 221 | * \brief Verify the certificate signature |
ansond | 0:137634ff4186 | 222 | * |
ansond | 0:137634ff4186 | 223 | * The verify callback is a user-supplied callback that |
ansond | 0:137634ff4186 | 224 | * can clear / modify / add flags for a certificate. If set, |
ansond | 0:137634ff4186 | 225 | * the verification callback is called for each |
ansond | 0:137634ff4186 | 226 | * certificate in the chain (from the trust-ca down to the |
ansond | 0:137634ff4186 | 227 | * presented crt). The parameters for the callback are: |
ansond | 0:137634ff4186 | 228 | * (void *parameter, x509_crt *crt, int certificate_depth, |
ansond | 0:137634ff4186 | 229 | * int *flags). With the flags representing current flags for |
ansond | 0:137634ff4186 | 230 | * that specific certificate and the certificate depth from |
ansond | 0:137634ff4186 | 231 | * the bottom (Peer cert depth = 0). |
ansond | 0:137634ff4186 | 232 | * |
ansond | 0:137634ff4186 | 233 | * All flags left after returning from the callback |
ansond | 0:137634ff4186 | 234 | * are also returned to the application. The function should |
ansond | 0:137634ff4186 | 235 | * return 0 for anything but a fatal error. |
ansond | 0:137634ff4186 | 236 | * |
ansond | 0:137634ff4186 | 237 | * \note In case verification failed, the results can be displayed |
ansond | 0:137634ff4186 | 238 | * using \c x509_crt_verify_info() |
ansond | 0:137634ff4186 | 239 | * |
ansond | 0:137634ff4186 | 240 | * \param crt a certificate to be verified |
ansond | 0:137634ff4186 | 241 | * \param trust_ca the trusted CA chain |
ansond | 0:137634ff4186 | 242 | * \param ca_crl the CRL chain for trusted CA's |
ansond | 0:137634ff4186 | 243 | * \param cn expected Common Name (can be set to |
ansond | 0:137634ff4186 | 244 | * NULL if the CN must not be verified) |
ansond | 0:137634ff4186 | 245 | * \param flags result of the verification |
ansond | 0:137634ff4186 | 246 | * \param f_vrfy verification function |
ansond | 0:137634ff4186 | 247 | * \param p_vrfy verification parameter |
ansond | 0:137634ff4186 | 248 | * |
ansond | 0:137634ff4186 | 249 | * \return 0 if successful or POLARSSL_ERR_X509_SIG_VERIFY_FAILED, |
ansond | 0:137634ff4186 | 250 | * in which case *flags will have one or more BADCERT_XXX or |
ansond | 0:137634ff4186 | 251 | * BADCRL_XXX flags set, |
ansond | 0:137634ff4186 | 252 | * or another error in case of a fatal error encountered |
ansond | 0:137634ff4186 | 253 | * during the verification process. |
ansond | 0:137634ff4186 | 254 | */ |
ansond | 0:137634ff4186 | 255 | int x509_crt_verify( x509_crt *crt, |
ansond | 0:137634ff4186 | 256 | x509_crt *trust_ca, |
ansond | 0:137634ff4186 | 257 | x509_crl *ca_crl, |
ansond | 0:137634ff4186 | 258 | const char *cn, int *flags, |
ansond | 0:137634ff4186 | 259 | int (*f_vrfy)(void *, x509_crt *, int, int *), |
ansond | 0:137634ff4186 | 260 | void *p_vrfy ); |
ansond | 0:137634ff4186 | 261 | |
ansond | 0:137634ff4186 | 262 | #if defined(POLARSSL_X509_CHECK_KEY_USAGE) |
ansond | 0:137634ff4186 | 263 | /** |
ansond | 0:137634ff4186 | 264 | * \brief Check usage of certificate against keyUsage extension. |
ansond | 0:137634ff4186 | 265 | * |
