x509_crt.h
Go to the documentation of this file.
/*
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
* SPDX-License-Identifier: Apache-2.0
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may
* not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
* This file is part of mbed TLS (https://tls.mbed.org)
*/
#ifndef MBEDTLS_X509_CRT_H
#define MBEDTLS_X509_CRT_H
#if !defined(MBEDTLS_CONFIG_FILE)
#include "config.h"
#else
#include MBEDTLS_CONFIG_FILE
#endif
#include "x509.h"
#include "x509_crl.h"
#ifdef __cplusplus
extern "C" {
#endif
typedef struct mbedtls_x509_crt
{
mbedtls_x509_buf raw;
mbedtls_x509_buf tbs;
int version;
mbedtls_x509_buf serial;
mbedtls_x509_buf sig_oid;
mbedtls_x509_buf issuer_raw;
mbedtls_x509_buf subject_raw;
mbedtls_x509_name issuer;
mbedtls_x509_name subject;
mbedtls_x509_time valid_from;
mbedtls_x509_time valid_to;
mbedtls_pk_context pk;
mbedtls_x509_buf issuer_id;
mbedtls_x509_buf subject_id;
mbedtls_x509_buf v3_ext;
mbedtls_x509_sequence subject_alt_names;
int ext_types;
int ca_istrue;
int max_pathlen;
unsigned int key_usage;
mbedtls_x509_sequence ext_key_usage;
unsigned char ns_cert_type;
mbedtls_x509_buf sig;
mbedtls_md_type_t sig_md;
mbedtls_pk_type_t sig_pk;
void *sig_opts;
struct mbedtls_x509_crt *next;
}
mbedtls_x509_crt;
#define MBEDTLS_X509_ID_FLAG( id ) ( 1 << ( id - 1 ) )
typedef struct
{
uint32_t allowed_mds;
uint32_t allowed_pks;
uint32_t allowed_curves;
uint32_t rsa_min_bitlen;
}
mbedtls_x509_crt_profile;
#define MBEDTLS_X509_CRT_VERSION_1 0
#define MBEDTLS_X509_CRT_VERSION_2 1
#define MBEDTLS_X509_CRT_VERSION_3 2
#define MBEDTLS_X509_RFC5280_MAX_SERIAL_LEN 32
#define MBEDTLS_X509_RFC5280_UTC_TIME_LEN 15
#if !defined( MBEDTLS_X509_MAX_FILE_PATH_LEN )
#define MBEDTLS_X509_MAX_FILE_PATH_LEN 512
#endif
typedef struct mbedtls_x509write_cert
{
int version;
mbedtls_mpi serial;
mbedtls_pk_context *subject_key;
mbedtls_pk_context *issuer_key;
mbedtls_asn1_named_data *subject;
mbedtls_asn1_named_data *issuer;
mbedtls_md_type_t md_alg;
char not_before[MBEDTLS_X509_RFC5280_UTC_TIME_LEN + 1];
char not_after[MBEDTLS_X509_RFC5280_UTC_TIME_LEN + 1];
mbedtls_asn1_named_data *extensions;
}
mbedtls_x509write_cert;
#if defined(MBEDTLS_X509_CRT_PARSE_C)
extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_default;
extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_next;
extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_suiteb;
int mbedtls_x509_crt_parse_der( mbedtls_x509_crt *chain, const unsigned char *buf,
size_t buflen );
int mbedtls_x509_crt_parse( mbedtls_x509_crt *chain, const unsigned char *buf, size_t buflen );
#if defined(MBEDTLS_FS_IO)
int mbedtls_x509_crt_parse_file( mbedtls_x509_crt *chain, const char *path );
int mbedtls_x509_crt_parse_path( mbedtls_x509_crt *chain, const char *path );
#endif /* MBEDTLS_FS_IO */
int mbedtls_x509_crt_info( char *buf, size_t size, const char *prefix,
const mbedtls_x509_crt *crt );
int mbedtls_x509_crt_verify_info( char *buf, size_t size, const char *prefix,
uint32_t flags );
int mbedtls_x509_crt_verify( mbedtls_x509_crt *crt,
mbedtls_x509_crt *trust_ca,
mbedtls_x509_crl *ca_crl,
const char *cn, uint32_t *flags,
int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
void *p_vrfy );
int mbedtls_x509_crt_verify_with_profile( mbedtls_x509_crt *crt,
mbedtls_x509_crt *trust_ca,
mbedtls_x509_crl *ca_crl,
const mbedtls_x509_crt_profile *profile,
const char *cn, uint32_t *flags,
int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
