x509.h
mbedtls/private_access.h
mbedtls/build_info.h
mbedtls/asn1.h
mbedtls/pk.h
mbedtls/rsa.h
x509_crl.h
x509_crt.h
x509_csr.h
mbedtls/asn1.h
mbedtls/bignum.h
mbedtls/build_info.h
mbedtls/ccm.h
mbedtls/chacha20.h
mbedtls/chachapoly.h
mbedtls/check_config.h
mbedtls/cipher.h
mbedtls/cmac.h
mbedtls/config_adjust_legacy_crypto.h
mbedtls/config_adjust_psa_from_legacy.h
mbedtls/config_adjust_psa_superset_legacy.h
mbedtls/config_adjust_ssl.h
mbedtls/config_adjust_x509.h
mbedtls/config_psa.h
mbedtls/ecdsa.h
mbedtls/ecjpake.h
mbedtls/ecp.h
mbedtls/gcm.h
mbedtls/mbedtls_config.h
mbedtls/md.h
mbedtls/md5.h
mbedtls/pk.h
mbedtls/platform_time.h
mbedtls/platform_util.h
mbedtls/poly1305.h
mbedtls/private_access.h
mbedtls/ripemd160.h
mbedtls/rsa.h
mbedtls/sha1.h
mbedtls/sha256.h
mbedtls/sha3.h
mbedtls/sha512.h
mbedtls/threading.h
x509.h
psa/build_info.h
psa/crypto.h
psa/crypto_adjust_auto_enabled.h
psa/crypto_adjust_config_dependencies.h
psa/crypto_adjust_config_key_pair_types.h
psa/crypto_adjust_config_synonyms.h
psa/crypto_builtin_composites.h
psa/crypto_builtin_key_derivation.h
psa/crypto_builtin_primitives.h
crypto_compat.h
psa/crypto_driver_common.h
psa/crypto_driver_contexts_composites.h
psa/crypto_driver_contexts_key_derivation.h
psa/crypto_driver_contexts_primitives.h
crypto_extra.h
psa/crypto_legacy.h
crypto_platform.h
crypto_sizes.h
crypto_struct.h
crypto_types.h
crypto_values.h
inttypes.h
limits.h
pthread.h
stddef.h
stdint.h
stdio.h
stdlib.h
time.h
debug.h
net_sockets.h
pkcs7.h
ssl.h
ssl_cache.h
ssl_cookie.h
ssl_ticket.h
x509.h
x509_crl.h
x509_crt.h
x509_csr.h
mbedtls_x509_authority
mbedtls_x509_time
mbedtls_x509_san_other_name
mbedtls_x509_subject_alternative_name
mbedtls_x509_san_list
X509 Error codes
- MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE
- MBEDTLS_ERR_X509_UNKNOWN_OID
- MBEDTLS_ERR_X509_INVALID_FORMAT
- MBEDTLS_ERR_X509_INVALID_VERSION
- MBEDTLS_ERR_X509_INVALID_SERIAL
- MBEDTLS_ERR_X509_INVALID_ALG
- MBEDTLS_ERR_X509_INVALID_NAME
- MBEDTLS_ERR_X509_INVALID_DATE
