X.509 certificate parsing and writing. More...

Data Structures
struct	_x509_crt
	Container for an X.509 certificate. More...
struct	_x509write_cert
	Container for writing a certificate (CRT) More...
Functions
void	x509write_crt_init (x509write_cert *ctx)
	Initialize a CRT writing context.
void	x509write_crt_set_version (x509write_cert *ctx, int version)
	Set the verion for a Certificate Default: X509_CRT_VERSION_3.
int	x509write_crt_set_serial (x509write_cert ctx, const mpi serial)
	Set the serial number for a Certificate.
int	x509write_crt_set_validity (x509write_cert ctx, const char not_before, const char *not_after)
	Set the validity period for a Certificate Timestamps should be in string format for UTC timezone i.e.
int	x509write_crt_set_issuer_name (x509write_cert ctx, const char issuer_name)
	Set the issuer name for a Certificate Issuer names should contain a comma-separated list of OID types and values: e.g.
int	x509write_crt_set_subject_name (x509write_cert ctx, const char subject_name)
	Set the subject name for a Certificate Subject names should contain a comma-separated list of OID types and values: e.g.
void	x509write_crt_set_subject_key (x509write_cert ctx, pk_context key)
	Set the subject public key for the certificate.
void	x509write_crt_set_issuer_key (x509write_cert ctx, pk_context key)
	Set the issuer key used for signing the certificate.
void	x509write_crt_set_md_alg (x509write_cert *ctx, md_type_t md_alg)
	Set the MD algorithm to use for the signature (e.g.
int	x509write_crt_set_extension (x509write_cert ctx, const char oid, size_t oid_len, int critical, const unsigned char *val, size_t val_len)
	Generic function to add to or replace an extension in the CRT.
int	x509write_crt_set_basic_constraints (x509write_cert *ctx, int is_ca, int max_pathlen)
	Set the basicConstraints extension for a CRT.
int	x509write_crt_set_subject_key_identifier (x509write_cert *ctx)
	Set the subjectKeyIdentifier extension for a CRT Requires that x509write_crt_set_subject_key() has been called before.
int	x509write_crt_set_authority_key_identifier (x509write_cert *ctx)
	Set the authorityKeyIdentifier extension for a CRT Requires that x509write_crt_set_issuer_key() has been called before.
int	x509write_crt_set_key_usage (x509write_cert *ctx, unsigned char key_usage)
	Set the Key Usage Extension flags (e.g.
int	x509write_crt_set_ns_cert_type (x509write_cert *ctx, unsigned char ns_cert_type)
	Set the Netscape Cert Type flags (e.g.
void	x509write_crt_free (x509write_cert *ctx)
	Free the contents of a CRT write context.
int	x509write_crt_der (x509write_cert ctx, unsigned char buf, size_t size, int(f_rng)(void , unsigned char , size_t), void p_rng)
	Write a built up certificate to a X509 DER structure Note: data is written at the end of the buffer! Use the return value to determine where you should start using the buffer.
int	x509write_crt_pem (x509write_cert ctx, unsigned char buf, size_t size, int(f_rng)(void , unsigned char , size_t), void p_rng)
	Write a built up certificate to a X509 PEM string.
Structures and functions for parsing and writing X.509 certificates
typedef struct _x509_crt	x509_crt
	Container for an X.509 certificate.
typedef struct _x509write_cert	x509write_cert
	Container for writing a certificate (CRT)
int	x509_crt_parse_der (x509_crt chain, const unsigned char buf, size_t buflen)
	Parse a single DER formatted certificate and add it to the chained list.
int	x509_crt_parse (x509_crt chain, const unsigned char buf, size_t buflen)
	Parse one or more certificates and add them to the chained list.
int	x509_crt_parse_file (x509_crt chain, const char path)
	Load one or more certificates and add them to the chained list.
int	x509_crt_parse_path (x509_crt chain, const char path)
	Load one or more certificate files from a path and add them to the chained list.
int	x509_crt_info (char buf, size_t size, const char prefix, const x509_crt *crt)
	Returns an informational string about the certificate.
int	x509_crt_verify_info (char buf, size_t size, const char prefix, int flags)
	Returns an informational string about the verification status of a certificate.
int	x509_crt_verify (x509_crt crt, x509_crt trust_ca, x509_crl ca_crl, const char cn, int flags, int(f_vrfy)(void , x509_crt , int, int ), void p_vrfy)
	Verify the certificate signature.
int	x509_crt_check_key_usage (const x509_crt *crt, int usage)
	Check usage of certificate against keyUsage extension.
int	x509_crt_check_extended_key_usage (const x509_crt crt, const char usage_oid, size_t usage_len)
	Check usage of certificate against extentedJeyUsage.
int	x509_crt_revoked (const x509_crt crt, const x509_crl crl)
	Verify the certificate revocation status.
void	x509_crt_init (x509_crt *crt)
	Initialize a certificate (chain)
void	x509_crt_free (x509_crt *crt)
	Unallocate all certificate data.

