Doug Anson / mbedTLSLibrary

mbed TLS library

Dependents:   HTTPClient-SSL WS_SERVER

include/polarssl/x509_crt.h@0:137634ff4186, 2015-06-11 (annotated)

Committer:
ansond
Date:
Thu Jun 11 03:27:03 2015 +0000
Revision:
0:137634ff4186
initial commit

Who changed what in which revision?

UserRevisionLine numberNew contents of line
ansond 0:137634ff4186 1 /**
ansond 0:137634ff4186 2 * \file x509_crt.h
ansond 0:137634ff4186 3 *
ansond 0:137634ff4186 4 * \brief X.509 certificate parsing and writing
ansond 0:137634ff4186 5 *
ansond 0:137634ff4186 6 * Copyright (C) 2006-2013, ARM Limited, All Rights Reserved
ansond 0:137634ff4186 7 *
ansond 0:137634ff4186 8 * This file is part of mbed TLS (https://tls.mbed.org)
ansond 0:137634ff4186 9 *
ansond 0:137634ff4186 10 * This program is free software; you can redistribute it and/or modify
ansond 0:137634ff4186 11 * it under the terms of the GNU General Public License as published by
ansond 0:137634ff4186 12 * the Free Software Foundation; either version 2 of the License, or
ansond 0:137634ff4186 13 * (at your option) any later version.
ansond 0:137634ff4186 14 *
ansond 0:137634ff4186 15 * This program is distributed in the hope that it will be useful,
ansond 0:137634ff4186 16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
ansond 0:137634ff4186 17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
ansond 0:137634ff4186 18 * GNU General Public License for more details.
ansond 0:137634ff4186 19 *
ansond 0:137634ff4186 20 * You should have received a copy of the GNU General Public License along
ansond 0:137634ff4186 21 * with this program; if not, write to the Free Software Foundation, Inc.,
ansond 0:137634ff4186 22 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
ansond 0:137634ff4186 23 */
ansond 0:137634ff4186 24 #ifndef POLARSSL_X509_CRT_H
ansond 0:137634ff4186 25 #define POLARSSL_X509_CRT_H
ansond 0:137634ff4186 26
ansond 0:137634ff4186 27 #if !defined(POLARSSL_CONFIG_FILE)
ansond 0:137634ff4186 28 #include "config.h"
ansond 0:137634ff4186 29 #else
ansond 0:137634ff4186 30 #include POLARSSL_CONFIG_FILE
ansond 0:137634ff4186 31 #endif
ansond 0:137634ff4186 32
ansond 0:137634ff4186 33 #include "x509.h"
ansond 0:137634ff4186 34 #include "x509_crl.h"
ansond 0:137634ff4186 35
ansond 0:137634ff4186 36 /**
ansond 0:137634ff4186 37 * \addtogroup x509_module
ansond 0:137634ff4186 38 * \{
ansond 0:137634ff4186 39 */
ansond 0:137634ff4186 40
ansond 0:137634ff4186 41 #ifdef __cplusplus
ansond 0:137634ff4186 42 extern "C" {
ansond 0:137634ff4186 43 #endif
ansond 0:137634ff4186 44
ansond 0:137634ff4186 45 /**
ansond 0:137634ff4186 46 * \name Structures and functions for parsing and writing X.509 certificates
ansond 0:137634ff4186 47 * \{
ansond 0:137634ff4186 48 */
ansond 0:137634ff4186 49
ansond 0:137634ff4186 50 /**
ansond 0:137634ff4186 51 * Container for an X.509 certificate. The certificate may be chained.
ansond 0:137634ff4186 52 */
ansond 0:137634ff4186 53 typedef struct _x509_crt
ansond 0:137634ff4186 54 {
ansond 0:137634ff4186 55 x509_buf raw; /**< The raw certificate data (DER). */
ansond 0:137634ff4186 56 x509_buf tbs; /**< The raw certificate body (DER). The part that is To Be Signed. */
ansond 0:137634ff4186 57
ansond 0:137634ff4186 58 int version; /**< The X.509 version. (1=v1, 2=v2, 3=v3) */
ansond 0:137634ff4186 59 x509_buf serial; /**< Unique id for certificate issued by a specific CA. */
ansond 0:137634ff4186 60 x509_buf sig_oid1; /**< Signature algorithm, e.g. sha1RSA */
ansond 0:137634ff4186 61
ansond 0:137634ff4186 62 x509_buf issuer_raw; /**< The raw issuer data (DER). Used for quick comparison. */
ansond 0:137634ff4186 63 x509_buf subject_raw; /**< The raw subject data (DER). Used for quick comparison. */
ansond 0:137634ff4186 64
ansond 0:137634ff4186 65 x509_name issuer; /**< The parsed issuer data (named information object). */
ansond 0:137634ff4186 66 x509_name subject; /**< The parsed subject data (named information object). */