- MBEDTLS_ERR_X509_INVALID_SIGNATURE
- MBEDTLS_ERR_X509_INVALID_EXTENSIONS
- MBEDTLS_ERR_X509_UNKNOWN_VERSION
- MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG
- MBEDTLS_ERR_X509_SIG_MISMATCH
- MBEDTLS_ERR_X509_CERT_VERIFY_FAILED
- MBEDTLS_ERR_X509_CERT_UNKNOWN_FORMAT
- MBEDTLS_ERR_X509_BAD_INPUT_DATA
- MBEDTLS_ERR_X509_ALLOC_FAILED
- MBEDTLS_ERR_X509_FILE_IO_ERROR
- MBEDTLS_ERR_X509_BUFFER_TOO_SMALL
- MBEDTLS_ERR_X509_FATAL_ERROR
X509 Verify codes
- MBEDTLS_X509_BADCERT_EXPIRED
- MBEDTLS_X509_BADCERT_REVOKED
- MBEDTLS_X509_BADCERT_CN_MISMATCH
- MBEDTLS_X509_BADCERT_NOT_TRUSTED
- MBEDTLS_X509_BADCRL_NOT_TRUSTED
- MBEDTLS_X509_BADCRL_EXPIRED
- MBEDTLS_X509_BADCERT_MISSING
- MBEDTLS_X509_BADCERT_SKIP_VERIFY
- MBEDTLS_X509_BADCERT_OTHER
- MBEDTLS_X509_BADCERT_FUTURE
- MBEDTLS_X509_BADCRL_FUTURE
- MBEDTLS_X509_BADCERT_KEY_USAGE
- MBEDTLS_X509_BADCERT_EXT_KEY_USAGE
- MBEDTLS_X509_BADCERT_NS_CERT_TYPE
- MBEDTLS_X509_BADCERT_BAD_MD
- MBEDTLS_X509_BADCERT_BAD_PK
- MBEDTLS_X509_BADCERT_BAD_KEY
- MBEDTLS_X509_BADCRL_BAD_MD
- MBEDTLS_X509_BADCRL_BAD_PK
- MBEDTLS_X509_BADCRL_BAD_KEY
Structures for parsing X.509 certificates, CRLs and CSRs
- mbedtls_x509_buf
- mbedtls_x509_bitstring
- mbedtls_x509_name
- mbedtls_x509_sequence
- mbedtls_x509_authority
- mbedtls_x509_time
- mbedtls_x509_san_other_name
- mbedtls_x509_subject_alternative_name
- mbedtls_x509_san_list
- MBEDTLS_X509_MAX_INTERMEDIATE_CA
MBEDTLS_X509_SAN_OTHER_NAME
0
MBEDTLS_X509_SAN_RFC822_NAME
1
MBEDTLS_X509_SAN_DNS_NAME
2
MBEDTLS_X509_SAN_X400_ADDRESS_NAME
3
MBEDTLS_X509_SAN_DIRECTORY_NAME
4
MBEDTLS_X509_SAN_EDI_PARTY_NAME
5
MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER
6
MBEDTLS_X509_SAN_IP_ADDRESS
7
MBEDTLS_X509_SAN_REGISTERED_ID
8
MBEDTLS_X509_KU_DIGITAL_SIGNATURE
(0x80) /* bit 0 */
MBEDTLS_X509_KU_NON_REPUDIATION
(0x40) /* bit 1 */
MBEDTLS_X509_KU_KEY_ENCIPHERMENT
(0x20) /* bit 2 */
MBEDTLS_X509_KU_DATA_ENCIPHERMENT
(0x10) /* bit 3 */
MBEDTLS_X509_KU_KEY_AGREEMENT
(0x08) /* bit 4 */
MBEDTLS_X509_KU_KEY_CERT_SIGN