void *p_vrfy );
#if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
int mbedtls_x509_crt_check_key_usage( const mbedtls_x509_crt *crt,
unsigned int usage );
#endif /* MBEDTLS_X509_CHECK_KEY_USAGE) */
#if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
int mbedtls_x509_crt_check_extended_key_usage( const mbedtls_x509_crt *crt,
const char *usage_oid,
size_t usage_len );
#endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE */
#if defined(MBEDTLS_X509_CRL_PARSE_C)
int mbedtls_x509_crt_is_revoked( const mbedtls_x509_crt *crt, const mbedtls_x509_crl *crl );
#endif /* MBEDTLS_X509_CRL_PARSE_C */
void mbedtls_x509_crt_init( mbedtls_x509_crt *crt );
void mbedtls_x509_crt_free( mbedtls_x509_crt *crt );
#endif /* MBEDTLS_X509_CRT_PARSE_C */
/* \} name */
/* \} addtogroup x509_module */
#if defined(MBEDTLS_X509_CRT_WRITE_C)
void mbedtls_x509write_crt_init( mbedtls_x509write_cert *ctx );
void mbedtls_x509write_crt_set_version( mbedtls_x509write_cert *ctx, int version );
int mbedtls_x509write_crt_set_serial( mbedtls_x509write_cert *ctx, const mbedtls_mpi *serial );
int mbedtls_x509write_crt_set_validity( mbedtls_x509write_cert *ctx, const char *not_before,
const char *not_after );
int mbedtls_x509write_crt_set_issuer_name( mbedtls_x509write_cert *ctx,
const char *issuer_name );
int mbedtls_x509write_crt_set_subject_name( mbedtls_x509write_cert *ctx,
const char *subject_name );
void mbedtls_x509write_crt_set_subject_key( mbedtls_x509write_cert *ctx, mbedtls_pk_context *key );
void mbedtls_x509write_crt_set_issuer_key( mbedtls_x509write_cert *ctx, mbedtls_pk_context *key );
void mbedtls_x509write_crt_set_md_alg( mbedtls_x509write_cert *ctx, mbedtls_md_type_t md_alg );
int mbedtls_x509write_crt_set_extension( mbedtls_x509write_cert *ctx,
const char *oid, size_t oid_len,
int critical,
const unsigned char *val, size_t val_len );
int mbedtls_x509write_crt_set_basic_constraints( mbedtls_x509write_cert *ctx,
int is_ca, int max_pathlen );
#if defined(MBEDTLS_SHA1_C)
int mbedtls_x509write_crt_set_subject_key_identifier( mbedtls_x509write_cert *ctx );
int mbedtls_x509write_crt_set_authority_key_identifier( mbedtls_x509write_cert *ctx );
#endif /* MBEDTLS_SHA1_C */
int mbedtls_x509write_crt_set_key_usage( mbedtls_x509write_cert *ctx,
unsigned int key_usage );
int mbedtls_x509write_crt_set_ns_cert_type( mbedtls_x509write_cert *ctx,
unsigned char ns_cert_type );
void mbedtls_x509write_crt_free( mbedtls_x509write_cert *ctx );
int mbedtls_x509write_crt_der( mbedtls_x509write_cert *ctx, unsigned char *buf, size_t size,
int (*f_rng)(void *, unsigned char *, size_t),
void *p_rng );
#if defined(MBEDTLS_PEM_WRITE_C)
int mbedtls_x509write_crt_pem( mbedtls_x509write_cert *ctx, unsigned char *buf, size_t size,
int (*f_rng)(void *, unsigned char *, size_t),
void *p_rng );
#endif /* MBEDTLS_PEM_WRITE_C */
#endif /* MBEDTLS_X509_CRT_WRITE_C */
#ifdef __cplusplus
}
#endif
#endif /* mbedtls_x509_crt.h */
mbedtls_x509write_crt_set_authority_key_identifier
int mbedtls_x509write_crt_set_authority_key_identifier(mbedtls_x509write_cert *ctx)
Set the authorityKeyIdentifier extension for a CRT Requires that mbedtls_x509write_crt_set_issuer_key...
mbedtls_x509_crt_verify
int mbedtls_x509_crt_verify(mbedtls_x509_crt *crt, mbedtls_x509_crt *trust_ca, mbedtls_x509_crl *ca_crl, const char *cn, uint32_t *flags, int(*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), void *p_vrfy)
Verify the certificate signature.
mbedtls_pk_context
Public key container.
