mbed TLS v2.16.6
x509_crt.h
Go to the documentation of this file.
1 
6 /*
7  * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
8  * SPDX-License-Identifier: GPL-2.0
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License as published by
12  * the Free Software Foundation; either version 2 of the License, or
13  * (at your option) any later version.
14  *
15  * This program is distributed in the hope that it will be useful,
16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18  * GNU General Public License for more details.
19  *
20  * You should have received a copy of the GNU General Public License along
21  * with this program; if not, write to the Free Software Foundation, Inc.,
22  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
23  *
24  * This file is part of mbed TLS (https://tls.mbed.org)
25  */
26 #ifndef MBEDTLS_X509_CRT_H
27 #define MBEDTLS_X509_CRT_H
28 
29 #if !defined(MBEDTLS_CONFIG_FILE)
30 #include "config.h"
31 #else
32 #include MBEDTLS_CONFIG_FILE
33 #endif
34 
35 #include "x509.h"
36 #include "x509_crl.h"
37 
43 #ifdef __cplusplus
44 extern "C" {
45 #endif
46 
55 typedef struct mbedtls_x509_crt
56 {
60  int version;
80  int ext_types;
81  int ca_istrue;
84  unsigned int key_usage;
88  unsigned char ns_cert_type;
93  void *sig_opts;
96 }
98 
103 #define MBEDTLS_X509_ID_FLAG( id ) ( 1 << ( (id) - 1 ) )
104 
111 {
112  uint32_t allowed_mds;
113  uint32_t allowed_pks;
114  uint32_t allowed_curves;
115  uint32_t rsa_min_bitlen;
116 }
118 
119 #define MBEDTLS_X509_CRT_VERSION_1 0
120 #define MBEDTLS_X509_CRT_VERSION_2 1
121 #define MBEDTLS_X509_CRT_VERSION_3 2
122 
123 #define MBEDTLS_X509_RFC5280_MAX_SERIAL_LEN 32
124 #define MBEDTLS_X509_RFC5280_UTC_TIME_LEN 15
125 
126 #if !defined( MBEDTLS_X509_MAX_FILE_PATH_LEN )
127 #define MBEDTLS_X509_MAX_FILE_PATH_LEN 512
128 #endif
129 
134 {
135  int version;
145 }
147 
151 typedef struct {
153  uint32_t flags;
155 
159 #define MBEDTLS_X509_MAX_VERIFY_CHAIN_SIZE ( MBEDTLS_X509_MAX_INTERMEDIATE_CA + 2 )
160 
164 typedef struct
165 {
167  unsigned len;
169 
170 #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
171 
175 typedef struct
176 {
177  /* for check_signature() */
179 
180  /* for find_parent_in() */
181  mbedtls_x509_crt *parent; /* non-null iff parent_in in progress */
182  mbedtls_x509_crt *fallback_parent;
183  int fallback_signature_is_good;
184 
185  /* for find_parent() */
186  int parent_is_trusted; /* -1 if find_parent is not in progress */
187 
188  /* for verify_chain() */
189  enum {
190  x509_crt_rs_none,
191  x509_crt_rs_find_parent,
192  } in_progress; /* none if no operation is in progress */
193  int self_cnt;
195 
197 
198 #else /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
199 
200 /* Now we can declare functions that take a pointer to that */
202 
203 #endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
204 
205 #if defined(MBEDTLS_X509_CRT_PARSE_C)
206 
211 
217 
222 
233 int mbedtls_x509_crt_parse_der( mbedtls_x509_crt *chain, const unsigned char *buf,
234  size_t buflen );
235 
266 int mbedtls_x509_crt_parse( mbedtls_x509_crt *chain, const unsigned char *buf, size_t buflen );
267 
268 #if defined(MBEDTLS_FS_IO)
269 
282 int mbedtls_x509_crt_parse_file( mbedtls_x509_crt *chain, const char *path );
283 
297 int mbedtls_x509_crt_parse_path( mbedtls_x509_crt *chain, const char *path );
298 #endif /* MBEDTLS_FS_IO */
299 
312 int mbedtls_x509_crt_info( char *buf, size_t size, const char *prefix,
313  const mbedtls_x509_crt *crt );
314 
327 int mbedtls_x509_crt_verify_info( char *buf, size_t size, const char *prefix,
328  uint32_t flags );
329 
389  mbedtls_x509_crt *trust_ca,
390  mbedtls_x509_crl *ca_crl,