(0x04) /* bit 5 */
MBEDTLS_X509_KU_CRL_SIGN
(0x02) /* bit 6 */
MBEDTLS_X509_KU_ENCIPHER_ONLY
(0x01) /* bit 7 */
MBEDTLS_X509_KU_DECIPHER_ONLY
(0x8000) /* bit 8 */
MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT
(0x80) /* bit 0 */
MBEDTLS_X509_NS_CERT_TYPE_SSL_SERVER
(0x40) /* bit 1 */
MBEDTLS_X509_NS_CERT_TYPE_EMAIL
(0x20) /* bit 2 */
MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING
(0x10) /* bit 3 */
MBEDTLS_X509_NS_CERT_TYPE_RESERVED
(0x08) /* bit 4 */
MBEDTLS_X509_NS_CERT_TYPE_SSL_CA
(0x04) /* bit 5 */
MBEDTLS_X509_NS_CERT_TYPE_EMAIL_CA
(0x02) /* bit 6 */
MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING_CA
(0x01) /* bit 7 */
MBEDTLS_X509_EXT_AUTHORITY_KEY_IDENTIFIER
MBEDTLS_OID_X509_EXT_AUTHORITY_KEY_IDENTIFIER
MBEDTLS_X509_EXT_SUBJECT_KEY_IDENTIFIER
MBEDTLS_OID_X509_EXT_SUBJECT_KEY_IDENTIFIER
MBEDTLS_X509_EXT_KEY_USAGE
MBEDTLS_OID_X509_EXT_KEY_USAGE
MBEDTLS_X509_EXT_CERTIFICATE_POLICIES
MBEDTLS_OID_X509_EXT_CERTIFICATE_POLICIES
MBEDTLS_X509_EXT_POLICY_MAPPINGS
MBEDTLS_OID_X509_EXT_POLICY_MAPPINGS
MBEDTLS_X509_EXT_SUBJECT_ALT_NAME
MBEDTLS_OID_X509_EXT_SUBJECT_ALT_NAME
/* Supported (DNS) */
MBEDTLS_X509_EXT_ISSUER_ALT_NAME
MBEDTLS_OID_X509_EXT_ISSUER_ALT_NAME
MBEDTLS_X509_EXT_SUBJECT_DIRECTORY_ATTRS
MBEDTLS_OID_X509_EXT_SUBJECT_DIRECTORY_ATTRS
MBEDTLS_X509_EXT_BASIC_CONSTRAINTS
MBEDTLS_OID_X509_EXT_BASIC_CONSTRAINTS
/* Supported */
MBEDTLS_X509_EXT_NAME_CONSTRAINTS
MBEDTLS_OID_X509_EXT_NAME_CONSTRAINTS
MBEDTLS_X509_EXT_POLICY_CONSTRAINTS
MBEDTLS_OID_X509_EXT_POLICY_CONSTRAINTS
MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE
MBEDTLS_OID_X509_EXT_EXTENDED_KEY_USAGE
MBEDTLS_X509_EXT_CRL_DISTRIBUTION_POINTS
MBEDTLS_OID_X509_EXT_CRL_DISTRIBUTION_POINTS
MBEDTLS_X509_EXT_INIHIBIT_ANYPOLICY
MBEDTLS_OID_X509_EXT_INIHIBIT_ANYPOLICY
MBEDTLS_X509_EXT_FRESHEST_CRL
MBEDTLS_OID_X509_EXT_FRESHEST_CRL
MBEDTLS_X509_EXT_NS_CERT_TYPE
MBEDTLS_OID_X509_EXT_NS_CERT_TYPE
MBEDTLS_X509_FORMAT_DER
1
MBEDTLS_X509_FORMAT_PEM
2
MBEDTLS_X509_MAX_DN_NAME_SIZE
256