ansond 0:137634ff4186 67
ansond 0:137634ff4186 68 x509_time valid_from; /**< Start time of certificate validity. */
ansond 0:137634ff4186 69 x509_time valid_to; /**< End time of certificate validity. */
ansond 0:137634ff4186 70
ansond 0:137634ff4186 71 pk_context pk; /**< Container for the public key context. */
ansond 0:137634ff4186 72
ansond 0:137634ff4186 73 x509_buf issuer_id; /**< Optional X.509 v2/v3 issuer unique identifier. */
ansond 0:137634ff4186 74 x509_buf subject_id; /**< Optional X.509 v2/v3 subject unique identifier. */
ansond 0:137634ff4186 75 x509_buf v3_ext; /**< Optional X.509 v3 extensions. */
ansond 0:137634ff4186 76 x509_sequence subject_alt_names; /**< Optional list of Subject Alternative Names (Only dNSName supported). */
ansond 0:137634ff4186 77
ansond 0:137634ff4186 78 int ext_types; /**< Bit string containing detected and parsed extensions */
ansond 0:137634ff4186 79 int ca_istrue; /**< Optional Basic Constraint extension value: 1 if this certificate belongs to a CA, 0 otherwise. */
ansond 0:137634ff4186 80 int max_pathlen; /**< Optional Basic Constraint extension value: The maximum path length to the root certificate. Path length is 1 higher than RFC 5280 'meaning', so 1+ */
ansond 0:137634ff4186 81
ansond 0:137634ff4186 82 unsigned char key_usage; /**< Optional key usage extension value: See the values in x509.h */
ansond 0:137634ff4186 83
ansond 0:137634ff4186 84 x509_sequence ext_key_usage; /**< Optional list of extended key usage OIDs. */
ansond 0:137634ff4186 85
ansond 0:137634ff4186 86 unsigned char ns_cert_type; /**< Optional Netscape certificate type extension value: See the values in x509.h */
ansond 0:137634ff4186 87
ansond 0:137634ff4186 88 x509_buf sig_oid2; /**< Signature algorithm. Must match sig_oid1. */
ansond 0:137634ff4186 89 x509_buf sig; /**< Signature: hash of the tbs part signed with the private key. */
ansond 0:137634ff4186 90 md_type_t sig_md; /**< Internal representation of the MD algorithm of the signature algorithm, e.g. POLARSSL_MD_SHA256 */
ansond 0:137634ff4186 91 pk_type_t sig_pk; /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. POLARSSL_PK_RSA */
ansond 0:137634ff4186 92 void *sig_opts; /**< Signature options to be passed to pk_verify_ext(), e.g. for RSASSA-PSS */
ansond 0:137634ff4186 93
ansond 0:137634ff4186 94 struct _x509_crt *next; /**< Next certificate in the CA-chain. */
ansond 0:137634ff4186 95 }
ansond 0:137634ff4186 96 x509_crt;
ansond 0:137634ff4186 97
ansond 0:137634ff4186 98 #define X509_CRT_VERSION_1 0
ansond 0:137634ff4186 99 #define X509_CRT_VERSION_2 1
ansond 0:137634ff4186 100 #define X509_CRT_VERSION_3 2
ansond 0:137634ff4186 101
ansond 0:137634ff4186 102 #define X509_RFC5280_MAX_SERIAL_LEN 32
ansond 0:137634ff4186 103 #define X509_RFC5280_UTC_TIME_LEN 15
ansond 0:137634ff4186 104
ansond 0:137634ff4186 105 /**
ansond 0:137634ff4186 106 * Container for writing a certificate (CRT)
ansond 0:137634ff4186 107 */
ansond 0:137634ff4186 108 typedef struct _x509write_cert
ansond 0:137634ff4186 109 {
ansond 0:137634ff4186 110 int version;
ansond 0:137634ff4186 111 mpi serial;
ansond 0:137634ff4186 112 pk_context *subject_key;
ansond 0:137634ff4186 113 pk_context *issuer_key;
ansond 0:137634ff4186 114 asn1_named_data *subject;
ansond 0:137634ff4186 115 asn1_named_data *issuer;
ansond 0:137634ff4186 116 md_type_t md_alg;
ansond 0:137634ff4186 117 char not_before[X509_RFC5280_UTC_TIME_LEN + 1];
ansond 0:137634ff4186 118 char not_after[X509_RFC5280_UTC_TIME_LEN + 1];
ansond 0:137634ff4186 119 asn1_named_data *extensions;
ansond 0:137634ff4186 120 }
ansond 0:137634ff4186 121 x509write_cert;
ansond 0:137634ff4186 122
ansond 0:137634ff4186 123 #if defined(POLARSSL_X509_CRT_PARSE_C)
ansond 0:137634ff4186 124 /**
ansond 0:137634ff4186 125 * \brief Parse a single DER formatted certificate and add it
ansond 0:137634ff4186 126 * to the chained list.