Definition: pk.h:128
mbedtls_x509write_crt_der
int mbedtls_x509write_crt_der(mbedtls_x509write_cert *ctx, unsigned char *buf, size_t size, int(*f_rng)(void *, unsigned char *, size_t), void *p_rng)
Write a built up certificate to a X509 DER structure Note: data is written at the end of the buffer! ...
mbedtls_x509_crt_verify_with_profile
int mbedtls_x509_crt_verify_with_profile(mbedtls_x509_crt *crt, mbedtls_x509_crt *trust_ca, mbedtls_x509_crl *ca_crl, const mbedtls_x509_crt_profile *profile, const char *cn, uint32_t *flags, int(*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), void *p_vrfy)
Verify the certificate signature according to profile.
mbedtls_x509_crt::subject_alt_names
mbedtls_x509_sequence subject_alt_names
Definition: x509_crt.h:76
mbedtls_x509_crt::ext_types
int ext_types
Definition: x509_crt.h:78
mbedtls_x509_crt_profile::allowed_curves
uint32_t allowed_curves
Definition: x509_crt.h:112
mbedtls_x509_crl
Definition: x509_crl.h:70
mbedtls_x509_crt_parse_der
int mbedtls_x509_crt_parse_der(mbedtls_x509_crt *chain, const unsigned char *buf, size_t buflen)
Parse a single DER formatted certificate and add it to the chained list.
mbedtls_x509write_crt_set_extension
int mbedtls_x509write_crt_set_extension(mbedtls_x509write_cert *ctx, const char *oid, size_t oid_len, int critical, const unsigned char *val, size_t val_len)
Generic function to add to or replace an extension in the CRT.
mbedtls_x509write_crt_set_ns_cert_type
int mbedtls_x509write_crt_set_ns_cert_type(mbedtls_x509write_cert *ctx, unsigned char ns_cert_type)
Set the Netscape Cert Type flags (e.g. MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT | MBEDTLS_X509_NS_CERT_TY...
mbedtls_pk_type_t
mbedtls_pk_type_t
Public key types.
Definition: pk.h:76
mbedtls_x509_crt_is_revoked
int mbedtls_x509_crt_is_revoked(const mbedtls_x509_crt *crt, const mbedtls_x509_crl *crl)
Verify the certificate revocation status.
config.h
Configuration options (set of defines)
mbedtls_x509write_crt_pem
int mbedtls_x509write_crt_pem(mbedtls_x509write_cert *ctx, unsigned char *buf, size_t size, int(*f_rng)(void *, unsigned char *, size_t), void *p_rng)
Write a built up certificate to a X509 PEM string.
mbedtls_x509_crt::next
struct mbedtls_x509_crt * next
Definition: x509_crt.h:93
mbedtls_asn1_sequence
Definition: asn1.h:156
mbedtls_x509_crt_profile_default
const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_default
mbedtls_x509_crt_check_key_usage
int mbedtls_x509_crt_check_key_usage(const mbedtls_x509_crt *crt, unsigned int usage)
Check usage of certificate against keyUsage extension.
mbedtls_x509_crt::issuer
mbedtls_x509_name issuer
Definition: x509_crt.h:65
mbedtls_x509write_crt_set_subject_key
void mbedtls_x509write_crt_set_subject_key(mbedtls_x509write_cert *ctx, mbedtls_pk_context *key)
Set the subject public key for the certificate.
mbedtls_x509write_crt_set_key_usage
int mbedtls_x509write_crt_set_key_usage(mbedtls_x509write_cert *ctx, unsigned int key_usage)
Set the Key Usage Extension flags (e.g. MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_KEY_CERT_...
mbedtls_x509write_crt_init
void mbedtls_x509write_crt_init(mbedtls_x509write_cert *ctx)
Initialize a CRT writing context.