Maximum value size of a DN entry

MBEDTLS_X509_SAFE_SNPRINTF
do { \ if (ret < 0 || (size_t) ret >= n) \ return MBEDTLS_ERR_X509_BUFFER_TOO_SMALL; \ \ n -= (size_t) ret; \ p += (size_t) ret; \ } while (0)
int int mbedtls_x509_dn_gets (char *buf, size_t size, const mbedtls_x509_name *dn) mbedtls_x509_dn_gets char * buf size_t size const mbedtls_x509_name * dn

Store the certificate DN in printable form into buf; no more than size characters will be written.

buf

Buffer to write to

size

Maximum size of buffer

dn

The X509 name to represent

The length of the string written (not including the terminated nul byte), or a negative error code.

int int mbedtls_x509_string_to_names (mbedtls_asn1_named_data **head, const char *name) mbedtls_x509_string_to_names mbedtls_asn1_named_data ** head const char * name

Convert the certificate DN string `name` into a linked list of mbedtls_x509_name (equivalent to mbedtls_asn1_named_data).

This function allocates a linked list, and places the head pointer in `head`. This list must later be freed by a call to mbedtls_asn1_free_named_data_list().

head

Address in which to store the pointer to the head of the allocated list of mbedtls_x509_name

name

The string representation of a DN to convert

0 on success, or a negative error code.

mbedtls_x509_name * static mbedtls_x509_name * mbedtls_x509_dn_get_next (mbedtls_x509_name *dn) mbedtls_x509_dn_get_next mbedtls_x509_name * dn

Return the next relative DN in an X509 name.

Intended use is to compare function result to dn->next in order to detect boundaries of multi-valued RDNs.

dn

Current node in the X509 name

Pointer to the first attribute-value pair of the next RDN in sequence, or NULL if end is reached.

mbedtls_asn1_named_data::next
int int mbedtls_x509_serial_gets (char *buf, size_t size, const mbedtls_x509_buf *serial) mbedtls_x509_serial_gets char * buf size_t size const mbedtls_x509_buf * serial

Store the certificate serial in printable form into buf; no more than size characters will be written.

buf

Buffer to write to

size

Maximum size of buffer

serial

The X509 serial to represent

The length of the string written (not including the terminated nul byte), or a negative error code.

int int mbedtls_x509_time_cmp (const mbedtls_x509_time *t1, const mbedtls_x509_time *t2) mbedtls_x509_time_cmp const mbedtls_x509_time * t1 const mbedtls_x509_time * t2

Compare pair of mbedtls_x509_time.

t1

mbedtls_x509_time to compare

t2

mbedtls_x509_time to compare

< 0 if t1 is before t2 0 if t1 equals t2 > 0 if t1 is after t2

int int mbedtls_x509_time_gmtime (mbedtls_time_t tt, mbedtls_x509_time *now) mbedtls_x509_time_gmtime mbedtls_time_t tt mbedtls_x509_time * now

Fill mbedtls_x509_time with provided mbedtls_time_t.

tt

mbedtls_time_t to convert

now

mbedtls_x509_time to fill with converted mbedtls_time_t

`0` on success

A non-zero return value on failure.

int int mbedtls_x509_time_is_past (const mbedtls_x509_time *to) mbedtls_x509_time_is_past const mbedtls_x509_time * to

Check a given mbedtls_x509_time against the system time and tell if it's in the past.

Intended usage is "if( is_past( valid_to ) ) ERROR". Hence the return value of 1 if on internal errors.

to

mbedtls_x509_time to check

1 if the given time is in the past or an error occurred, 0 otherwise.

int int mbedtls_x509_time_is_future (const mbedtls_x509_time *from) mbedtls_x509_time_is_future const mbedtls_x509_time * from

Check a given mbedtls_x509_time against the system time and tell if it's in the future.

Intended usage is "if( is_future( valid_from ) ) ERROR". Hence the return value of 1 if on internal errors.

from

mbedtls_x509_time to check

1 if the given time is in the future or an error occurred, 0 otherwise.

int int mbedtls_x509_parse_subject_alt_name (const mbedtls_x509_buf *san_buf, mbedtls_x509_subject_alternative_name *san) mbedtls_x509_parse_subject_alt_name const mbedtls_x509_buf * san_buf mbedtls_x509_subject_alternative_name * san

This function parses an item in the SubjectAlternativeNames extension. Please note that this function might allocate additional memory for a subject alternative name, thus mbedtls_x509_free_subject_alt_name has to be called to dispose of this additional memory afterwards.

san_buf

The buffer holding the raw data item of the subject alternative name.

san

The target structure to populate with the parsed presentation of the subject alternative name encoded in `san_buf`.

Supported GeneralName types, as defined in RFC 5280: "rfc822Name", "dnsName", "directoryName", "uniformResourceIdentifier" and "hardware_module_name" of type "otherName", as defined in RFC 4108.

This function should be called on a single raw data of subject alternative name. For example, after successful certificate parsing, one must iterate on every item in the `crt->subject_alt_names` sequence, and pass it to this function.