ansond | 0:137634ff4186 | 266 | * \param crt Leaf certificate used. |
ansond | 0:137634ff4186 | 267 | * \param usage Intended usage(s) (eg KU_KEY_ENCIPHERMENT before using the |
ansond | 0:137634ff4186 | 268 | * certificate to perform an RSA key exchange). |
ansond | 0:137634ff4186 | 269 | * |
ansond | 0:137634ff4186 | 270 | * \return 0 is these uses of the certificate are allowed, |
ansond | 0:137634ff4186 | 271 | * POLARSSL_ERR_X509_BAD_INPUT_DATA if the keyUsage extension |
ansond | 0:137634ff4186 | 272 | * is present but does not contain all the bits set in the |
ansond | 0:137634ff4186 | 273 | * usage argument. |
ansond | 0:137634ff4186 | 274 | * |
ansond | 0:137634ff4186 | 275 | * \note You should only call this function on leaf certificates, on |
ansond | 0:137634ff4186 | 276 | * (intermediate) CAs the keyUsage extension is automatically |
ansond | 0:137634ff4186 | 277 | * checked by \c x509_crt_verify(). |
ansond | 0:137634ff4186 | 278 | */ |
ansond | 0:137634ff4186 | 279 | int x509_crt_check_key_usage( const x509_crt *crt, int usage ); |
ansond | 0:137634ff4186 | 280 | #endif /* POLARSSL_X509_CHECK_KEY_USAGE) */ |
ansond | 0:137634ff4186 | 281 | |
ansond | 0:137634ff4186 | 282 | #if defined(POLARSSL_X509_CHECK_EXTENDED_KEY_USAGE) |
ansond | 0:137634ff4186 | 283 | /** |
ansond | 0:137634ff4186 | 284 | * \brief Check usage of certificate against extentedJeyUsage. |
ansond | 0:137634ff4186 | 285 | * |
ansond | 0:137634ff4186 | 286 | * \param crt Leaf certificate used. |
ansond | 0:137634ff4186 | 287 | * \param usage_oid Intended usage (eg OID_SERVER_AUTH or OID_CLIENT_AUTH). |
ansond | 0:137634ff4186 | 288 | * \param usage_len Length of usage_oid (eg given by OID_SIZE()). |
ansond | 0:137634ff4186 | 289 | * |
ansond | 0:137634ff4186 | 290 | * \return 0 is this use of the certificate is allowed, |
ansond | 0:137634ff4186 | 291 | * POLARSSL_ERR_X509_BAD_INPUT_DATA if not. |
ansond | 0:137634ff4186 | 292 | * |
ansond | 0:137634ff4186 | 293 | * \note Usually only makes sense on leaf certificates. |
ansond | 0:137634ff4186 | 294 | */ |
ansond | 0:137634ff4186 | 295 | int x509_crt_check_extended_key_usage( const x509_crt *crt, |
ansond | 0:137634ff4186 | 296 | const char *usage_oid, |
ansond | 0:137634ff4186 | 297 | size_t usage_len ); |
ansond | 0:137634ff4186 | 298 | #endif /* POLARSSL_X509_CHECK_EXTENDED_KEY_USAGE) */ |
ansond | 0:137634ff4186 | 299 | |
ansond | 0:137634ff4186 | 300 | #if defined(POLARSSL_X509_CRL_PARSE_C) |
ansond | 0:137634ff4186 | 301 | /** |
ansond | 0:137634ff4186 | 302 | * \brief Verify the certificate revocation status |
ansond | 0:137634ff4186 | 303 | * |
ansond | 0:137634ff4186 | 304 | * \param crt a certificate to be verified |
ansond | 0:137634ff4186 | 305 | * \param crl the CRL to verify against |
ansond | 0:137634ff4186 | 306 | * |
ansond | 0:137634ff4186 | 307 | * \return 1 if the certificate is revoked, 0 otherwise |
ansond | 0:137634ff4186 | 308 | * |
ansond | 0:137634ff4186 | 309 | */ |
ansond | 0:137634ff4186 | 310 | int x509_crt_revoked( const x509_crt *crt, const x509_crl *crl ); |
ansond | 0:137634ff4186 | 311 | #endif /* POLARSSL_X509_CRL_PARSE_C */ |
ansond | 0:137634ff4186 | 312 | |