391  const char *cn, uint32_t *flags,
392  int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
393  void *p_vrfy );
394 
423  mbedtls_x509_crt *trust_ca,
424  mbedtls_x509_crl *ca_crl,
425  const mbedtls_x509_crt_profile *profile,
426  const char *cn, uint32_t *flags,
427  int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
428  void *p_vrfy );
429 
453  mbedtls_x509_crt *trust_ca,
454  mbedtls_x509_crl *ca_crl,
455  const mbedtls_x509_crt_profile *profile,
456  const char *cn, uint32_t *flags,
457  int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
458  void *p_vrfy,
459  mbedtls_x509_crt_restart_ctx *rs_ctx );
460 
461 #if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
462 
484  unsigned int usage );
485 #endif /* MBEDTLS_X509_CHECK_KEY_USAGE) */
486 
487 #if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
488 
502  const char *usage_oid,
503  size_t usage_len );
504 #endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE */
505 
506 #if defined(MBEDTLS_X509_CRL_PARSE_C)
507 
517 #endif /* MBEDTLS_X509_CRL_PARSE_C */
518 
525 
532 
533 #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
534 
537 void mbedtls_x509_crt_restart_init( mbedtls_x509_crt_restart_ctx *ctx );
538 
542 void mbedtls_x509_crt_restart_free( mbedtls_x509_crt_restart_ctx *ctx );
543 #endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
544 #endif /* MBEDTLS_X509_CRT_PARSE_C */
545 
546 /* \} name */
547 /* \} addtogroup x509_module */
548 
549 #if defined(MBEDTLS_X509_CRT_WRITE_C)
550 
556 
566 
576 
591 int mbedtls_x509write_crt_set_validity( mbedtls_x509write_cert *ctx, const char *not_before,
592  const char *not_after );
593 
607  const char *issuer_name );
608 
622  const char *subject_name );
623 
631 
639 
648 
663  const char *oid, size_t oid_len,
664  int critical,
665  const unsigned char *val, size_t val_len );
666 
679  int is_ca, int max_pathlen );
680 
681 #if defined(MBEDTLS_SHA1_C)
682 
692 
703 #endif /* MBEDTLS_SHA1_C */
704 
715  unsigned int key_usage );
716 
727  unsigned char ns_cert_type );
728 
735 
756 int mbedtls_x509write_crt_der( mbedtls_x509write_cert *ctx, unsigned char *buf, size_t size,
757  int (*f_rng)(void *, unsigned char *, size_t),
758  void *p_rng );
759 
760 #if defined(MBEDTLS_PEM_WRITE_C)
761 
777 int mbedtls_x509write_crt_pem( mbedtls_x509write_cert *ctx, unsigned char *buf, size_t size,
778  int (*f_rng)(void *, unsigned char *, size_t),
779  void *p_rng );
780 #endif /* MBEDTLS_PEM_WRITE_C */
781 #endif /* MBEDTLS_X509_CRT_WRITE_C */
782 
783 #ifdef __cplusplus
784 }
785 #endif
786 
787 #endif /* mbedtls_x509_crt.h */
int mbedtls_x509write_crt_set_authority_key_identifier(mbedtls_x509write_cert *ctx)
Set the authorityKeyIdentifier extension for a CRT Requires that mbedtls_x509write_crt_set_issuer_key...
int mbedtls_x509_crt_verify(mbedtls_x509_crt *crt, mbedtls_x509_crt *trust_ca, mbedtls_x509_crl *ca_crl, const char *cn, uint32_t *flags, int(*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), void *p_vrfy)
Verify the certificate signature.
Public key container.
Definition: pk.h:132
int mbedtls_x509write_crt_der(mbedtls_x509write_cert *ctx, unsigned char *buf, size_t size, int(*f_rng)(void *, unsigned char *, size_t), void *p_rng)
Write a built up certificate to a X509 DER structure Note: data is written at the end of the buffer! ...
int mbedtls_x509_crt_verify_with_profile(mbedtls_x509_crt *crt, mbedtls_x509_crt *trust_ca, mbedtls_x509_crl *ca_crl, const mbedtls_x509_crt_profile *profile, const char *cn, uint32_t *flags, int(*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), void *p_vrfy)
Verify the certificate signature according to profile.
