Top | ![]() |
![]() |
![]() |
![]() |
typedef | gnutls_subject_alt_names_t |
#define | gnutls_x509_ext_import_issuer_alt_name |
#define | gnutls_x509_ext_export_issuer_alt_name |
typedef | gnutls_x509_crl_dist_points_t |
typedef | gnutls_x509_aia_t |
typedef | gnutls_x509_aki_t |
typedef | gnutls_x509_key_purposes_t |
typedef | gnutls_x509_policies_t |
typedef | gnutls_x509_ct_scts_t |
int
gnutls_subject_alt_names_init (gnutls_subject_alt_names_t *Param1
);
This function will initialize an alternative names type.
Since: 3.3.0
void
gnutls_subject_alt_names_deinit (gnutls_subject_alt_names_t sans
);
This function will deinitialize an alternative names structure.
Since: 3.3.0
int gnutls_subject_alt_names_get (gnutls_subject_alt_names_t sans
,unsigned int seq
,unsigned int *san_type
,gnutls_datum_t *san
,gnutls_datum_t *othername_oid
);
This function will return a specific alternative name as stored in
the sans
type. The returned values should be treated as constant
and valid for the lifetime of sans
.
sans |
The alternative names |
|
seq |
The index of the name to get |
|
san_type |
Will hold the type of the name (of |
|
san |
The alternative name data (should be treated as constant) |
|
othername_oid |
The object identifier if |
On success, GNUTLS_E_SUCCESS
(0) is returned, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
if the index is out of bounds, otherwise a negative error value.
Since: 3.3.0
int gnutls_subject_alt_names_set (gnutls_subject_alt_names_t sans
,unsigned int san_type
,const gnutls_datum_t *san
,const char *othername_oid
);
This function will store the specified alternative name in
the sans
.
Since version 3.5.7 the GNUTLS_SAN_RFC822NAME
, GNUTLS_SAN_DNSNAME
, and
GNUTLS_SAN_OTHERNAME_XMPP
are converted to ACE format when necessary.
sans |
The alternative names |
|
san_type |
The type of the name (of |
|
san |
The alternative name data |
|
othername_oid |
The object identifier if |
Since: 3.3.0
int gnutls_x509_ext_import_subject_alt_names (const gnutls_datum_t *ext
,gnutls_subject_alt_names_t Param2
,unsigned int flags
);
This function will export the alternative names in the provided DER-encoded
SubjectAltName PKIX extension, to a gnutls_subject_alt_names_t
type. sans
must be initialized.
This function will succeed even if there no subject alternative names in the structure.
Since: 3.3.0
int gnutls_x509_ext_export_subject_alt_names (gnutls_subject_alt_names_t Param1
,gnutls_datum_t *ext
);
This function will convert the provided alternative names structure to a
DER-encoded SubjectAltName PKIX extension. The output data in ext
will be allocated using
gnutls_malloc()
.
sans |
The alternative names |
|
ext |
The DER-encoded extension data; must be freed using |
Since: 3.3.0
int
gnutls_x509_crl_dist_points_init (gnutls_x509_crl_dist_points_t *Param1
);
This function will initialize a CRL distribution points type.
Since: 3.3.0
void
gnutls_x509_crl_dist_points_deinit (gnutls_x509_crl_dist_points_t Param1
);
This function will deinitialize a CRL distribution points type.
Since: 3.3.0
int gnutls_x509_crl_dist_points_get (gnutls_x509_crl_dist_points_t Param1
,unsigned int seq
,unsigned int *type
,gnutls_datum_t *dist
,unsigned int *reason_flags
);
This function retrieves the individual CRL distribution points (2.5.29.31), contained in provided type.
cdp |
The CRL distribution points |
|
seq |
specifies the sequence number of the distribution point (0 for the first one, 1 for the second etc.) |
|
type |
The name type of the corresponding name (gnutls_x509_subject_alt_name_t) |
|
san |
The distribution point names (to be treated as constant) |
|
reasons |
Revocation reasons. An ORed sequence of flags from |
On success, GNUTLS_E_SUCCESS
(0) is returned, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
if the index is out of bounds, otherwise a negative error value.