mbedtls_x509_crt::subject_id
mbedtls_x509_buf subject_id
Definition: x509_crt.h:74
mbedtls_x509write_cert
struct mbedtls_x509write_cert mbedtls_x509write_cert
mbedtls_x509write_crt_set_md_alg
void mbedtls_x509write_crt_set_md_alg(mbedtls_x509write_cert *ctx, mbedtls_md_type_t md_alg)
Set the MD algorithm to use for the signature (e.g. MBEDTLS_MD_SHA1)
mbedtls_x509_crt::tbs
mbedtls_x509_buf tbs
Definition: x509_crt.h:56
mbedtls_asn1_named_data
Definition: asn1.h:166
mbedtls_x509_crt::subject_raw
mbedtls_x509_buf subject_raw
Definition: x509_crt.h:63
mbedtls_x509_crt_free
void mbedtls_x509_crt_free(mbedtls_x509_crt *crt)
Unallocate all certificate data.
mbedtls_x509_crt::sig_oid
mbedtls_x509_buf sig_oid
Definition: x509_crt.h:60
mbedtls_x509_crt::issuer_raw
mbedtls_x509_buf issuer_raw
Definition: x509_crt.h:62
mbedtls_x509_crt_profile_suiteb
const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_suiteb
mbedtls_x509write_crt_set_basic_constraints
int mbedtls_x509write_crt_set_basic_constraints(mbedtls_x509write_cert *ctx, int is_ca, int max_pathlen)
Set the basicConstraints extension for a CRT.
mbedtls_x509_crt::subject
mbedtls_x509_name subject
Definition: x509_crt.h:66
mbedtls_x509_crt::valid_to
mbedtls_x509_time valid_to
Definition: x509_crt.h:69
mbedtls_x509_crt_parse
int mbedtls_x509_crt_parse(mbedtls_x509_crt *chain, const unsigned char *buf, size_t buflen)
Parse one or more certificates and add them to the chained list. Parses permissively. If some certificates can be parsed, the result is the number of failed certificates it encountered. If none complete correctly, the first error is returned.
mbedtls_x509_crt::ns_cert_type
unsigned char ns_cert_type
Definition: x509_crt.h:86
mbedtls_asn1_buf
Definition: asn1.h:134
mbedtls_x509_time
Definition: x509.h:208
mbedtls_x509_crt_parse_path
int mbedtls_x509_crt_parse_path(mbedtls_x509_crt *chain, const char *path)
Load one or more certificate files from a path and add them to the chained list. Parses permissively...
mbedtls_x509write_cert
Definition: x509_crt.h:131
mbedtls_x509write_cert::version
int version
Definition: x509_crt.h:133
mbedtls_x509write_crt_set_subject_key_identifier
int mbedtls_x509write_crt_set_subject_key_identifier(mbedtls_x509write_cert *ctx)
Set the subjectKeyIdentifier extension for a CRT Requires that mbedtls_x509write_crt_set_subject_key(...
mbedtls_x509write_crt_set_subject_name
int mbedtls_x509write_crt_set_subject_name(mbedtls_x509write_cert *ctx, const char *subject_name)
Set the subject name for a Certificate Subject names should contain a comma-separated list of OID typ...
mbedtls_x509_crt::serial
mbedtls_x509_buf serial
Definition: x509_crt.h:59
mbedtls_x509write_crt_set_version
void mbedtls_x509write_crt_set_version(mbedtls_x509write_cert *ctx, int version)
Set the verion for a Certificate Default: MBEDTLS_X509_CRT_VERSION_3.
mbedtls_x509_crt_profile::rsa_min_bitlen
uint32_t rsa_min_bitlen
Definition: x509_crt.h:113
mbedtls_x509_crt::valid_from
mbedtls_x509_time valid_from
Definition: x509_crt.h:68
mbedtls_x509_crt::raw
mbedtls_x509_buf raw
Definition: x509_crt.h:55
mbedtls_x509_crt_check_extended_key_usage
int mbedtls_x509_crt_check_extended_key_usage(const mbedtls_x509_crt *crt, const char *usage_oid, size_t usage_len)
Check usage of certificate against extendedKeyUsage.
mbedtls_x509write_crt_set_validity
int mbedtls_x509write_crt_set_validity(mbedtls_x509write_cert *ctx, const char *not_before, const char *not_after)
Set the validity period for a Certificate Timestamps should be in string format for UTC timezone i...