mbedtls_x509_sequence subject_alt_names
Definition: x509_crt.h:78
int mbedtls_x509_crt_verify_restartable(mbedtls_x509_crt *crt, mbedtls_x509_crt *trust_ca, mbedtls_x509_crl *ca_crl, const mbedtls_x509_crt_profile *profile, const char *cn, uint32_t *flags, int(*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), void *p_vrfy, mbedtls_x509_crt_restart_ctx *rs_ctx)
Restartable version of mbedtls_crt_verify_with_profile()
int mbedtls_x509_crt_parse_der(mbedtls_x509_crt *chain, const unsigned char *buf, size_t buflen)
Parse a single DER formatted certificate and add it to the chained list.
int mbedtls_x509write_crt_set_extension(mbedtls_x509write_cert *ctx, const char *oid, size_t oid_len, int critical, const unsigned char *val, size_t val_len)
Generic function to add to or replace an extension in the CRT.
int mbedtls_x509write_crt_set_ns_cert_type(mbedtls_x509write_cert *ctx, unsigned char ns_cert_type)
Set the Netscape Cert Type flags (e.g. MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT | MBEDTLS_X509_NS_CERT_TY...
mbedtls_pk_type_t
Public key types.
Definition: pk.h:80
int mbedtls_x509_crt_is_revoked(const mbedtls_x509_crt *crt, const mbedtls_x509_crl *crl)
Verify the certificate revocation status.
Configuration options (set of defines)
char not_after[MBEDTLS_X509_RFC5280_UTC_TIME_LEN+1]
Definition: x509_crt.h:143
int mbedtls_x509write_crt_pem(mbedtls_x509write_cert *ctx, unsigned char *buf, size_t size, int(*f_rng)(void *, unsigned char *, size_t), void *p_rng)
Write a built up certificate to a X509 PEM string.
struct mbedtls_x509_crt * next
Definition: x509_crt.h:95
const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_default
int mbedtls_x509_crt_check_key_usage(const mbedtls_x509_crt *crt, unsigned int usage)
Check usage of certificate against keyUsage extension.
mbedtls_x509_name issuer
Definition: x509_crt.h:67
void mbedtls_x509write_crt_set_subject_key(mbedtls_x509write_cert *ctx, mbedtls_pk_context *key)
Set the subject public key for the certificate.
int mbedtls_x509write_crt_set_key_usage(mbedtls_x509write_cert *ctx, unsigned int key_usage)
Set the Key Usage Extension flags (e.g. MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_KEY_CERT_...
void mbedtls_x509write_crt_init(mbedtls_x509write_cert *ctx)
Initialize a CRT writing context.
mbedtls_x509_buf subject_id
Definition: x509_crt.h:76
struct mbedtls_x509write_cert mbedtls_x509write_cert
void mbedtls_x509write_crt_set_md_alg(mbedtls_x509write_cert *ctx, mbedtls_md_type_t md_alg)
Set the MD algorithm to use for the signature (e.g. MBEDTLS_MD_SHA1)
mbedtls_x509_buf tbs
Definition: x509_crt.h:58
mbedtls_x509_buf subject_raw
Definition: x509_crt.h:65
void mbedtls_x509_crt_free(mbedtls_x509_crt *crt)
Unallocate all certificate data.
mbedtls_x509_buf sig_oid
Definition: x509_crt.h:62
void mbedtls_pk_restart_ctx
Definition: pk.h:149
mbedtls_x509_buf issuer_raw
Definition: x509_crt.h:64
const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_suiteb
int mbedtls_x509write_crt_set_basic_constraints(mbedtls_x509write_cert *ctx, int is_ca, int max_pathlen)
Set the basicConstraints extension for a CRT.
mbedtls_x509_name subject
Definition: x509_crt.h:68
mbedtls_x509_time valid_to
Definition: x509_crt.h:71
int mbedtls_x509_crt_parse(mbedtls_x509_crt *chain, const unsigned char *buf, size_t buflen)
Parse one DER-encoded or one or more concatenated PEM-encoded certificates and add them to the chaine...
struct mbedtls_x509_crt_profile mbedtls_x509_crt_profile
unsigned char ns_cert_type
Definition: x509_crt.h:88
int mbedtls_x509_crt_parse_path(mbedtls_x509_crt *chain, const char *path)
Load one or more certificate files from a path and add them to the chained list. Parses permissively...
int mbedtls_x509write_crt_set_subject_key_identifier(mbedtls_x509write_cert *ctx)
Set the subjectKeyIdentifier extension for a CRT Requires that mbedtls_x509write_crt_set_subject_key(...