int gnutls_x509_crl_dist_points_set (gnutls_x509_crl_dist_points_t Param1
,gnutls_x509_subject_alt_name_t type
,const gnutls_datum_t *dist
,unsigned int reason_flags
);
This function will store the specified CRL distribution point value
the cdp
type.
cdp |
The CRL distribution points |
|
type |
The type of the name (of |
|
san |
The point name data |
|
reasons |
Revocation reasons. An ORed sequence of flags from |
Since: 3.3.0
int gnutls_x509_ext_import_crl_dist_points (const gnutls_datum_t *ext
,gnutls_x509_crl_dist_points_t dp
,unsigned int flags
);
This function will extract the CRL distribution points extension (2.5.29.31) and store it into the provided type.
ext |
the DER encoded extension data |
|
cdp |
A pointer to an initialized CRL distribution points. |
|
flags |
should be zero |
Since: 3.3.0
int gnutls_x509_ext_export_crl_dist_points (gnutls_x509_crl_dist_points_t dp
,gnutls_datum_t *ext
);
This function will convert the provided policies, to a certificate policy DER encoded extension (2.5.29.31).
The ext
data will be allocated using gnutls_malloc()
.
cdp |
A pointer to an initialized CRL distribution points. |
|
ext |
The DER-encoded extension data; must be freed using |
Since: 3.3.0
int gnutls_x509_ext_import_name_constraints (const gnutls_datum_t *ext
,gnutls_x509_name_constraints_t nc
,unsigned int flags
);
This function will return an intermediate type containing
the name constraints of the provided NameConstraints extension. That
can be used in combination with gnutls_x509_name_constraints_check()
to verify whether a server's name is in accordance with the constraints.
When the flags
is set to GNUTLS_NAME_CONSTRAINTS_FLAG_APPEND
, then if
the nc
type is empty this function will behave identically as if the flag was not set.
Otherwise if there are elements in the nc
structure then the
constraints will be merged with the existing constraints following
RFC5280 p6.1.4 (excluded constraints will be appended, permitted
will be intersected).
Note that nc
must be initialized prior to calling this function.
On success, GNUTLS_E_SUCCESS
(0) is returned, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
if the extension is not present, otherwise a negative error value.
Since: 3.3.0
int gnutls_x509_ext_export_name_constraints (gnutls_x509_name_constraints_t nc
,gnutls_datum_t *ext
);
This function will convert the provided name constraints type to a
DER-encoded PKIX NameConstraints (2.5.29.30) extension. The output data in
ext
will be allocated using gnutls_malloc()
.
nc |
The nameconstraints |
|
ext |
The DER-encoded extension data; must be freed using |
Since: 3.3.0
int
gnutls_x509_aia_init (gnutls_x509_aia_t *Param1
);
This function will initialize an authority info access type.
Since: 3.3.0
void
gnutls_x509_aia_deinit (gnutls_x509_aia_t Param1
);
This function will deinitialize an authority info access type.
Since: 3.3.0
int gnutls_x509_aia_get (gnutls_x509_aia_t aia
,unsigned int seq
,gnutls_datum_t *oid
,unsigned *san_type
,gnutls_datum_t *san
);
This function reads from the Authority Information Access type.
The seq
input parameter is used to indicate which member of the
sequence the caller is interested in. The first member is 0, the
second member 1 and so on. When the seq
value is out of bounds,
GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
is returned.
Typically oid
is GNUTLS_OID_AD_CAISSUERS
or GNUTLS_OID_AD_OCSP
.
aia |
The authority info access |
|
seq |
specifies the sequence number of the access descriptor (0 for the first one, 1 for the second etc.) |
|
oid |
the type of available data; to be treated as constant. |
|
san_type |
Will hold the type of the name of |
|
san |
the access location name; to be treated as constant (may be null). |
Since: 3.3.0
int gnutls_x509_aia_set (gnutls_x509_aia_t aia
,const char *oid
,unsigned san_type
,const gnutls_datum_t *san
);
This function will store the specified alternative name in
the aia
type.
Typically the value for oid
should be GNUTLS_OID_AD_OCSP
, or
GNUTLS_OID_AD_CAISSUERS
.
