mbed TLS v2.16.7
x509_crt.h
Go to the documentation of this file.
1 
6 /*
7  * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
8  * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
9  *
10  * This file is provided under the Apache License 2.0, or the
11  * GNU General Public License v2.0 or later.
12  *
13  * **********
14  * Apache License 2.0:
15  *
16  * Licensed under the Apache License, Version 2.0 (the "License"); you may
17  * not use this file except in compliance with the License.
18  * You may obtain a copy of the License at
19  *
20  * http://www.apache.org/licenses/LICENSE-2.0
21  *
22  * Unless required by applicable law or agreed to in writing, software
23  * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
24  * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
25  * See the License for the specific language governing permissions and
26  * limitations under the License.
27  *
28  * **********
29  *
30  * **********
31  * GNU General Public License v2.0 or later:
32  *
33  * This program is free software; you can redistribute it and/or modify
34  * it under the terms of the GNU General Public License as published by
35  * the Free Software Foundation; either version 2 of the License, or
36  * (at your option) any later version.
37  *
38  * This program is distributed in the hope that it will be useful,
39  * but WITHOUT ANY WARRANTY; without even the implied warranty of
40  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
41  * GNU General Public License for more details.
42  *
43  * You should have received a copy of the GNU General Public License along
44  * with this program; if not, write to the Free Software Foundation, Inc.,
45  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
46  *
47  * **********
48  *
49  * This file is part of mbed TLS (https://tls.mbed.org)
50  */
51 #ifndef MBEDTLS_X509_CRT_H
52 #define MBEDTLS_X509_CRT_H
53 
54 #if !defined(MBEDTLS_CONFIG_FILE)
55 #include "config.h"
56 #else
57 #include MBEDTLS_CONFIG_FILE
58 #endif
59 
60 #include "x509.h"
61 #include "x509_crl.h"
62 
68 #ifdef __cplusplus
69 extern "C" {
70 #endif
71 
80 typedef struct mbedtls_x509_crt
81 {
85  int version;
105  int ext_types;
106  int ca_istrue;
109  unsigned int key_usage;
113  unsigned char ns_cert_type;
118  void *sig_opts;
121 }
123 
128 #define MBEDTLS_X509_ID_FLAG( id ) ( 1 << ( (id) - 1 ) )
129 
136 {
137  uint32_t allowed_mds;
138  uint32_t allowed_pks;
139  uint32_t allowed_curves;
140  uint32_t rsa_min_bitlen;
141 }
143 
144 #define MBEDTLS_X509_CRT_VERSION_1 0
145 #define MBEDTLS_X509_CRT_VERSION_2 1
146 #define MBEDTLS_X509_CRT_VERSION_3 2
147 
148 #define MBEDTLS_X509_RFC5280_MAX_SERIAL_LEN 32
149 #define MBEDTLS_X509_RFC5280_UTC_TIME_LEN 15
150 
151 #if !defined( MBEDTLS_X509_MAX_FILE_PATH_LEN )
152 #define MBEDTLS_X509_MAX_FILE_PATH_LEN 512
153 #endif
154 
159 {
160  int version;
170 }
172 
176 typedef struct {
178  uint32_t flags;
180 
184 #define MBEDTLS_X509_MAX_VERIFY_CHAIN_SIZE ( MBEDTLS_X509_MAX_INTERMEDIATE_CA + 2 )
185 
189 typedef struct
190 {
192  unsigned len;
194 
195 #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
196 
200 typedef struct
201 {
202  /* for check_signature() */
204 
205  /* for find_parent_in() */
206  mbedtls_x509_crt *parent; /* non-null iff parent_in in progress */
207  mbedtls_x509_crt *fallback_parent;
208  int fallback_signature_is_good;
209 
210  /* for find_parent() */
211  int parent_is_trusted; /* -1 if find_parent is not in progress */
212 
213  /* for verify_chain() */
214  enum {
215  x509_crt_rs_none,
216  x509_crt_rs_find_parent,
217  } in_progress; /* none if no operation is in progress */
218  int self_cnt;
220 
222 
223 #else /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
224 
225 /* Now we can declare functions that take a pointer to that */
227 
228 #endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