The target structure contains pointers to the raw data of the parsed certificate, and its lifetime is restricted by the lifetime of the certificate.

`0` on success

MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE for an unsupported SAN type.

Another negative value for any other failure.

void void mbedtls_x509_free_subject_alt_name (mbedtls_x509_subject_alternative_name *san) mbedtls_x509_free_subject_alt_name mbedtls_x509_subject_alternative_name * san

Unallocate all data related to subject alternative name.

san

SAN structure - extra memory owned by this structure will be freed

size_t size_t mbedtls_x509_crt_parse_cn_inet_pton (const char *cn, void *dst) mbedtls_x509_crt_parse_cn_inet_pton const char * cn void * dst

This function parses a CN string as an IP address.

cn

The CN string to parse. CN string MUST be null-terminated.

dst

The target buffer to populate with the binary IP address. The buffer MUST be 16 bytes to save IPv6, and should be 4-byte aligned if the result will be used as struct in_addr. e.g. uint32_t dst[4]

`cn` is parsed as an IPv6 address if string contains ':', else `cn` is parsed as an IPv4 address.

Length of binary IP address; num bytes written to target.

`0` on failure to parse CN string as an IP address.

X.509 generic defines and structures.

    /*
    *CopyrightTheMbedTLSContributors
    *SPDX-License-Identifier:Apache-2.0ORGPL-2.0-or-later
    */
    #ifndefMBEDTLS_X509_H
    #defineMBEDTLS_X509_H
    #include"mbedtls/private_access.h"

    #include"mbedtls/build_info.h"

    #include"mbedtls/asn1.h"
    #include"mbedtls/pk.h"

    #ifdefined(MBEDTLS_RSA_C)
    #include"mbedtls/rsa.h"
    #endif

    #if!defined(MBEDTLS_X509_MAX_INTERMEDIATE_CA)
    #defineMBEDTLS_X509_MAX_INTERMEDIATE_CA8
    #endif