ansond | 0:137634ff4186 | 313 | /** |
ansond | 0:137634ff4186 | 314 | * \brief Initialize a certificate (chain) |
ansond | 0:137634ff4186 | 315 | * |
ansond | 0:137634ff4186 | 316 | * \param crt Certificate chain to initialize |
ansond | 0:137634ff4186 | 317 | */ |
ansond | 0:137634ff4186 | 318 | void x509_crt_init( x509_crt *crt ); |
ansond | 0:137634ff4186 | 319 | |
ansond | 0:137634ff4186 | 320 | /** |
ansond | 0:137634ff4186 | 321 | * \brief Unallocate all certificate data |
ansond | 0:137634ff4186 | 322 | * |
ansond | 0:137634ff4186 | 323 | * \param crt Certificate chain to free |
ansond | 0:137634ff4186 | 324 | */ |
ansond | 0:137634ff4186 | 325 | void x509_crt_free( x509_crt *crt ); |
ansond | 0:137634ff4186 | 326 | #endif /* POLARSSL_X509_CRT_PARSE_C */ |
ansond | 0:137634ff4186 | 327 | |
ansond | 0:137634ff4186 | 328 | /* \} name */ |
ansond | 0:137634ff4186 | 329 | /* \} addtogroup x509_module */ |
ansond | 0:137634ff4186 | 330 | |
ansond | 0:137634ff4186 | 331 | #if defined(POLARSSL_X509_CRT_WRITE_C) |
ansond | 0:137634ff4186 | 332 | /** |
ansond | 0:137634ff4186 | 333 | * \brief Initialize a CRT writing context |
ansond | 0:137634ff4186 | 334 | * |
ansond | 0:137634ff4186 | 335 | * \param ctx CRT context to initialize |
ansond | 0:137634ff4186 | 336 | */ |
ansond | 0:137634ff4186 | 337 | void x509write_crt_init( x509write_cert *ctx ); |
ansond | 0:137634ff4186 | 338 | |
ansond | 0:137634ff4186 | 339 | /** |
ansond | 0:137634ff4186 | 340 | * \brief Set the verion for a Certificate |
ansond | 0:137634ff4186 | 341 | * Default: X509_CRT_VERSION_3 |
ansond | 0:137634ff4186 | 342 | * |
ansond | 0:137634ff4186 | 343 | * \param ctx CRT context to use |
ansond | 0:137634ff4186 | 344 | * \param version version to set (X509_CRT_VERSION_1, X509_CRT_VERSION_2 or |
ansond | 0:137634ff4186 | 345 | * X509_CRT_VERSION_3) |
ansond | 0:137634ff4186 | 346 | */ |
ansond | 0:137634ff4186 | 347 | void x509write_crt_set_version( x509write_cert *ctx, int version ); |
ansond | 0:137634ff4186 | 348 | |
ansond | 0:137634ff4186 | 349 | /** |
ansond | 0:137634ff4186 | 350 | * \brief Set the serial number for a Certificate. |
ansond | 0:137634ff4186 | 351 | * |
ansond | 0:137634ff4186 | 352 | * \param ctx CRT context to use |
ansond | 0:137634ff4186 | 353 | * \param serial serial number to set |
ansond | 0:137634ff4186 | 354 | * |
ansond | 0:137634ff4186 | 355 | * \return 0 if successful |
ansond | 0:137634ff4186 | 356 | */ |
ansond | 0:137634ff4186 | 357 | int x509write_crt_set_serial( x509write_cert *ctx, const mpi *serial ); |
ansond | 0:137634ff4186 | 358 | |
ansond | 0:137634ff4186 | 359 | /** |
ansond | 0:137634ff4186 | 360 | * \brief Set the validity period for a Certificate |
ansond | 0:137634ff4186 | 361 | * Timestamps should be in string format for UTC timezone |
ansond | 0:137634ff4186 | 362 | * i.e. "YYYYMMDDhhmmss" |
ansond | 0:137634ff4186 | 363 | * e.g. "20131231235959" for December 31st 2013 |
ansond | 0:137634ff4186 | 364 | * at 23:59:59 |
ansond | 0:137634ff4186 | 365 | * |
ansond | 0:137634ff4186 | 366 | * \param ctx CRT context to use |
ansond | 0:137634ff4186 | 367 | * \param not_before not_before timestamp |