229 
230 #if defined(MBEDTLS_X509_CRT_PARSE_C)
231 
236 
242 
247 
258 int mbedtls_x509_crt_parse_der( mbedtls_x509_crt *chain, const unsigned char *buf,
259  size_t buflen );
260 
291 int mbedtls_x509_crt_parse( mbedtls_x509_crt *chain, const unsigned char *buf, size_t buflen );
292 
293 #if defined(MBEDTLS_FS_IO)
294 
307 int mbedtls_x509_crt_parse_file( mbedtls_x509_crt *chain, const char *path );
308 
322 int mbedtls_x509_crt_parse_path( mbedtls_x509_crt *chain, const char *path );
323 #endif /* MBEDTLS_FS_IO */
324 
337 int mbedtls_x509_crt_info( char *buf, size_t size, const char *prefix,
338  const mbedtls_x509_crt *crt );
339 
352 int mbedtls_x509_crt_verify_info( char *buf, size_t size, const char *prefix,
353  uint32_t flags );
354 
414  mbedtls_x509_crt *trust_ca,
415  mbedtls_x509_crl *ca_crl,
416  const char *cn, uint32_t *flags,
417  int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
418  void *p_vrfy );
419 
448  mbedtls_x509_crt *trust_ca,
449  mbedtls_x509_crl *ca_crl,
450  const mbedtls_x509_crt_profile *profile,
451  const char *cn, uint32_t *flags,
452  int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
453  void *p_vrfy );
454 
478  mbedtls_x509_crt *trust_ca,
479  mbedtls_x509_crl *ca_crl,
480  const mbedtls_x509_crt_profile *profile,
481  const char *cn, uint32_t *flags,
482  int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
483  void *p_vrfy,
485 
486 #if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
487 
509  unsigned int usage );
510 #endif /* MBEDTLS_X509_CHECK_KEY_USAGE) */
511 
512 #if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
513 
527  const char *usage_oid,
528  size_t usage_len );
529 #endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE */
530 
531 #if defined(MBEDTLS_X509_CRL_PARSE_C)
532 
542 #endif /* MBEDTLS_X509_CRL_PARSE_C */
543 
550 
557 
558 #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
559 
562 void mbedtls_x509_crt_restart_init( mbedtls_x509_crt_restart_ctx *ctx );
563 
567 void mbedtls_x509_crt_restart_free( mbedtls_x509_crt_restart_ctx *ctx );
568 #endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
569 #endif /* MBEDTLS_X509_CRT_PARSE_C */
570 
571 /* \} name */
572 /* \} addtogroup x509_module */
573 
574 #if defined(MBEDTLS_X509_CRT_WRITE_C)
575 
581 
591 
601 
616 int mbedtls_x509write_crt_set_validity( mbedtls_x509write_cert *ctx, const char *not_before,
617  const char *not_after );
618 
632  const char *issuer_name );
633 
647  const char *subject_name );
648 
656 
664 
673 
688  const char *oid, size_t oid_len,
689  int critical,
690  const unsigned char *val, size_t val_len );
691 
704  int is_ca, int max_pathlen );
705 
706 #if defined(MBEDTLS_SHA1_C)
707 
717 
728 #endif /* MBEDTLS_SHA1_C */
729 
740  unsigned int key_usage );
741 
752  unsigned char ns_cert_type );
753 
760 
781 int mbedtls_x509write_crt_der( mbedtls_x509write_cert *ctx, unsigned char *buf, size_t size,
782  int (*f_rng)(void *, unsigned char *, size_t),
783  void *p_rng );
784 
785 #if defined(MBEDTLS_PEM_WRITE_C)
786 
802 int mbedtls_x509write_crt_pem( mbedtls_x509write_cert *ctx, unsigned char *buf, size_t size,
803  int (*f_rng)(void *, unsigned char *, size_t),
804  void *p_rng );
805 #endif /* MBEDTLS_PEM_WRITE_C */
806 #endif /* MBEDTLS_X509_CRT_WRITE_C */
807 
808 #ifdef __cplusplus
809 }
810 #endif
811 
812 #endif /* mbedtls_x509_crt.h */
int mbedtls_x509write_crt_set_authority_key_identifier(mbedtls_x509write_cert *ctx)
Set the authorityKeyIdentifier extension for a CRT Requires that mbedtls_x509write_crt_set_issuer_key...
int mbedtls_x509_crt_verify(mbedtls_x509_crt *crt, mbedtls_x509_crt *trust_ca, mbedtls_x509_crl *ca_crl, const char *cn, uint32_t *flags, int(*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), void *p_vrfy)
Verify the certificate signature.
Public key container.