ansond 0:137634ff4186 127 *
ansond 0:137634ff4186 128 * \param chain points to the start of the chain
ansond 0:137634ff4186 129 * \param buf buffer holding the certificate DER data
ansond 0:137634ff4186 130 * \param buflen size of the buffer
ansond 0:137634ff4186 131 *
ansond 0:137634ff4186 132 * \return 0 if successful, or a specific X509 or PEM error code
ansond 0:137634ff4186 133 */
ansond 0:137634ff4186 134 int x509_crt_parse_der( x509_crt *chain, const unsigned char *buf,
ansond 0:137634ff4186 135 size_t buflen );
ansond 0:137634ff4186 136
ansond 0:137634ff4186 137 /**
ansond 0:137634ff4186 138 * \brief Parse one or more certificates and add them
ansond 0:137634ff4186 139 * to the chained list. Parses permissively. If some
ansond 0:137634ff4186 140 * certificates can be parsed, the result is the number
ansond 0:137634ff4186 141 * of failed certificates it encountered. If none complete
ansond 0:137634ff4186 142 * correctly, the first error is returned.
ansond 0:137634ff4186 143 *
ansond 0:137634ff4186 144 * \param chain points to the start of the chain
ansond 0:137634ff4186 145 * \param buf buffer holding the certificate data
ansond 0:137634ff4186 146 * \param buflen size of the buffer
ansond 0:137634ff4186 147 *
ansond 0:137634ff4186 148 * \return 0 if all certificates parsed successfully, a positive number
ansond 0:137634ff4186 149 * if partly successful or a specific X509 or PEM error code
ansond 0:137634ff4186 150 */
ansond 0:137634ff4186 151 int x509_crt_parse( x509_crt *chain, const unsigned char *buf, size_t buflen );
ansond 0:137634ff4186 152
ansond 0:137634ff4186 153 #if defined(POLARSSL_FS_IO)
ansond 0:137634ff4186 154 /**
ansond 0:137634ff4186 155 * \brief Load one or more certificates and add them
ansond 0:137634ff4186 156 * to the chained list. Parses permissively. If some
ansond 0:137634ff4186 157 * certificates can be parsed, the result is the number
ansond 0:137634ff4186 158 * of failed certificates it encountered. If none complete
ansond 0:137634ff4186 159 * correctly, the first error is returned.
ansond 0:137634ff4186 160 *
ansond 0:137634ff4186 161 * \param chain points to the start of the chain
ansond 0:137634ff4186 162 * \param path filename to read the certificates from
ansond 0:137634ff4186 163 *
ansond 0:137634ff4186 164 * \return 0 if all certificates parsed successfully, a positive number
ansond 0:137634ff4186 165 * if partly successful or a specific X509 or PEM error code
ansond 0:137634ff4186 166 */
ansond 0:137634ff4186 167 int x509_crt_parse_file( x509_crt *chain, const char *path );
ansond 0:137634ff4186 168
ansond 0:137634ff4186 169 /**
ansond 0:137634ff4186 170 * \brief Load one or more certificate files from a path and add them
ansond 0:137634ff4186 171 * to the chained list. Parses permissively. If some
ansond 0:137634ff4186 172 * certificates can be parsed, the result is the number
ansond 0:137634ff4186 173 * of failed certificates it encountered. If none complete
ansond 0:137634ff4186 174 * correctly, the first error is returned.
ansond 0:137634ff4186 175 *
ansond 0:137634ff4186 176 * \warning This function is NOT thread-safe unless
ansond 0:137634ff4186 177 * POLARSSL_THREADING_PTHREADS is defined. If you're using an
ansond 0:137634ff4186 178 * alternative threading implementation, you should either use
ansond 0:137634ff4186 179 * this function only in the main thread, or mutex it.
ansond 0:137634ff4186 180 *
ansond 0:137634ff4186 181 * \param chain points to the start of the chain
ansond 0:137634ff4186 182 * \param path directory / folder to read the certificate files from
ansond 0:137634ff4186 183 *
ansond 0:137634ff4186 184 * \return 0 if all certificates parsed successfully, a positive number
ansond 0:137634ff4186 185 * if partly successful or a specific X509 or PEM error code
ansond 0:137634ff4186 186 */
ansond 0:137634ff4186 187 int x509_crt_parse_path( x509_crt *chain, const char *path );
ansond 0:137634ff4186 188 #endif /* POLARSSL_FS_IO */
ansond 0:137634ff4186 189
ansond 0:137634ff4186 190 /**
ansond 0:137634ff4186 191 * \brief Returns an informational string about the
ansond 0:137634ff4186 192 * certificate.
ansond 0:137634ff4186 193 *
ansond 0:137634ff4186 194 * \param buf Buffer to write to
ansond 0:137634ff4186 195 * \param size Maximum size of buffer
ansond 0:137634ff4186 196 * \param prefix A line prefix
ansond 0:137634ff4186 197 * \param crt The X509 certificate to represent
ansond 0:137634ff4186 198 *
ansond 0:137634ff4186 199 * \return The amount of data written to the buffer, or -1 in
ansond 0:137634ff4186 200 * case of an error.
ansond 0:137634ff4186 201 */
ansond 0:137634ff4186 202 int x509_crt_info( char *buf, size_t size, const char *prefix,
ansond 0:137634ff4186 203 const x509_crt *crt );
ansond 0:137634ff4186 204
ansond 0:137634ff4186 205 /**
ansond 0:137634ff4186 206 * \brief Returns an informational string about the
ansond 0:137634ff4186 207 * verification status of a certificate.