ansond | 0:137634ff4186 | 368 | * \param not_after not_after timestamp |
ansond | 0:137634ff4186 | 369 | * |
ansond | 0:137634ff4186 | 370 | * \return 0 if timestamp was parsed successfully, or |
ansond | 0:137634ff4186 | 371 | * a specific error code |
ansond | 0:137634ff4186 | 372 | */ |
ansond | 0:137634ff4186 | 373 | int x509write_crt_set_validity( x509write_cert *ctx, const char *not_before, |
ansond | 0:137634ff4186 | 374 | const char *not_after ); |
ansond | 0:137634ff4186 | 375 | |
ansond | 0:137634ff4186 | 376 | /** |
ansond | 0:137634ff4186 | 377 | * \brief Set the issuer name for a Certificate |
ansond | 0:137634ff4186 | 378 | * Issuer names should contain a comma-separated list |
ansond | 0:137634ff4186 | 379 | * of OID types and values: |
ansond | 0:137634ff4186 | 380 | * e.g. "C=UK,O=ARM,CN=mbed TLS CA" |
ansond | 0:137634ff4186 | 381 | * |
ansond | 0:137634ff4186 | 382 | * \param ctx CRT context to use |
ansond | 0:137634ff4186 | 383 | * \param issuer_name issuer name to set |
ansond | 0:137634ff4186 | 384 | * |
ansond | 0:137634ff4186 | 385 | * \return 0 if issuer name was parsed successfully, or |
ansond | 0:137634ff4186 | 386 | * a specific error code |
ansond | 0:137634ff4186 | 387 | */ |
ansond | 0:137634ff4186 | 388 | int x509write_crt_set_issuer_name( x509write_cert *ctx, |
ansond | 0:137634ff4186 | 389 | const char *issuer_name ); |
ansond | 0:137634ff4186 | 390 | |
ansond | 0:137634ff4186 | 391 | /** |
ansond | 0:137634ff4186 | 392 | * \brief Set the subject name for a Certificate |
ansond | 0:137634ff4186 | 393 | * Subject names should contain a comma-separated list |
ansond | 0:137634ff4186 | 394 | * of OID types and values: |
ansond | 0:137634ff4186 | 395 | * e.g. "C=UK,O=ARM,CN=mbed TLS Server 1" |
ansond | 0:137634ff4186 | 396 | * |
ansond | 0:137634ff4186 | 397 | * \param ctx CRT context to use |
ansond | 0:137634ff4186 | 398 | * \param subject_name subject name to set |
ansond | 0:137634ff4186 | 399 | * |
ansond | 0:137634ff4186 | 400 | * \return 0 if subject name was parsed successfully, or |
ansond | 0:137634ff4186 | 401 | * a specific error code |
ansond | 0:137634ff4186 | 402 | */ |
ansond | 0:137634ff4186 | 403 | int x509write_crt_set_subject_name( x509write_cert *ctx, |
ansond | 0:137634ff4186 | 404 | const char *subject_name ); |
ansond | 0:137634ff4186 | 405 | |
ansond | 0:137634ff4186 | 406 | /** |
ansond | 0:137634ff4186 | 407 | * \brief Set the subject public key for the certificate |
ansond | 0:137634ff4186 | 408 | * |
ansond | 0:137634ff4186 | 409 | * \param ctx CRT context to use |
ansond | 0:137634ff4186 | 410 | * \param key public key to include |
ansond | 0:137634ff4186 | 411 | */ |
ansond | 0:137634ff4186 | 412 | void x509write_crt_set_subject_key( x509write_cert *ctx, pk_context *key ); |
ansond | 0:137634ff4186 | 413 | |
ansond | 0:137634ff4186 | 414 | /** |
ansond | 0:137634ff4186 | 415 | * \brief Set the issuer key used for signing the certificate |
ansond | 0:137634ff4186 | 416 | * |
ansond | 0:137634ff4186 | 417 | * \param ctx CRT context to use |
ansond | 0:137634ff4186 | 418 | * \param key private key to sign with |
ansond | 0:137634ff4186 | 419 | */ |