Detailed Description

X.509 certificate parsing and writing.

This file is part of mbed TLS (https://tls.mbed.org)

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

Definition in file x509_crt.h.

Function Documentation

int x509write_crt_der	(	x509write_cert *	ctx,
		unsigned char *	buf,
		size_t	size,
		int()(void , unsigned char *, size_t)	f_rng,
		void *	p_rng
	)

Write a built up certificate to a X509 DER structure Note: data is written at the end of the buffer! Use the return value to determine where you should start using the buffer.

Parameters:

ctx	certificate to write away
buf	buffer to write to
size	size of the buffer
f_rng	RNG function (for signature, see note)
p_rng	RNG parameter

Returns:: length of data written if successful, or a specific error code

Note:: f_rng may be NULL if RSA is used for signature and the signature is made offline (otherwise f_rng is desirable for countermeasures against timing attacks). ECDSA signatures always require a non-NULL f_rng.

Definition at line 290 of file x509write_crt.c.

void x509write_crt_free ( x509write_cert * ctx )

Free the contents of a CRT write context.

Parameters:

ctx	CRT context to free

Definition at line 61 of file x509write_crt.c.

void x509write_crt_init ( x509write_cert * ctx )

Initialize a CRT writing context.

Parameters:

ctx	CRT context to initialize

Definition at line 53 of file x509write_crt.c.

int x509write_crt_pem	(	x509write_cert *	ctx,
		unsigned char *	buf,
		size_t	size,
		int()(void , unsigned char *, size_t)	f_rng,
		void *	p_rng
	)

Write a built up certificate to a X509 PEM string.

Parameters:

ctx	certificate to write away
buf	buffer to write to
size	size of the buffer
f_rng	RNG function (for signature, see note)
p_rng	RNG parameter

Returns:: 0 successful, or a specific error code

Note:: f_rng may be NULL if RSA is used for signature and the signature is made offline (otherwise f_rng is desirable for countermeasures against timing attacks). ECDSA signatures always require a non-NULL f_rng.

Definition at line 426 of file x509write_crt.c.

int x509write_crt_set_authority_key_identifier ( x509write_cert * ctx )

Set the authorityKeyIdentifier extension for a CRT Requires that x509write_crt_set_issuer_key() has been called before.

Parameters:

ctx	CRT context to use

Returns:: 0 if successful, or a POLARSSL_ERR_X509WRITE_MALLOC_FAILED

Definition at line 193 of file x509write_crt.c.

int x509write_crt_set_basic_constraints	(	x509write_cert *	ctx,
		int	is_ca,
		int	max_pathlen
	)

Set the basicConstraints extension for a CRT.

Parameters:

ctx	CRT context to use
is_ca	is this a CA certificate
max_pathlen	maximum length of certificate chains below this certificate (only for CA certificates, -1 is inlimited)

Returns:: 0 if successful, or a POLARSSL_ERR_X509WRITE_MALLOC_FAILED

Definition at line 139 of file x509write_crt.c.

int x509write_crt_set_extension	(	x509write_cert *	ctx,
		const char *	oid,
		size_t	oid_len,
		int	critical,
		const unsigned char *	val,
		size_t	val_len
	)

Generic function to add to or replace an extension in the CRT.

Parameters:

ctx	CRT context to use
oid	OID of the extension
oid_len	length of the OID
critical	if the extension is critical (per the RFC's definition)
val	value of the extension OCTET STRING
val_len	length of the value data

Returns:: 0 if successful, or a POLARSSL_ERR_X509WRITE_MALLOC_FAILED

Definition at line 130 of file x509write_crt.c.

void x509write_crt_set_issuer_key	(	x509write_cert *	ctx,
		pk_context *	key
	)

Set the issuer key used for signing the certificate.

Parameters:

ctx	CRT context to use
key	private key to sign with

Definition at line 87 of file x509write_crt.c.

int x509write_crt_set_issuer_name	(	x509write_cert *	ctx,
		const char *	issuer_name
	)

Set the issuer name for a Certificate Issuer names should contain a comma-separated list of OID types and values: e.g.