ansond 0:137634ff4186 208 *
ansond 0:137634ff4186 209 * \param buf Buffer to write to
ansond 0:137634ff4186 210 * \param size Maximum size of buffer
ansond 0:137634ff4186 211 * \param prefix A line prefix
ansond 0:137634ff4186 212 * \param flags Verification flags created by x509_crt_verify()
ansond 0:137634ff4186 213 *
ansond 0:137634ff4186 214 * \return The amount of data written to the buffer, or -1 in
ansond 0:137634ff4186 215 * case of an error.
ansond 0:137634ff4186 216 */
ansond 0:137634ff4186 217 int x509_crt_verify_info( char *buf, size_t size, const char *prefix,
ansond 0:137634ff4186 218 int flags );
ansond 0:137634ff4186 219
ansond 0:137634ff4186 220 /**
ansond 0:137634ff4186 221 * \brief Verify the certificate signature
ansond 0:137634ff4186 222 *
ansond 0:137634ff4186 223 * The verify callback is a user-supplied callback that
ansond 0:137634ff4186 224 * can clear / modify / add flags for a certificate. If set,
ansond 0:137634ff4186 225 * the verification callback is called for each
ansond 0:137634ff4186 226 * certificate in the chain (from the trust-ca down to the
ansond 0:137634ff4186 227 * presented crt). The parameters for the callback are:
ansond 0:137634ff4186 228 * (void *parameter, x509_crt *crt, int certificate_depth,
ansond 0:137634ff4186 229 * int *flags). With the flags representing current flags for
ansond 0:137634ff4186 230 * that specific certificate and the certificate depth from
ansond 0:137634ff4186 231 * the bottom (Peer cert depth = 0).
ansond 0:137634ff4186 232 *
ansond 0:137634ff4186 233 * All flags left after returning from the callback
ansond 0:137634ff4186 234 * are also returned to the application. The function should
ansond 0:137634ff4186 235 * return 0 for anything but a fatal error.
ansond 0:137634ff4186 236 *
ansond 0:137634ff4186 237 * \note In case verification failed, the results can be displayed
ansond 0:137634ff4186 238 * using \c x509_crt_verify_info()
ansond 0:137634ff4186 239 *
ansond 0:137634ff4186 240 * \param crt a certificate to be verified
ansond 0:137634ff4186 241 * \param trust_ca the trusted CA chain
ansond 0:137634ff4186 242 * \param ca_crl the CRL chain for trusted CA's
ansond 0:137634ff4186 243 * \param cn expected Common Name (can be set to
ansond 0:137634ff4186 244 * NULL if the CN must not be verified)
ansond 0:137634ff4186 245 * \param flags result of the verification
ansond 0:137634ff4186 246 * \param f_vrfy verification function
ansond 0:137634ff4186 247 * \param p_vrfy verification parameter
ansond 0:137634ff4186 248 *
ansond 0:137634ff4186 249 * \return 0 if successful or POLARSSL_ERR_X509_SIG_VERIFY_FAILED,
ansond 0:137634ff4186 250 * in which case *flags will have one or more BADCERT_XXX or
ansond 0:137634ff4186 251 * BADCRL_XXX flags set,
ansond 0:137634ff4186 252 * or another error in case of a fatal error encountered
ansond 0:137634ff4186 253 * during the verification process.
ansond 0:137634ff4186 254 */
ansond 0:137634ff4186 255 int x509_crt_verify( x509_crt *crt,
ansond 0:137634ff4186 256 x509_crt *trust_ca,
ansond 0:137634ff4186 257 x509_crl *ca_crl,
ansond 0:137634ff4186 258 const char *cn, int *flags,
ansond 0:137634ff4186 259 int (*f_vrfy)(void *, x509_crt *, int, int *),
ansond 0:137634ff4186 260 void *p_vrfy );
ansond 0:137634ff4186 261
ansond 0:137634ff4186 262 #if defined(POLARSSL_X509_CHECK_KEY_USAGE)
ansond 0:137634ff4186 263 /**
ansond 0:137634ff4186 264 * \brief Check usage of certificate against keyUsage extension.
ansond 0:137634ff4186 265 *
ansond 0:137634ff4186 266 * \param crt Leaf certificate used.
ansond 0:137634ff4186 267 * \param usage Intended usage(s) (eg KU_KEY_ENCIPHERMENT before using the
ansond 0:137634ff4186 268 * certificate to perform an RSA key exchange).
ansond 0:137634ff4186 269 *
ansond 0:137634ff4186 270 * \return 0 is these uses of the certificate are allowed,
ansond 0:137634ff4186 271 * POLARSSL_ERR_X509_BAD_INPUT_DATA if the keyUsage extension
ansond 0:137634ff4186 272 * is present but does not contain all the bits set in the
ansond 0:137634ff4186 273 * usage argument.
ansond 0:137634ff4186 274 *
ansond 0:137634ff4186 275 * \note You should only call this function on leaf certificates, on
ansond 0:137634ff4186 276 * (intermediate) CAs the keyUsage extension is automatically
ansond 0:137634ff4186 277 * checked by \c x509_crt_verify().