ansond | 0:137634ff4186 | 420 | void x509write_crt_set_issuer_key( x509write_cert *ctx, pk_context *key ); |
ansond | 0:137634ff4186 | 421 | |
ansond | 0:137634ff4186 | 422 | /** |
ansond | 0:137634ff4186 | 423 | * \brief Set the MD algorithm to use for the signature |
ansond | 0:137634ff4186 | 424 | * (e.g. POLARSSL_MD_SHA1) |
ansond | 0:137634ff4186 | 425 | * |
ansond | 0:137634ff4186 | 426 | * \param ctx CRT context to use |
ansond | 0:137634ff4186 | 427 | * \param md_alg MD algorithm to use |
ansond | 0:137634ff4186 | 428 | */ |
ansond | 0:137634ff4186 | 429 | void x509write_crt_set_md_alg( x509write_cert *ctx, md_type_t md_alg ); |
ansond | 0:137634ff4186 | 430 | |
ansond | 0:137634ff4186 | 431 | /** |
ansond | 0:137634ff4186 | 432 | * \brief Generic function to add to or replace an extension in the |
ansond | 0:137634ff4186 | 433 | * CRT |
ansond | 0:137634ff4186 | 434 | * |
ansond | 0:137634ff4186 | 435 | * \param ctx CRT context to use |
ansond | 0:137634ff4186 | 436 | * \param oid OID of the extension |
ansond | 0:137634ff4186 | 437 | * \param oid_len length of the OID |
ansond | 0:137634ff4186 | 438 | * \param critical if the extension is critical (per the RFC's definition) |
ansond | 0:137634ff4186 | 439 | * \param val value of the extension OCTET STRING |
ansond | 0:137634ff4186 | 440 | * \param val_len length of the value data |
ansond | 0:137634ff4186 | 441 | * |
ansond | 0:137634ff4186 | 442 | * \return 0 if successful, or a POLARSSL_ERR_X509WRITE_MALLOC_FAILED |
ansond | 0:137634ff4186 | 443 | */ |
ansond | 0:137634ff4186 | 444 | int x509write_crt_set_extension( x509write_cert *ctx, |
ansond | 0:137634ff4186 | 445 | const char *oid, size_t oid_len, |
ansond | 0:137634ff4186 | 446 | int critical, |
ansond | 0:137634ff4186 | 447 | const unsigned char *val, size_t val_len ); |
ansond | 0:137634ff4186 | 448 | |
ansond | 0:137634ff4186 | 449 | /** |
ansond | 0:137634ff4186 | 450 | * \brief Set the basicConstraints extension for a CRT |
ansond | 0:137634ff4186 | 451 | * |
ansond | 0:137634ff4186 | 452 | * \param ctx CRT context to use |
ansond | 0:137634ff4186 | 453 | * \param is_ca is this a CA certificate |
ansond | 0:137634ff4186 | 454 | * \param max_pathlen maximum length of certificate chains below this |
ansond | 0:137634ff4186 | 455 | * certificate (only for CA certificates, -1 is |
ansond | 0:137634ff4186 | 456 | * inlimited) |
ansond | 0:137634ff4186 | 457 | * |
ansond | 0:137634ff4186 | 458 | * \return 0 if successful, or a POLARSSL_ERR_X509WRITE_MALLOC_FAILED |
ansond | 0:137634ff4186 | 459 | */ |
ansond | 0:137634ff4186 | 460 | int x509write_crt_set_basic_constraints( x509write_cert *ctx, |
ansond | 0:137634ff4186 | 461 | int is_ca, int max_pathlen ); |
ansond | 0:137634ff4186 | 462 | |
ansond | 0:137634ff4186 | 463 | #if defined(POLARSSL_SHA1_C) |
ansond | 0:137634ff4186 | 464 | /** |
ansond | 0:137634ff4186 | 465 | * \brief Set the subjectKeyIdentifier extension for a CRT |
ansond | 0:137634ff4186 | 466 | * Requires that x509write_crt_set_subject_key() has been |
ansond | 0:137634ff4186 | 467 | * called before |
ansond | 0:137634ff4186 | 468 | * |
ansond | 0:137634ff4186 | 469 | * \param ctx CRT context to use |