Definition: pk.h:157
int mbedtls_x509write_crt_der(mbedtls_x509write_cert *ctx, unsigned char *buf, size_t size, int(*f_rng)(void *, unsigned char *, size_t), void *p_rng)
Write a built up certificate to a X509 DER structure Note: data is written at the end of the buffer! ...
int mbedtls_x509_crt_verify_with_profile(mbedtls_x509_crt *crt, mbedtls_x509_crt *trust_ca, mbedtls_x509_crl *ca_crl, const mbedtls_x509_crt_profile *profile, const char *cn, uint32_t *flags, int(*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), void *p_vrfy)
Verify the certificate signature according to profile.
mbedtls_x509_sequence subject_alt_names
Definition: x509_crt.h:103
int mbedtls_x509_crt_verify_restartable(mbedtls_x509_crt *crt, mbedtls_x509_crt *trust_ca, mbedtls_x509_crl *ca_crl, const mbedtls_x509_crt_profile *profile, const char *cn, uint32_t *flags, int(*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), void *p_vrfy, mbedtls_x509_crt_restart_ctx *rs_ctx)
Restartable version of mbedtls_crt_verify_with_profile()
int mbedtls_x509_crt_parse_der(mbedtls_x509_crt *chain, const unsigned char *buf, size_t buflen)
Parse a single DER formatted certificate and add it to the chained list.
int mbedtls_x509write_crt_set_extension(mbedtls_x509write_cert *ctx, const char *oid, size_t oid_len, int critical, const unsigned char *val, size_t val_len)
Generic function to add to or replace an extension in the CRT.
int mbedtls_x509write_crt_set_ns_cert_type(mbedtls_x509write_cert *ctx, unsigned char ns_cert_type)
Set the Netscape Cert Type flags (e.g. MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT | MBEDTLS_X509_NS_CERT_TY...
mbedtls_pk_type_t
Public key types.
Definition: pk.h:105
int mbedtls_x509_crt_is_revoked(const mbedtls_x509_crt *crt, const mbedtls_x509_crl *crl)
Verify the certificate revocation status.
Configuration options (set of defines)
char not_after[MBEDTLS_X509_RFC5280_UTC_TIME_LEN+1]
Definition: x509_crt.h:168
int mbedtls_x509write_crt_pem(mbedtls_x509write_cert *ctx, unsigned char *buf, size_t size, int(*f_rng)(void *, unsigned char *, size_t), void *p_rng)
Write a built up certificate to a X509 PEM string.
struct mbedtls_x509_crt * next
Definition: x509_crt.h:120
const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_default
int mbedtls_x509_crt_check_key_usage(const mbedtls_x509_crt *crt, unsigned int usage)
Check usage of certificate against keyUsage extension.
mbedtls_x509_name issuer
Definition: x509_crt.h:92
void mbedtls_x509write_crt_set_subject_key(mbedtls_x509write_cert *ctx, mbedtls_pk_context *key)
Set the subject public key for the certificate.
int mbedtls_x509write_crt_set_key_usage(mbedtls_x509write_cert *ctx, unsigned int key_usage)
Set the Key Usage Extension flags (e.g. MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_KEY_CERT_...
void mbedtls_x509write_crt_init(mbedtls_x509write_cert *ctx)
Initialize a CRT writing context.
mbedtls_x509_buf subject_id
Definition: x509_crt.h:101
struct mbedtls_x509write_cert mbedtls_x509write_cert
void mbedtls_x509write_crt_set_md_alg(mbedtls_x509write_cert *ctx, mbedtls_md_type_t md_alg)
Set the MD algorithm to use for the signature (e.g. MBEDTLS_MD_SHA1)
mbedtls_x509_buf tbs
Definition: x509_crt.h:83
mbedtls_x509_buf subject_raw
Definition: x509_crt.h:90
void mbedtls_x509_crt_free(mbedtls_x509_crt *crt)
Unallocate all certificate data.
mbedtls_x509_buf sig_oid
Definition: x509_crt.h:87
void mbedtls_pk_restart_ctx
Definition: pk.h:174
mbedtls_x509_buf issuer_raw
Definition: x509_crt.h:89
const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_suiteb
int mbedtls_x509write_crt_set_basic_constraints(mbedtls_x509write_cert *ctx, int is_ca, int max_pathlen)
Set the basicConstraints extension for a CRT.
mbedtls_x509_name subject
Definition: x509_crt.h:93
mbedtls_x509_time valid_to
Definition: x509_crt.h:96
int mbedtls_x509_crt_parse(mbedtls_x509_crt *chain, const unsigned char *buf, size_t buflen)
Parse one DER-encoded or one or more concatenated PEM-encoded certificates and add them to the chaine...
struct mbedtls_x509_crt_profile mbedtls_x509_crt_profile
unsigned char ns_cert_type
Definition: x509_crt.h:113
int mbedtls_x509_crt_parse_path(mbedtls_x509_crt *chain, const char *path)
Load one or more certificate files from a path and add them to the chained list. Parses permissively...