ansond 0:137634ff4186 278 */
ansond 0:137634ff4186 279 int x509_crt_check_key_usage( const x509_crt *crt, int usage );
ansond 0:137634ff4186 280 #endif /* POLARSSL_X509_CHECK_KEY_USAGE) */
ansond 0:137634ff4186 281
ansond 0:137634ff4186 282 #if defined(POLARSSL_X509_CHECK_EXTENDED_KEY_USAGE)
ansond 0:137634ff4186 283 /**
ansond 0:137634ff4186 284 * \brief Check usage of certificate against extentedJeyUsage.
ansond 0:137634ff4186 285 *
ansond 0:137634ff4186 286 * \param crt Leaf certificate used.
ansond 0:137634ff4186 287 * \param usage_oid Intended usage (eg OID_SERVER_AUTH or OID_CLIENT_AUTH).
ansond 0:137634ff4186 288 * \param usage_len Length of usage_oid (eg given by OID_SIZE()).
ansond 0:137634ff4186 289 *
ansond 0:137634ff4186 290 * \return 0 is this use of the certificate is allowed,
ansond 0:137634ff4186 291 * POLARSSL_ERR_X509_BAD_INPUT_DATA if not.
ansond 0:137634ff4186 292 *
ansond 0:137634ff4186 293 * \note Usually only makes sense on leaf certificates.
ansond 0:137634ff4186 294 */
ansond 0:137634ff4186 295 int x509_crt_check_extended_key_usage( const x509_crt *crt,
ansond 0:137634ff4186 296 const char *usage_oid,
ansond 0:137634ff4186 297 size_t usage_len );
ansond 0:137634ff4186 298 #endif /* POLARSSL_X509_CHECK_EXTENDED_KEY_USAGE) */
ansond 0:137634ff4186 299
ansond 0:137634ff4186 300 #if defined(POLARSSL_X509_CRL_PARSE_C)
ansond 0:137634ff4186 301 /**
ansond 0:137634ff4186 302 * \brief Verify the certificate revocation status
ansond 0:137634ff4186 303 *
ansond 0:137634ff4186 304 * \param crt a certificate to be verified
ansond 0:137634ff4186 305 * \param crl the CRL to verify against
ansond 0:137634ff4186 306 *
ansond 0:137634ff4186 307 * \return 1 if the certificate is revoked, 0 otherwise
ansond 0:137634ff4186 308 *
ansond 0:137634ff4186 309 */
ansond 0:137634ff4186 310 int x509_crt_revoked( const x509_crt *crt, const x509_crl *crl );
ansond 0:137634ff4186 311 #endif /* POLARSSL_X509_CRL_PARSE_C */
ansond 0:137634ff4186 312
ansond 0:137634ff4186 313 /**
ansond 0:137634ff4186 314 * \brief Initialize a certificate (chain)
ansond 0:137634ff4186 315 *
ansond 0:137634ff4186 316 * \param crt Certificate chain to initialize
ansond 0:137634ff4186 317 */
ansond 0:137634ff4186 318 void x509_crt_init( x509_crt *crt );
ansond 0:137634ff4186 319
ansond 0:137634ff4186 320 /**
ansond 0:137634ff4186 321 * \brief Unallocate all certificate data
ansond 0:137634ff4186 322 *
ansond 0:137634ff4186 323 * \param crt Certificate chain to free
ansond 0:137634ff4186 324 */
ansond 0:137634ff4186 325 void x509_crt_free( x509_crt *crt );
ansond 0:137634ff4186 326 #endif /* POLARSSL_X509_CRT_PARSE_C */
ansond 0:137634ff4186 327
ansond 0:137634ff4186 328 /* \} name */
ansond 0:137634ff4186 329 /* \} addtogroup x509_module */
ansond 0:137634ff4186 330
ansond 0:137634ff4186 331 #if defined(POLARSSL_X509_CRT_WRITE_C)
ansond 0:137634ff4186 332 /**
ansond 0:137634ff4186 333 * \brief Initialize a CRT writing context
ansond 0:137634ff4186 334 *
ansond 0:137634ff4186 335 * \param ctx CRT context to initialize
ansond 0:137634ff4186 336 */
ansond 0:137634ff4186 337 void x509write_crt_init( x509write_cert *ctx );
ansond 0:137634ff4186 338
ansond 0:137634ff4186 339 /**
ansond 0:137634ff4186 340 * \brief Set the verion for a Certificate
ansond 0:137634ff4186 341 * Default: X509_CRT_VERSION_3
ansond 0:137634ff4186 342 *
ansond 0:137634ff4186 343 * \param ctx CRT context to use
ansond 0:137634ff4186 344 * \param version version to set (X509_CRT_VERSION_1, X509_CRT_VERSION_2 or
ansond 0:137634ff4186 345 * X509_CRT_VERSION_3)
ansond 0:137634ff4186 346 */
ansond 0:137634ff4186 347 void x509write_crt_set_version( x509write_cert *ctx, int version );
ansond 0:137634ff4186 348
ansond 0:137634ff4186 349 /**
ansond 0:137634ff4186 350 * \brief Set the serial number for a Certificate.