    #defineMBEDTLS_ERR_X509_FEATURE_UNAVAILABLE-0x2080
    #defineMBEDTLS_ERR_X509_UNKNOWN_OID-0x2100
    #defineMBEDTLS_ERR_X509_INVALID_FORMAT-0x2180
    #defineMBEDTLS_ERR_X509_INVALID_VERSION-0x2200
    #defineMBEDTLS_ERR_X509_INVALID_SERIAL-0x2280
    #defineMBEDTLS_ERR_X509_INVALID_ALG-0x2300
    #defineMBEDTLS_ERR_X509_INVALID_NAME-0x2380
    #defineMBEDTLS_ERR_X509_INVALID_DATE-0x2400
    #defineMBEDTLS_ERR_X509_INVALID_SIGNATURE-0x2480
    #defineMBEDTLS_ERR_X509_INVALID_EXTENSIONS-0x2500
    #defineMBEDTLS_ERR_X509_UNKNOWN_VERSION-0x2580
    #defineMBEDTLS_ERR_X509_UNKNOWN_SIG_ALG-0x2600
    #defineMBEDTLS_ERR_X509_SIG_MISMATCH-0x2680
    #defineMBEDTLS_ERR_X509_CERT_VERIFY_FAILED-0x2700
    #defineMBEDTLS_ERR_X509_CERT_UNKNOWN_FORMAT-0x2780
    #defineMBEDTLS_ERR_X509_BAD_INPUT_DATA-0x2800
    #defineMBEDTLS_ERR_X509_ALLOC_FAILED-0x2880
    #defineMBEDTLS_ERR_X509_FILE_IO_ERROR-0x2900
    #defineMBEDTLS_ERR_X509_BUFFER_TOO_SMALL-0x2980
    #defineMBEDTLS_ERR_X509_FATAL_ERROR-0x3000
    /*Reminder:updatex509_crt_verify_strings[]inlibrary/x509_crt.c*/
    #defineMBEDTLS_X509_BADCERT_EXPIRED0x01
    #defineMBEDTLS_X509_BADCERT_REVOKED0x02
    #defineMBEDTLS_X509_BADCERT_CN_MISMATCH0x04
    #defineMBEDTLS_X509_BADCERT_NOT_TRUSTED0x08
    #defineMBEDTLS_X509_BADCRL_NOT_TRUSTED0x10
    #defineMBEDTLS_X509_BADCRL_EXPIRED0x20
    #defineMBEDTLS_X509_BADCERT_MISSING0x40
    #defineMBEDTLS_X509_BADCERT_SKIP_VERIFY0x80
    #defineMBEDTLS_X509_BADCERT_OTHER0x0100
    #defineMBEDTLS_X509_BADCERT_FUTURE0x0200
    #defineMBEDTLS_X509_BADCRL_FUTURE0x0400
    #defineMBEDTLS_X509_BADCERT_KEY_USAGE0x0800
    #defineMBEDTLS_X509_BADCERT_EXT_KEY_USAGE0x1000
    #defineMBEDTLS_X509_BADCERT_NS_CERT_TYPE0x2000
    #defineMBEDTLS_X509_BADCERT_BAD_MD0x4000
    #defineMBEDTLS_X509_BADCERT_BAD_PK0x8000
    #defineMBEDTLS_X509_BADCERT_BAD_KEY0x010000
    #defineMBEDTLS_X509_BADCRL_BAD_MD0x020000
    #defineMBEDTLS_X509_BADCRL_BAD_PK0x040000
    #defineMBEDTLS_X509_BADCRL_BAD_KEY0x080000
    /*
    *X.509v3SubjectAlternativeNametypes.
    *otherName[0]OtherName,
    *rfc822Name[1]IA5String,
    *dNSName[2]IA5String,
    *x400Address[3]ORAddress,
    *directoryName[4]Name,
    *ediPartyName[5]EDIPartyName,
    *uniformResourceIdentifier[6]IA5String,
    *iPAddress[7]OCTETSTRING,
    *registeredID[8]OBJECTIDENTIFIER
    */
    #defineMBEDTLS_X509_SAN_OTHER_NAME0
    #defineMBEDTLS_X509_SAN_RFC822_NAME1
    #defineMBEDTLS_X509_SAN_DNS_NAME2
    #defineMBEDTLS_X509_SAN_X400_ADDRESS_NAME3
    #defineMBEDTLS_X509_SAN_DIRECTORY_NAME4
    #defineMBEDTLS_X509_SAN_EDI_PARTY_NAME5
    #defineMBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER6
    #defineMBEDTLS_X509_SAN_IP_ADDRESS7
    #defineMBEDTLS_X509_SAN_REGISTERED_ID8

    /*
    *X.509v3KeyUsageExtensionflags
    *Reminder:updatembedtls_x509_info_key_usage()whenaddingnewflags.
    */
    #defineMBEDTLS_X509_KU_DIGITAL_SIGNATURE(0x80)/*bit0*/
    #defineMBEDTLS_X509_KU_NON_REPUDIATION(0x40)/*bit1*/
    #defineMBEDTLS_X509_KU_KEY_ENCIPHERMENT(0x20)/*bit2*/
    #defineMBEDTLS_X509_KU_DATA_ENCIPHERMENT(0x10)/*bit3*/
    #defineMBEDTLS_X509_KU_KEY_AGREEMENT(0x08)/*bit4*/
    #defineMBEDTLS_X509_KU_KEY_CERT_SIGN(0x04)/*bit5*/
    #defineMBEDTLS_X509_KU_CRL_SIGN(0x02)/*bit6*/
    #defineMBEDTLS_X509_KU_ENCIPHER_ONLY(0x01)/*bit7*/
    #defineMBEDTLS_X509_KU_DECIPHER_ONLY(0x8000)/*bit8*/

    /*
    *Netscapecertificatetypes
    *(http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn3.html)
    */