int mbedtls_x509write_crt_set_subject_key_identifier(mbedtls_x509write_cert *ctx)
Set the subjectKeyIdentifier extension for a CRT Requires that mbedtls_x509write_crt_set_subject_key(...
int mbedtls_x509write_crt_set_subject_name(mbedtls_x509write_cert *ctx, const char *subject_name)
Set the subject name for a Certificate Subject names should contain a comma-separated list of OID typ...
mbedtls_x509_buf serial
Definition: x509_crt.h:86
void mbedtls_x509_crt_restart_ctx
Definition: x509_crt.h:226
void mbedtls_x509write_crt_set_version(mbedtls_x509write_cert *ctx, int version)
Set the verion for a Certificate Default: MBEDTLS_X509_CRT_VERSION_3.
mbedtls_x509_time valid_from
Definition: x509_crt.h:95
mbedtls_x509_buf raw
Definition: x509_crt.h:82
int mbedtls_x509_crt_check_extended_key_usage(const mbedtls_x509_crt *crt, const char *usage_oid, size_t usage_len)
Check usage of certificate against extendedKeyUsage.
int mbedtls_x509write_crt_set_validity(mbedtls_x509write_cert *ctx, const char *not_before, const char *not_after)
Set the validity period for a Certificate Timestamps should be in string format for UTC timezone i...
#define MBEDTLS_X509_RFC5280_UTC_TIME_LEN
Definition: x509_crt.h:149
#define MBEDTLS_X509_MAX_VERIFY_CHAIN_SIZE
Definition: x509_crt.h:184
void mbedtls_x509write_crt_set_issuer_key(mbedtls_x509write_cert *ctx, mbedtls_pk_context *key)
Set the issuer key used for signing the certificate.
const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_next
mbedtls_pk_context * subject_key
Definition: x509_crt.h:162
mbedtls_pk_type_t sig_pk
Definition: x509_crt.h:117
X.509 generic defines and structures.
int mbedtls_x509_crt_info(char *buf, size_t size, const char *prefix, const mbedtls_x509_crt *crt)
Returns an informational string about the certificate.
int mbedtls_x509write_crt_set_issuer_name(mbedtls_x509write_cert *ctx, const char *issuer_name)
Set the issuer name for a Certificate Issuer names should contain a comma-separated list of OID types...
mbedtls_asn1_named_data * subject
Definition: x509_crt.h:164
int mbedtls_x509_crt_parse_file(mbedtls_x509_crt *chain, const char *path)
Load one or more certificates and add them to the chained list. Parses permissively. If some certificates can be parsed, the result is the number of failed certificates it encountered. If none complete correctly, the first error is returned.
mbedtls_pk_context * issuer_key
Definition: x509_crt.h:163
void * sig_opts
Definition: x509_crt.h:118
char not_before[MBEDTLS_X509_RFC5280_UTC_TIME_LEN+1]
Definition: x509_crt.h:167
mbedtls_md_type_t md_alg
Definition: x509_crt.h:166
mbedtls_x509_buf issuer_id
Definition: x509_crt.h:100
int mbedtls_x509write_crt_set_serial(mbedtls_x509write_cert *ctx, const mbedtls_mpi *serial)
Set the serial number for a Certificate.
MPI structure.
Definition: bignum.h:212
X.509 certificate revocation list parsing.
void mbedtls_x509write_crt_free(mbedtls_x509write_cert *ctx)
Free the contents of a CRT write context.
struct mbedtls_x509_crt mbedtls_x509_crt
mbedtls_x509_sequence ext_key_usage
Definition: x509_crt.h:111
void mbedtls_x509_crt_init(mbedtls_x509_crt *crt)
Initialize a certificate (chain)
mbedtls_asn1_named_data * extensions
Definition: x509_crt.h:169
unsigned int key_usage
Definition: x509_crt.h:109
mbedtls_pk_context pk
Definition: x509_crt.h:98
mbedtls_x509_buf sig
Definition: x509_crt.h:115
mbedtls_md_type_t
Supported message digests.
Definition: md.h:85
int mbedtls_x509_crt_verify_info(char *buf, size_t size, const char *prefix, uint32_t flags)
Returns an informational string about the verification status of a certificate.
mbedtls_asn1_named_data * issuer
Definition: x509_crt.h:165
mbedtls_mpi serial
Definition: x509_crt.h:161
mbedtls_x509_buf v3_ext
Definition: x509_crt.h:102
mbedtls_md_type_t sig_md
Definition: x509_crt.h:116