ansond 0:137634ff4186 351 *
ansond 0:137634ff4186 352 * \param ctx CRT context to use
ansond 0:137634ff4186 353 * \param serial serial number to set
ansond 0:137634ff4186 354 *
ansond 0:137634ff4186 355 * \return 0 if successful
ansond 0:137634ff4186 356 */
ansond 0:137634ff4186 357 int x509write_crt_set_serial( x509write_cert *ctx, const mpi *serial );
ansond 0:137634ff4186 358
ansond 0:137634ff4186 359 /**
ansond 0:137634ff4186 360 * \brief Set the validity period for a Certificate
ansond 0:137634ff4186 361 * Timestamps should be in string format for UTC timezone
ansond 0:137634ff4186 362 * i.e. "YYYYMMDDhhmmss"
ansond 0:137634ff4186 363 * e.g. "20131231235959" for December 31st 2013
ansond 0:137634ff4186 364 * at 23:59:59
ansond 0:137634ff4186 365 *
ansond 0:137634ff4186 366 * \param ctx CRT context to use
ansond 0:137634ff4186 367 * \param not_before not_before timestamp
ansond 0:137634ff4186 368 * \param not_after not_after timestamp
ansond 0:137634ff4186 369 *
ansond 0:137634ff4186 370 * \return 0 if timestamp was parsed successfully, or
ansond 0:137634ff4186 371 * a specific error code
ansond 0:137634ff4186 372 */
ansond 0:137634ff4186 373 int x509write_crt_set_validity( x509write_cert *ctx, const char *not_before,
ansond 0:137634ff4186 374 const char *not_after );
ansond 0:137634ff4186 375
ansond 0:137634ff4186 376 /**
ansond 0:137634ff4186 377 * \brief Set the issuer name for a Certificate
ansond 0:137634ff4186 378 * Issuer names should contain a comma-separated list
ansond 0:137634ff4186 379 * of OID types and values:
ansond 0:137634ff4186 380 * e.g. "C=UK,O=ARM,CN=mbed TLS CA"
ansond 0:137634ff4186 381 *
ansond 0:137634ff4186 382 * \param ctx CRT context to use
ansond 0:137634ff4186 383 * \param issuer_name issuer name to set
ansond 0:137634ff4186 384 *
ansond 0:137634ff4186 385 * \return 0 if issuer name was parsed successfully, or
ansond 0:137634ff4186 386 * a specific error code
ansond 0:137634ff4186 387 */
ansond 0:137634ff4186 388 int x509write_crt_set_issuer_name( x509write_cert *ctx,
ansond 0:137634ff4186 389 const char *issuer_name );
ansond 0:137634ff4186 390
ansond 0:137634ff4186 391 /**
ansond 0:137634ff4186 392 * \brief Set the subject name for a Certificate
ansond 0:137634ff4186 393 * Subject names should contain a comma-separated list
ansond 0:137634ff4186 394 * of OID types and values:
ansond 0:137634ff4186 395 * e.g. "C=UK,O=ARM,CN=mbed TLS Server 1"
ansond 0:137634ff4186 396 *
ansond 0:137634ff4186 397 * \param ctx CRT context to use
ansond 0:137634ff4186 398 * \param subject_name subject name to set
ansond 0:137634ff4186 399 *
ansond 0:137634ff4186 400 * \return 0 if subject name was parsed successfully, or
ansond 0:137634ff4186 401 * a specific error code
ansond 0:137634ff4186 402 */
ansond 0:137634ff4186 403 int x509write_crt_set_subject_name( x509write_cert *ctx,
ansond 0:137634ff4186 404 const char *subject_name );
ansond 0:137634ff4186 405
ansond 0:137634ff4186 406 /**
ansond 0:137634ff4186 407 * \brief Set the subject public key for the certificate
ansond 0:137634ff4186 408 *
ansond 0:137634ff4186 409 * \param ctx CRT context to use
ansond 0:137634ff4186 410 * \param key public key to include
ansond 0:137634ff4186 411 */
ansond 0:137634ff4186 412 void x509write_crt_set_subject_key( x509write_cert *ctx, pk_context *key );
ansond 0:137634ff4186 413
ansond 0:137634ff4186 414 /**
ansond 0:137634ff4186 415 * \brief Set the issuer key used for signing the certificate
ansond 0:137634ff4186 416 *
ansond 0:137634ff4186 417 * \param ctx CRT context to use
ansond 0:137634ff4186 418 * \param key private key to sign with
ansond 0:137634ff4186 419 */
ansond 0:137634ff4186 420 void x509write_crt_set_issuer_key( x509write_cert *ctx, pk_context *key );
ansond 0:137634ff4186 421
ansond 0:137634ff4186 422 /**
ansond 0:137634ff4186 423 * \brief Set the MD algorithm to use for the signature
ansond 0:137634ff4186 424 * (e.g. POLARSSL_MD_SHA1)
ansond 0:137634ff4186 425 *
ansond 0:137634ff4186 426 * \param ctx CRT context to use