Since version 3.5.7 the GNUTLS_SAN_RFC822NAME
, and GNUTLS_SAN_DNSNAME
,
are converted to ACE format when necessary.
aia |
The authority info access |
|
oid |
the type of data. |
|
san_type |
The type of the name (of |
|
san |
The alternative name data |
|
othername_oid |
The object identifier if |
Since: 3.3.0
int gnutls_x509_ext_import_aia (const gnutls_datum_t *ext
,gnutls_x509_aia_t Param2
,unsigned int flags
);
This function extracts the Authority Information Access (AIA) extension from the provided DER-encoded data; see RFC 5280 section 4.2.2.1 for more information on the extension. The AIA extension holds a sequence of AccessDescription (AD) data.
Since: 3.3.0
int gnutls_x509_ext_export_aia (gnutls_x509_aia_t aia
,gnutls_datum_t *ext
);
This function will DER encode the Authority Information Access (AIA) extension; see RFC 5280 section 4.2.2.1 for more information on the extension.
aia |
The authority info access |
|
ext |
The DER-encoded extension data; must be freed using |
Since: 3.3.0
int gnutls_x509_ext_import_subject_key_id (const gnutls_datum_t *ext
,gnutls_datum_t *id
);
This function will return the subject key ID stored in the provided
SubjectKeyIdentifier extension. The ID will be allocated using
gnutls_malloc()
.
On success, GNUTLS_E_SUCCESS
(0) is returned, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
if the extension is not present, otherwise a negative error value.
Since: 3.3.0
int gnutls_x509_ext_export_subject_key_id (const gnutls_datum_t *id
,gnutls_datum_t *ext
);
This function will convert the provided key identifier to a
DER-encoded PKIX SubjectKeyIdentifier extension.
The output data in ext
will be allocated using
gnutls_malloc()
.
id |
The key identifier |
|
ext |
The DER-encoded extension data; must be freed using |
Since: 3.3.0
int gnutls_x509_ext_export_authority_key_id (gnutls_x509_aki_t Param1
,gnutls_datum_t *ext
);
This function will convert the provided key identifier to a
DER-encoded PKIX AuthorityKeyIdentifier extension.
The output data in ext
will be allocated using
gnutls_malloc()
.
aki |
An initialized authority key identifier |
|
ext |
The DER-encoded extension data; must be freed using |
Since: 3.3.0
int gnutls_x509_ext_import_authority_key_id (const gnutls_datum_t *ext
,gnutls_x509_aki_t Param2
,unsigned int flags
);
This function will return the subject key ID stored in the provided AuthorityKeyIdentifier extension.
ext |
a DER encoded extension |
|
aki |
An initialized authority key identifier type |
|
flags |
should be zero |
On success, GNUTLS_E_SUCCESS
(0) is returned, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
if the extension is not present, otherwise a negative error value.
Since: 3.3.0
int gnutls_x509_othername_to_virtual (const char *oid
,const gnutls_datum_t *othername
,unsigned int *virt_type
,gnutls_datum_t *virt
);
This function will parse and convert the othername data to a virtual type supported by gnutls.
oid |
The othername object identifier |
|
othername |
The othername data |
|
virt_type |
GNUTLS_SAN_OTHERNAME_XXX |
|
virt |
allocated printable data |
Since: 3.3.8
int
gnutls_x509_aki_init (gnutls_x509_aki_t *Param1
);
This function will initialize an authority key ID.
Since: 3.3.0
int gnutls_x509_aki_get_id (gnutls_x509_aki_t Param1
,gnutls_datum_t *id
);
This function will return the key identifier as stored in
the aki
type. The identifier should be treated as constant.
On success, GNUTLS_E_SUCCESS
(0) is returned, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
if the index is out of bounds, otherwise a negative error value.
Since: 3.3.0
int gnutls_x509_aki_get_cert_issuer (gnutls_x509_aki_t aki
,unsigned int seq
,unsigned int *san_type
,gnutls_datum_t *san
,gnutls_datum_t *othername_oid
,gnutls_datum_t *serial
);
This function will return a specific authorityCertIssuer name as stored in
the aki
type, as well as the authorityCertSerialNumber. All the returned
values should be treated as constant, and may be set to NULL
when are not required.
aki |
The authority key ID |
|
seq |
The index of the name to get |
|
san_type |
Will hold the type of the name (of |
|
san |
The alternative name data |
|
othername_oid |
The object identifier if |
|
serial |
The authorityCertSerialNumber number |
On success, GNUTLS_E_SUCCESS
(0) is returned, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
if the index is out of bounds, otherwise a negative error value.