"C=UK,O=ARM,CN=mbed TLS CA"

Parameters:

ctx	CRT context to use
issuer_name	issuer name to set

Returns:: 0 if issuer name was parsed successfully, or a specific error code

Definition at line 98 of file x509write_crt.c.

int x509write_crt_set_key_usage	(	x509write_cert *	ctx,
		unsigned char	key_usage
	)

Set the Key Usage Extension flags (e.g.

KU_DIGITAL_SIGNATURE | KU_KEY_CERT_SIGN)

Parameters:

ctx	CRT context to use
key_usage	key usage flags to set

Returns:: 0 if successful, or POLARSSL_ERR_X509WRITE_MALLOC_FAILED

Definition at line 220 of file x509write_crt.c.

void x509write_crt_set_md_alg	(	x509write_cert *	ctx,
		md_type_t	md_alg
	)

Set the MD algorithm to use for the signature (e.g.

POLARSSL_MD_SHA1)

Parameters:

ctx	CRT context to use
md_alg	MD algorithm to use

Definition at line 77 of file x509write_crt.c.

int x509write_crt_set_ns_cert_type	(	x509write_cert *	ctx,
		unsigned char	ns_cert_type
	)

Set the Netscape Cert Type flags (e.g.

NS_CERT_TYPE_SSL_CLIENT | NS_CERT_TYPE_EMAIL)

Parameters:

ctx	CRT context to use
ns_cert_type	Netscape Cert Type flags to set

Returns:: 0 if successful, or POLARSSL_ERR_X509WRITE_MALLOC_FAILED

Definition at line 240 of file x509write_crt.c.

int x509write_crt_set_serial	(	x509write_cert *	ctx,
		const mpi *	serial
	)

Set the serial number for a Certificate.

Parameters:

ctx	CRT context to use
serial	serial number to set

Returns:: 0 if successful

Definition at line 104 of file x509write_crt.c.

void x509write_crt_set_subject_key	(	x509write_cert *	ctx,
		pk_context *	key
	)

Set the subject public key for the certificate.

Parameters:

ctx	CRT context to use
key	public key to include

Definition at line 82 of file x509write_crt.c.

int x509write_crt_set_subject_key_identifier ( x509write_cert * ctx )

Set the subjectKeyIdentifier extension for a CRT Requires that x509write_crt_set_subject_key() has been called before.

Parameters:

ctx	CRT context to use

Returns:: 0 if successful, or a POLARSSL_ERR_X509WRITE_MALLOC_FAILED

Definition at line 171 of file x509write_crt.c.

int x509write_crt_set_subject_name	(	x509write_cert *	ctx,
		const char *	subject_name
	)

Set the subject name for a Certificate Subject names should contain a comma-separated list of OID types and values: e.g.

"C=UK,O=ARM,CN=mbed TLS Server 1"

Parameters:

ctx	CRT context to use
subject_name	subject name to set

Returns:: 0 if subject name was parsed successfully, or a specific error code

Definition at line 92 of file x509write_crt.c.

int x509write_crt_set_validity	(	x509write_cert *	ctx,
		const char *	not_before,
		const char *	not_after
	)

Set the validity period for a Certificate Timestamps should be in string format for UTC timezone i.e.

"YYYYMMDDhhmmss" e.g. "20131231235959" for December 31st 2013 at 23:59:59

Parameters:

ctx	CRT context to use
not_before	not_before timestamp
not_after	not_after timestamp

Returns:: 0 if timestamp was parsed successfully, or a specific error code

Definition at line 114 of file x509write_crt.c.

void x509write_crt_set_version	(	x509write_cert *	ctx,
		int	version
	)

Set the verion for a Certificate Default: X509_CRT_VERSION_3.

Parameters:

ctx	CRT context to use
version	version to set (X509_CRT_VERSION_1, X509_CRT_VERSION_2 or X509_CRT_VERSION_3)

Definition at line 72 of file x509write_crt.c.

Type:	Library
Created:	11 Jun 2015
Imports:	10
Forks:	0
Commits:	1
Dependents:	2
Dependencies:	0
Followers:	1

x509_crt.h File Reference

Data Structures

Functions

Structures and functions for parsing and writing X.509 certificates

Detailed Description

Function Documentation

Repository toolbox

Repository details

Important Information for this Arm website

x509_crt.h File Reference

Data Structures

Functions

Structures and functions for parsing and writing X.509 certificates

Detailed Description

Function Documentation

Repository toolbox

Repository details

Important Information for this Arm website

Access Warning