ansond 0:137634ff4186 427 * \param md_alg MD algorithm to use
ansond 0:137634ff4186 428 */
ansond 0:137634ff4186 429 void x509write_crt_set_md_alg( x509write_cert *ctx, md_type_t md_alg );
ansond 0:137634ff4186 430
ansond 0:137634ff4186 431 /**
ansond 0:137634ff4186 432 * \brief Generic function to add to or replace an extension in the
ansond 0:137634ff4186 433 * CRT
ansond 0:137634ff4186 434 *
ansond 0:137634ff4186 435 * \param ctx CRT context to use
ansond 0:137634ff4186 436 * \param oid OID of the extension
ansond 0:137634ff4186 437 * \param oid_len length of the OID
ansond 0:137634ff4186 438 * \param critical if the extension is critical (per the RFC's definition)
ansond 0:137634ff4186 439 * \param val value of the extension OCTET STRING
ansond 0:137634ff4186 440 * \param val_len length of the value data
ansond 0:137634ff4186 441 *
ansond 0:137634ff4186 442 * \return 0 if successful, or a POLARSSL_ERR_X509WRITE_MALLOC_FAILED
ansond 0:137634ff4186 443 */
ansond 0:137634ff4186 444 int x509write_crt_set_extension( x509write_cert *ctx,
ansond 0:137634ff4186 445 const char *oid, size_t oid_len,
ansond 0:137634ff4186 446 int critical,
ansond 0:137634ff4186 447 const unsigned char *val, size_t val_len );
ansond 0:137634ff4186 448
ansond 0:137634ff4186 449 /**
ansond 0:137634ff4186 450 * \brief Set the basicConstraints extension for a CRT
ansond 0:137634ff4186 451 *
ansond 0:137634ff4186 452 * \param ctx CRT context to use
ansond 0:137634ff4186 453 * \param is_ca is this a CA certificate
ansond 0:137634ff4186 454 * \param max_pathlen maximum length of certificate chains below this
ansond 0:137634ff4186 455 * certificate (only for CA certificates, -1 is
ansond 0:137634ff4186 456 * inlimited)
ansond 0:137634ff4186 457 *
ansond 0:137634ff4186 458 * \return 0 if successful, or a POLARSSL_ERR_X509WRITE_MALLOC_FAILED
ansond 0:137634ff4186 459 */
ansond 0:137634ff4186 460 int x509write_crt_set_basic_constraints( x509write_cert *ctx,
ansond 0:137634ff4186 461 int is_ca, int max_pathlen );
ansond 0:137634ff4186 462
ansond 0:137634ff4186 463 #if defined(POLARSSL_SHA1_C)
ansond 0:137634ff4186 464 /**
ansond 0:137634ff4186 465 * \brief Set the subjectKeyIdentifier extension for a CRT
ansond 0:137634ff4186 466 * Requires that x509write_crt_set_subject_key() has been
ansond 0:137634ff4186 467 * called before
ansond 0:137634ff4186 468 *
ansond 0:137634ff4186 469 * \param ctx CRT context to use
ansond 0:137634ff4186 470 *
ansond 0:137634ff4186 471 * \return 0 if successful, or a POLARSSL_ERR_X509WRITE_MALLOC_FAILED
ansond 0:137634ff4186 472 */
ansond 0:137634ff4186 473 int x509write_crt_set_subject_key_identifier( x509write_cert *ctx );
ansond 0:137634ff4186 474
ansond 0:137634ff4186 475 /**
ansond 0:137634ff4186 476 * \brief Set the authorityKeyIdentifier extension for a CRT
ansond 0:137634ff4186 477 * Requires that x509write_crt_set_issuer_key() has been
ansond 0:137634ff4186 478 * called before
ansond 0:137634ff4186 479 *
ansond 0:137634ff4186 480 * \param ctx CRT context to use
ansond 0:137634ff4186 481 *
ansond 0:137634ff4186 482 * \return 0 if successful, or a POLARSSL_ERR_X509WRITE_MALLOC_FAILED
ansond 0:137634ff4186 483 */
ansond 0:137634ff4186 484 int x509write_crt_set_authority_key_identifier( x509write_cert *ctx );
ansond 0:137634ff4186 485 #endif /* POLARSSL_SHA1_C */
ansond 0:137634ff4186 486
ansond 0:137634ff4186 487 /**
ansond 0:137634ff4186 488 * \brief Set the Key Usage Extension flags
ansond 0:137634ff4186 489 * (e.g. KU_DIGITAL_SIGNATURE | KU_KEY_CERT_SIGN)
ansond 0:137634ff4186 490 *
ansond 0:137634ff4186 491 * \param ctx CRT context to use
ansond 0:137634ff4186 492 * \param key_usage key usage flags to set
ansond 0:137634ff4186 493 *
ansond 0:137634ff4186 494 * \return 0 if successful, or POLARSSL_ERR_X509WRITE_MALLOC_FAILED
ansond 0:137634ff4186 495 */
ansond 0:137634ff4186 496 int x509write_crt_set_key_usage( x509write_cert *ctx, unsigned char key_usage );
ansond 0:137634ff4186 497