MBEDTLS_X509_RFC5280_UTC_TIME_LEN
#define MBEDTLS_X509_RFC5280_UTC_TIME_LEN
Definition: x509_crt.h:122
mbedtls_x509write_crt_set_issuer_key
void mbedtls_x509write_crt_set_issuer_key(mbedtls_x509write_cert *ctx, mbedtls_pk_context *key)
Set the issuer key used for signing the certificate.
mbedtls_x509_crt_profile_next
const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_next
mbedtls_x509write_cert::subject_key
mbedtls_pk_context * subject_key
Definition: x509_crt.h:135
mbedtls_x509_crt::sig_pk
mbedtls_pk_type_t sig_pk
Definition: x509_crt.h:90
x509.h
X.509 generic defines and structures.
mbedtls_x509_crt_info
int mbedtls_x509_crt_info(char *buf, size_t size, const char *prefix, const mbedtls_x509_crt *crt)
Returns an informational string about the certificate.
mbedtls_x509write_crt_set_issuer_name
int mbedtls_x509write_crt_set_issuer_name(mbedtls_x509write_cert *ctx, const char *issuer_name)
Set the issuer name for a Certificate Issuer names should contain a comma-separated list of OID types...
mbedtls_x509write_cert::subject
mbedtls_asn1_named_data * subject
Definition: x509_crt.h:137
mbedtls_x509_crt_parse_file
int mbedtls_x509_crt_parse_file(mbedtls_x509_crt *chain, const char *path)
Load one or more certificates and add them to the chained list. Parses permissively. If some certificates can be parsed, the result is the number of failed certificates it encountered. If none complete correctly, the first error is returned.
mbedtls_x509write_cert::issuer_key
mbedtls_pk_context * issuer_key
Definition: x509_crt.h:136
mbedtls_x509_crt::sig_opts
void * sig_opts
Definition: x509_crt.h:91
mbedtls_x509write_cert::md_alg
mbedtls_md_type_t md_alg
Definition: x509_crt.h:139
mbedtls_x509_crt::issuer_id
mbedtls_x509_buf issuer_id
Definition: x509_crt.h:73
mbedtls_x509write_crt_set_serial
int mbedtls_x509write_crt_set_serial(mbedtls_x509write_cert *ctx, const mbedtls_mpi *serial)
Set the serial number for a Certificate.
mbedtls_mpi
MPI structure.
Definition: bignum.h:180
x509_crl.h
X.509 certificate revocation list parsing.
mbedtls_x509write_crt_free
void mbedtls_x509write_crt_free(mbedtls_x509write_cert *ctx)
Free the contents of a CRT write context.
mbedtls_x509_crt
Definition: x509_crt.h:53
mbedtls_x509_crt
struct mbedtls_x509_crt mbedtls_x509_crt
mbedtls_x509_crt::ext_key_usage
mbedtls_x509_sequence ext_key_usage
Definition: x509_crt.h:84
mbedtls_x509_crt::max_pathlen
int max_pathlen
Definition: x509_crt.h:80
mbedtls_x509_crt_profile
Definition: x509_crt.h:108
mbedtls_x509_crt_init
void mbedtls_x509_crt_init(mbedtls_x509_crt *crt)
Initialize a certificate (chain)
mbedtls_x509write_cert::extensions
mbedtls_asn1_named_data * extensions
Definition: x509_crt.h:142
mbedtls_x509_crt::key_usage
unsigned int key_usage
Definition: x509_crt.h:82
mbedtls_x509_crt_profile::allowed_pks
uint32_t allowed_pks
Definition: x509_crt.h:111
mbedtls_x509_crt_profile::allowed_mds
uint32_t allowed_mds
Definition: x509_crt.h:110
mbedtls_x509_crt::pk
mbedtls_pk_context pk
Definition: x509_crt.h:71
mbedtls_x509_crt::sig
mbedtls_x509_buf sig
Definition: x509_crt.h:88
mbedtls_md_type_t
mbedtls_md_type_t
Enumeration of supported message digests.
Definition: md.h:56
mbedtls_x509_crt_verify_info
int mbedtls_x509_crt_verify_info(char *buf, size_t size, const char *prefix, uint32_t flags)
Returns an informational string about the verification status of a certificate.
mbedtls_x509write_cert::issuer
mbedtls_asn1_named_data * issuer
Definition: x509_crt.h:138
mbedtls_x509write_cert::serial
mbedtls_mpi serial
Definition: x509_crt.h:134
mbedtls_x509_crt::v3_ext
mbedtls_x509_buf v3_ext
Definition: x509_crt.h:75
mbedtls_x509_crt::ca_istrue
int ca_istrue
Definition: x509_crt.h:79
mbedtls_x509_crt::version
int version
Definition: x509_crt.h:58
mbedtls_x509_crt::sig_md
mbedtls_md_type_t sig_md
Definition: x509_crt.h:89