ansond | 0:137634ff4186 | 470 | * |
ansond | 0:137634ff4186 | 471 | * \return 0 if successful, or a POLARSSL_ERR_X509WRITE_MALLOC_FAILED |
ansond | 0:137634ff4186 | 472 | */ |
ansond | 0:137634ff4186 | 473 | int x509write_crt_set_subject_key_identifier( x509write_cert *ctx ); |
ansond | 0:137634ff4186 | 474 | |
ansond | 0:137634ff4186 | 475 | /** |
ansond | 0:137634ff4186 | 476 | * \brief Set the authorityKeyIdentifier extension for a CRT |
ansond | 0:137634ff4186 | 477 | * Requires that x509write_crt_set_issuer_key() has been |
ansond | 0:137634ff4186 | 478 | * called before |
ansond | 0:137634ff4186 | 479 | * |
ansond | 0:137634ff4186 | 480 | * \param ctx CRT context to use |
ansond | 0:137634ff4186 | 481 | * |
ansond | 0:137634ff4186 | 482 | * \return 0 if successful, or a POLARSSL_ERR_X509WRITE_MALLOC_FAILED |
ansond | 0:137634ff4186 | 483 | */ |
ansond | 0:137634ff4186 | 484 | int x509write_crt_set_authority_key_identifier( x509write_cert *ctx ); |
ansond | 0:137634ff4186 | 485 | #endif /* POLARSSL_SHA1_C */ |
ansond | 0:137634ff4186 | 486 | |
ansond | 0:137634ff4186 | 487 | /** |
ansond | 0:137634ff4186 | 488 | * \brief Set the Key Usage Extension flags |
ansond | 0:137634ff4186 | 489 | * (e.g. KU_DIGITAL_SIGNATURE | KU_KEY_CERT_SIGN) |
ansond | 0:137634ff4186 | 490 | * |
ansond | 0:137634ff4186 | 491 | * \param ctx CRT context to use |
ansond | 0:137634ff4186 | 492 | * \param key_usage key usage flags to set |
ansond | 0:137634ff4186 | 493 | * |
ansond | 0:137634ff4186 | 494 | * \return 0 if successful, or POLARSSL_ERR_X509WRITE_MALLOC_FAILED |
ansond | 0:137634ff4186 | 495 | */ |
ansond | 0:137634ff4186 | 496 | int x509write_crt_set_key_usage( x509write_cert *ctx, unsigned char key_usage ); |
ansond | 0:137634ff4186 | 497 | |
ansond | 0:137634ff4186 | 498 | /** |
ansond | 0:137634ff4186 | 499 | * \brief Set the Netscape Cert Type flags |
ansond | 0:137634ff4186 | 500 | * (e.g. NS_CERT_TYPE_SSL_CLIENT | NS_CERT_TYPE_EMAIL) |
ansond | 0:137634ff4186 | 501 | * |
ansond | 0:137634ff4186 | 502 | * \param ctx CRT context to use |
ansond | 0:137634ff4186 | 503 | * \param ns_cert_type Netscape Cert Type flags to set |
ansond | 0:137634ff4186 | 504 | * |
ansond | 0:137634ff4186 | 505 | * \return 0 if successful, or POLARSSL_ERR_X509WRITE_MALLOC_FAILED |
ansond | 0:137634ff4186 | 506 | */ |
ansond | 0:137634ff4186 | 507 | int x509write_crt_set_ns_cert_type( x509write_cert *ctx, |
ansond | 0:137634ff4186 | 508 | unsigned char ns_cert_type ); |
ansond | 0:137634ff4186 | 509 | |
ansond | 0:137634ff4186 | 510 | /** |
ansond | 0:137634ff4186 | 511 | * \brief Free the contents of a CRT write context |
ansond | 0:137634ff4186 | 512 | * |
ansond | 0:137634ff4186 | 513 | * \param ctx CRT context to free |
ansond | 0:137634ff4186 | 514 | */ |
ansond | 0:137634ff4186 | 515 | void x509write_crt_free( x509write_cert *ctx ); |
ansond | 0:137634ff4186 | 516 | |
ansond | 0:137634ff4186 | 517 | /** |
ansond | 0:137634ff4186 | 518 | * \brief Write a built up certificate to a X509 DER structure |
ansond | 0:137634ff4186 | 519 | * Note: data is written at the end of the buffer! Use the |
ansond | 0:137634ff4186 | 520 | * return value to determine where you should start |