ansond 0:137634ff4186 498 /**
ansond 0:137634ff4186 499 * \brief Set the Netscape Cert Type flags
ansond 0:137634ff4186 500 * (e.g. NS_CERT_TYPE_SSL_CLIENT | NS_CERT_TYPE_EMAIL)
ansond 0:137634ff4186 501 *
ansond 0:137634ff4186 502 * \param ctx CRT context to use
ansond 0:137634ff4186 503 * \param ns_cert_type Netscape Cert Type flags to set
ansond 0:137634ff4186 504 *
ansond 0:137634ff4186 505 * \return 0 if successful, or POLARSSL_ERR_X509WRITE_MALLOC_FAILED
ansond 0:137634ff4186 506 */
ansond 0:137634ff4186 507 int x509write_crt_set_ns_cert_type( x509write_cert *ctx,
ansond 0:137634ff4186 508 unsigned char ns_cert_type );
ansond 0:137634ff4186 509
ansond 0:137634ff4186 510 /**
ansond 0:137634ff4186 511 * \brief Free the contents of a CRT write context
ansond 0:137634ff4186 512 *
ansond 0:137634ff4186 513 * \param ctx CRT context to free
ansond 0:137634ff4186 514 */
ansond 0:137634ff4186 515 void x509write_crt_free( x509write_cert *ctx );
ansond 0:137634ff4186 516
ansond 0:137634ff4186 517 /**
ansond 0:137634ff4186 518 * \brief Write a built up certificate to a X509 DER structure
ansond 0:137634ff4186 519 * Note: data is written at the end of the buffer! Use the
ansond 0:137634ff4186 520 * return value to determine where you should start
ansond 0:137634ff4186 521 * using the buffer
ansond 0:137634ff4186 522 *
ansond 0:137634ff4186 523 * \param ctx certificate to write away
ansond 0:137634ff4186 524 * \param buf buffer to write to
ansond 0:137634ff4186 525 * \param size size of the buffer
ansond 0:137634ff4186 526 * \param f_rng RNG function (for signature, see note)
ansond 0:137634ff4186 527 * \param p_rng RNG parameter
ansond 0:137634ff4186 528 *
ansond 0:137634ff4186 529 * \return length of data written if successful, or a specific
ansond 0:137634ff4186 530 * error code
ansond 0:137634ff4186 531 *
ansond 0:137634ff4186 532 * \note f_rng may be NULL if RSA is used for signature and the
ansond 0:137634ff4186 533 * signature is made offline (otherwise f_rng is desirable
ansond 0:137634ff4186 534 * for countermeasures against timing attacks).
ansond 0:137634ff4186 535 * ECDSA signatures always require a non-NULL f_rng.
ansond 0:137634ff4186 536 */
ansond 0:137634ff4186 537 int x509write_crt_der( x509write_cert *ctx, unsigned char *buf, size_t size,
ansond 0:137634ff4186 538 int (*f_rng)(void *, unsigned char *, size_t),
ansond 0:137634ff4186 539 void *p_rng );
ansond 0:137634ff4186 540
ansond 0:137634ff4186 541 #if defined(POLARSSL_PEM_WRITE_C)
ansond 0:137634ff4186 542 /**
ansond 0:137634ff4186 543 * \brief Write a built up certificate to a X509 PEM string
ansond 0:137634ff4186 544 *
ansond 0:137634ff4186 545 * \param ctx certificate to write away
ansond 0:137634ff4186 546 * \param buf buffer to write to
ansond 0:137634ff4186 547 * \param size size of the buffer
ansond 0:137634ff4186 548 * \param f_rng RNG function (for signature, see note)
ansond 0:137634ff4186 549 * \param p_rng RNG parameter
ansond 0:137634ff4186 550 *
ansond 0:137634ff4186 551 * \return 0 successful, or a specific error code
ansond 0:137634ff4186 552 *
ansond 0:137634ff4186 553 * \note f_rng may be NULL if RSA is used for signature and the
ansond 0:137634ff4186 554 * signature is made offline (otherwise f_rng is desirable
ansond 0:137634ff4186 555 * for countermeasures against timing attacks).
ansond 0:137634ff4186 556 * ECDSA signatures always require a non-NULL f_rng.
ansond 0:137634ff4186 557 */
ansond 0:137634ff4186 558 int x509write_crt_pem( x509write_cert *ctx, unsigned char *buf, size_t size,
ansond 0:137634ff4186 559 int (*f_rng)(void *, unsigned char *, size_t),
ansond 0:137634ff4186 560 void *p_rng );
ansond 0:137634ff4186 561 #endif /* POLARSSL_PEM_WRITE_C */
ansond 0:137634ff4186 562 #endif /* POLARSSL_X509_CRT_WRITE_C */
ansond 0:137634ff4186 563
ansond 0:137634ff4186 564 #ifdef __cplusplus
ansond 0:137634ff4186 565 }
ansond 0:137634ff4186 566 #endif
ansond 0:137634ff4186 567
ansond 0:137634ff4186 568 #endif /* x509_crt.h */
ansond 0:137634ff4186 569