    #defineMBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT(0x80)/*bit0*/
    #defineMBEDTLS_X509_NS_CERT_TYPE_SSL_SERVER(0x40)/*bit1*/
    #defineMBEDTLS_X509_NS_CERT_TYPE_EMAIL(0x20)/*bit2*/
    #defineMBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING(0x10)/*bit3*/
    #defineMBEDTLS_X509_NS_CERT_TYPE_RESERVED(0x08)/*bit4*/
    #defineMBEDTLS_X509_NS_CERT_TYPE_SSL_CA(0x04)/*bit5*/
    #defineMBEDTLS_X509_NS_CERT_TYPE_EMAIL_CA(0x02)/*bit6*/
    #defineMBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING_CA(0x01)/*bit7*/

    /*
    *X.509extensiontypes
    *
    *Commentsrefertothestatusforusingcertificates.Statuscanbe
    *differentforwritingcertificatesorreadingCRLsorCSRs.
    *
    *Thosearedefinedinoid.hasoid.cneedstheminadatastructure.Since
    *thesewerepreviouslydefinedhere,let'shavealiasesforcompatibility.
    */
    #defineMBEDTLS_X509_EXT_AUTHORITY_KEY_IDENTIFIERMBEDTLS_OID_X509_EXT_AUTHORITY_KEY_IDENTIFIER
    #defineMBEDTLS_X509_EXT_SUBJECT_KEY_IDENTIFIERMBEDTLS_OID_X509_EXT_SUBJECT_KEY_IDENTIFIER
    #defineMBEDTLS_X509_EXT_KEY_USAGEMBEDTLS_OID_X509_EXT_KEY_USAGE
    #defineMBEDTLS_X509_EXT_CERTIFICATE_POLICIESMBEDTLS_OID_X509_EXT_CERTIFICATE_POLICIES
    #defineMBEDTLS_X509_EXT_POLICY_MAPPINGSMBEDTLS_OID_X509_EXT_POLICY_MAPPINGS
    #defineMBEDTLS_X509_EXT_SUBJECT_ALT_NAMEMBEDTLS_OID_X509_EXT_SUBJECT_ALT_NAME/*Supported(DNS)*/
    #defineMBEDTLS_X509_EXT_ISSUER_ALT_NAMEMBEDTLS_OID_X509_EXT_ISSUER_ALT_NAME
    #defineMBEDTLS_X509_EXT_SUBJECT_DIRECTORY_ATTRSMBEDTLS_OID_X509_EXT_SUBJECT_DIRECTORY_ATTRS
    #defineMBEDTLS_X509_EXT_BASIC_CONSTRAINTSMBEDTLS_OID_X509_EXT_BASIC_CONSTRAINTS/*Supported*/
    #defineMBEDTLS_X509_EXT_NAME_CONSTRAINTSMBEDTLS_OID_X509_EXT_NAME_CONSTRAINTS
    #defineMBEDTLS_X509_EXT_POLICY_CONSTRAINTSMBEDTLS_OID_X509_EXT_POLICY_CONSTRAINTS
    #defineMBEDTLS_X509_EXT_EXTENDED_KEY_USAGEMBEDTLS_OID_X509_EXT_EXTENDED_KEY_USAGE
    #defineMBEDTLS_X509_EXT_CRL_DISTRIBUTION_POINTSMBEDTLS_OID_X509_EXT_CRL_DISTRIBUTION_POINTS
    #defineMBEDTLS_X509_EXT_INIHIBIT_ANYPOLICYMBEDTLS_OID_X509_EXT_INIHIBIT_ANYPOLICY
    #defineMBEDTLS_X509_EXT_FRESHEST_CRLMBEDTLS_OID_X509_EXT_FRESHEST_CRL
    #defineMBEDTLS_X509_EXT_NS_CERT_TYPEMBEDTLS_OID_X509_EXT_NS_CERT_TYPE