ansond | 0:137634ff4186 | 521 | * using the buffer |
ansond | 0:137634ff4186 | 522 | * |
ansond | 0:137634ff4186 | 523 | * \param ctx certificate to write away |
ansond | 0:137634ff4186 | 524 | * \param buf buffer to write to |
ansond | 0:137634ff4186 | 525 | * \param size size of the buffer |
ansond | 0:137634ff4186 | 526 | * \param f_rng RNG function (for signature, see note) |
ansond | 0:137634ff4186 | 527 | * \param p_rng RNG parameter |
ansond | 0:137634ff4186 | 528 | * |
ansond | 0:137634ff4186 | 529 | * \return length of data written if successful, or a specific |
ansond | 0:137634ff4186 | 530 | * error code |
ansond | 0:137634ff4186 | 531 | * |
ansond | 0:137634ff4186 | 532 | * \note f_rng may be NULL if RSA is used for signature and the |
ansond | 0:137634ff4186 | 533 | * signature is made offline (otherwise f_rng is desirable |
ansond | 0:137634ff4186 | 534 | * for countermeasures against timing attacks). |
ansond | 0:137634ff4186 | 535 | * ECDSA signatures always require a non-NULL f_rng. |
ansond | 0:137634ff4186 | 536 | */ |
ansond | 0:137634ff4186 | 537 | int x509write_crt_der( x509write_cert *ctx, unsigned char *buf, size_t size, |
ansond | 0:137634ff4186 | 538 | int (*f_rng)(void *, unsigned char *, size_t), |
ansond | 0:137634ff4186 | 539 | void *p_rng ); |
ansond | 0:137634ff4186 | 540 | |
ansond | 0:137634ff4186 | 541 | #if defined(POLARSSL_PEM_WRITE_C) |
ansond | 0:137634ff4186 | 542 | /** |
ansond | 0:137634ff4186 | 543 | * \brief Write a built up certificate to a X509 PEM string |
ansond | 0:137634ff4186 | 544 | * |
ansond | 0:137634ff4186 | 545 | * \param ctx certificate to write away |
ansond | 0:137634ff4186 | 546 | * \param buf buffer to write to |
ansond | 0:137634ff4186 | 547 | * \param size size of the buffer |
ansond | 0:137634ff4186 | 548 | * \param f_rng RNG function (for signature, see note) |
ansond | 0:137634ff4186 | 549 | * \param p_rng RNG parameter |
ansond | 0:137634ff4186 | 550 | * |
ansond | 0:137634ff4186 | 551 | * \return 0 successful, or a specific error code |
ansond | 0:137634ff4186 | 552 | * |
ansond | 0:137634ff4186 | 553 | * \note f_rng may be NULL if RSA is used for signature and the |
ansond | 0:137634ff4186 | 554 | * signature is made offline (otherwise f_rng is desirable |
ansond | 0:137634ff4186 | 555 | * for countermeasures against timing attacks). |
ansond | 0:137634ff4186 | 556 | * ECDSA signatures always require a non-NULL f_rng. |
ansond | 0:137634ff4186 | 557 | */ |
ansond | 0:137634ff4186 | 558 | int x509write_crt_pem( x509write_cert *ctx, unsigned char *buf, size_t size, |
ansond | 0:137634ff4186 | 559 | int (*f_rng)(void *, unsigned char *, size_t), |
ansond | 0:137634ff4186 | 560 | void *p_rng ); |
ansond | 0:137634ff4186 | 561 | #endif /* POLARSSL_PEM_WRITE_C */ |
ansond | 0:137634ff4186 | 562 | #endif /* POLARSSL_X509_CRT_WRITE_C */ |
ansond | 0:137634ff4186 | 563 | |
ansond | 0:137634ff4186 | 564 | #ifdef __cplusplus |
ansond | 0:137634ff4186 | 565 | } |
ansond | 0:137634ff4186 | 566 | #endif |
ansond | 0:137634ff4186 | 567 | |
ansond | 0:137634ff4186 | 568 | #endif /* x509_crt.h */ |
ansond | 0:137634ff4186 | 569 |