int mbedtls_x509write_crt_set_subject_name(mbedtls_x509write_cert *ctx, const char *subject_name)
Set the subject name for a Certificate Subject names should contain a comma-separated list of OID typ...
mbedtls_x509_buf serial
Definition: x509_crt.h:61
void mbedtls_x509_crt_restart_ctx
Definition: x509_crt.h:201
void mbedtls_x509write_crt_set_version(mbedtls_x509write_cert *ctx, int version)
Set the verion for a Certificate Default: MBEDTLS_X509_CRT_VERSION_3.
mbedtls_x509_time valid_from
Definition: x509_crt.h:70
mbedtls_x509_buf raw
Definition: x509_crt.h:57
int mbedtls_x509_crt_check_extended_key_usage(const mbedtls_x509_crt *crt, const char *usage_oid, size_t usage_len)
Check usage of certificate against extendedKeyUsage.
int mbedtls_x509write_crt_set_validity(mbedtls_x509write_cert *ctx, const char *not_before, const char *not_after)
Set the validity period for a Certificate Timestamps should be in string format for UTC timezone i...
#define MBEDTLS_X509_RFC5280_UTC_TIME_LEN
Definition: x509_crt.h:124
#define MBEDTLS_X509_MAX_VERIFY_CHAIN_SIZE
Definition: x509_crt.h:159
void mbedtls_x509write_crt_set_issuer_key(mbedtls_x509write_cert *ctx, mbedtls_pk_context *key)
Set the issuer key used for signing the certificate.
const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_next
mbedtls_pk_context * subject_key
Definition: x509_crt.h:137
mbedtls_pk_type_t sig_pk
Definition: x509_crt.h:92
X.509 generic defines and structures.
int mbedtls_x509_crt_info(char *buf, size_t size, const char *prefix, const mbedtls_x509_crt *crt)
Returns an informational string about the certificate.
int mbedtls_x509write_crt_set_issuer_name(mbedtls_x509write_cert *ctx, const char *issuer_name)
Set the issuer name for a Certificate Issuer names should contain a comma-separated list of OID types...
mbedtls_asn1_named_data * subject
Definition: x509_crt.h:139
int mbedtls_x509_crt_parse_file(mbedtls_x509_crt *chain, const char *path)
Load one or more certificates and add them to the chained list. Parses permissively. If some certificates can be parsed, the result is the number of failed certificates it encountered. If none complete correctly, the first error is returned.
mbedtls_pk_context * issuer_key
Definition: x509_crt.h:138
void * sig_opts
Definition: x509_crt.h:93
char not_before[MBEDTLS_X509_RFC5280_UTC_TIME_LEN+1]
Definition: x509_crt.h:142
mbedtls_md_type_t md_alg
Definition: x509_crt.h:141
mbedtls_x509_buf issuer_id
Definition: x509_crt.h:75
int mbedtls_x509write_crt_set_serial(mbedtls_x509write_cert *ctx, const mbedtls_mpi *serial)
Set the serial number for a Certificate.
MPI structure.
Definition: bignum.h:187
X.509 certificate revocation list parsing.
void mbedtls_x509write_crt_free(mbedtls_x509write_cert *ctx)
Free the contents of a CRT write context.
struct mbedtls_x509_crt mbedtls_x509_crt
mbedtls_x509_sequence ext_key_usage
Definition: x509_crt.h:86
void mbedtls_x509_crt_init(mbedtls_x509_crt *crt)
Initialize a certificate (chain)
mbedtls_asn1_named_data * extensions
Definition: x509_crt.h:144
unsigned int key_usage
Definition: x509_crt.h:84
mbedtls_pk_context pk
Definition: x509_crt.h:73
mbedtls_x509_buf sig
Definition: x509_crt.h:90
mbedtls_md_type_t
Supported message digests.
Definition: md.h:60
int mbedtls_x509_crt_verify_info(char *buf, size_t size, const char *prefix, uint32_t flags)
Returns an informational string about the verification status of a certificate.
mbedtls_asn1_named_data * issuer
Definition: x509_crt.h:140
mbedtls_mpi serial
Definition: x509_crt.h:136
mbedtls_x509_buf v3_ext
Definition: x509_crt.h:77
mbedtls_md_type_t sig_md
Definition: x509_crt.h:91