    /*
    *Storageformatidentifiers
    *Recognizedformats:PEMandDER
    */
    #defineMBEDTLS_X509_FORMAT_DER1
    #defineMBEDTLS_X509_FORMAT_PEM2

    #defineMBEDTLS_X509_MAX_DN_NAME_SIZE256
    #ifdef__cplusplus
    extern"C"{
    #endif

    typedefmbedtls_asn1_bufmbedtls_x509_buf;

    typedefmbedtls_asn1_bitstringmbedtls_x509_bitstring;

    typedefmbedtls_asn1_named_datambedtls_x509_name;

    typedefmbedtls_asn1_sequencembedtls_x509_sequence;

    /*
    *ContainerforthefieldsoftheAuthorityKeyIdentifierobject
    */
    typedefstructmbedtls_x509_authority{
    mbedtls_x509_bufkeyIdentifier;
    mbedtls_x509_sequenceauthorityCertIssuer;
    mbedtls_x509_bufauthorityCertSerialNumber;
    mbedtls_x509_bufraw;
    }
    mbedtls_x509_authority;

    typedefstructmbedtls_x509_time{
    intyear,mon,day;
    inthour,min,sec;
    }
    mbedtls_x509_time;

    typedefstructmbedtls_x509_san_other_name{
    mbedtls_x509_buftype_id;
    union{
    struct{
    mbedtls_x509_bufoid;
    mbedtls_x509_bufval;
    }
    hardware_module_name;
    }
    value;
    }
    mbedtls_x509_san_other_name;

    typedefstructmbedtls_x509_subject_alternative_name{
    inttype;
    union{
    mbedtls_x509_san_other_nameother_name;
    mbedtls_x509_namedirectory_name;
    mbedtls_x509_bufunstructured_name;
    }
    san;
    }
    mbedtls_x509_subject_alternative_name;

    typedefstructmbedtls_x509_san_list{
    mbedtls_x509_subject_alternative_namenode;
    structmbedtls_x509_san_list*next;
    }
    mbedtls_x509_san_list;

    intmbedtls_x509_dn_gets(char*buf,size_tsize,constmbedtls_x509_name*dn);

    intmbedtls_x509_string_to_names(mbedtls_asn1_named_data**head,constchar*name);

    staticinlinembedtls_x509_name*mbedtls_x509_dn_get_next(
    mbedtls_x509_name*dn)
    {
    while(dn->MBEDTLS_PRIVATE(next_merged)&&dn->next!=NULL){
    dn=dn->next;
    }
    returndn->next;
    }

    intmbedtls_x509_serial_gets(char*buf,size_tsize,constmbedtls_x509_buf*serial);

    intmbedtls_x509_time_cmp(constmbedtls_x509_time*t1,constmbedtls_x509_time*t2);

    #ifdefined(MBEDTLS_HAVE_TIME_DATE)
    intmbedtls_x509_time_gmtime(mbedtls_time_ttt,mbedtls_x509_time*now);
    #endif/*MBEDTLS_HAVE_TIME_DATE*/

    intmbedtls_x509_time_is_past(constmbedtls_x509_time*to);

    intmbedtls_x509_time_is_future(constmbedtls_x509_time*from);

    intmbedtls_x509_parse_subject_alt_name(constmbedtls_x509_buf*san_buf,
    mbedtls_x509_subject_alternative_name*san);
    voidmbedtls_x509_free_subject_alt_name(mbedtls_x509_subject_alternative_name*san);

    size_tmbedtls_x509_crt_parse_cn_inet_pton(constchar*cn,void*dst);

    #defineMBEDTLS_X509_SAFE_SNPRINTF\
    do{\
    if(ret<0||(size_t)ret>=n)\
    returnMBEDTLS_ERR_X509_BUFFER_TOO_SMALL;\
    \
    n-=(size_t)ret;\
    p+=(size_t)ret;\
    }while(0)

    #ifdef__cplusplus
    }
    #endif

    #endif/*MBEDTLS_X509_H*/