Since: 3.3.0
int gnutls_x509_aki_set_id (gnutls_x509_aki_t aki
,const gnutls_datum_t *id
);
This function will set the keyIdentifier to be stored in the aki
type.
Since: 3.3.0
int gnutls_x509_aki_set_cert_issuer (gnutls_x509_aki_t aki
,unsigned int san_type
,const gnutls_datum_t *san
,const char *othername_oid
,const gnutls_datum_t *serial
);
This function will set the authorityCertIssuer name and the authorityCertSerialNumber
to be stored in the aki
type. When storing multiple names, the serial
should be set on the first call, and subsequent calls should use a NULL
serial.
Since version 3.5.7 the GNUTLS_SAN_RFC822NAME
, GNUTLS_SAN_DNSNAME
, and
GNUTLS_SAN_OTHERNAME_XMPP
are converted to ACE format when necessary.
aki |
The authority key ID |
|
san_type |
the type of the name (of |
|
san |
The alternative name data |
|
othername_oid |
The object identifier if |
|
serial |
The authorityCertSerialNumber number (may be null) |
Since: 3.3.0
void
gnutls_x509_aki_deinit (gnutls_x509_aki_t Param1
);
This function will deinitialize an authority key identifier.
Since: 3.3.0
int gnutls_x509_ext_import_private_key_usage_period (const gnutls_datum_t *ext
,time_t *activation
,time_t *expiration
);
This function will return the expiration and activation times of the private key as written in the PKIX extension 2.5.29.16.
ext |
the DER encoded extension data |
|
activation |
Will hold the activation time |
|
expiration |
Will hold the expiration time |
Since: 3.3.0
int gnutls_x509_ext_export_private_key_usage_period (time_t activation
,time_t expiration
,gnutls_datum_t *ext
);
This function will convert the periods provided to a private key
usage DER encoded extension (2.5.29.16).
(
The ext
data will be allocated using
gnutls_malloc()
.
activation |
The activation time |
|
expiration |
The expiration time |
|
ext |
The DER-encoded extension data; must be freed using |
Since: 3.3.0
int gnutls_x509_ext_import_basic_constraints (const gnutls_datum_t *ext
,unsigned int *ca
,int *pathlen
);
This function will return the CA status and path length constraint as written in the PKIX extension 2.5.29.19.
ext |
the DER encoded extension data |
|
ca |
will be non zero if the CA status is true |
|
pathlen |
the path length constraint; will be set to -1 for no limit |
Since: 3.3.0
int gnutls_x509_ext_export_basic_constraints (unsigned int ca
,int pathlen
,gnutls_datum_t *ext
);
This function will convert the parameters provided to a basic constraints
DER encoded extension (2.5.29.19).
(
The ext
data will be allocated using
gnutls_malloc()
.
ca |
non-zero for a CA |
|
pathlen |
The path length constraint (set to -1 for no constraint) |
|
ext |
The DER-encoded extension data; must be freed using |
Since: 3.3.0
void
gnutls_x509_key_purpose_deinit (gnutls_x509_key_purposes_t p
);
This function will deinitialize a key purposes type.
Since: 3.3.0
int gnutls_x509_key_purpose_set (gnutls_x509_key_purposes_t p
,const char *oid
);
This function will store the specified key purpose in the purposes.
Since: 3.3.0
int gnutls_x509_key_purpose_get (gnutls_x509_key_purposes_t p
,unsigned idx
,gnutls_datum_t *oid
);
This function will retrieve the specified by the index key purpose in the purposes type. The object identifier will be a null terminated string.
p |
The key purposes |
|
idx |
The index of the key purpose to retrieve |
|
oid |
Will hold the object identifier of the key purpose (to be treated as constant) |
On success, GNUTLS_E_SUCCESS
(0) is returned, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
if the index is out of bounds, otherwise a negative error value.
Since: 3.3.0
int gnutls_x509_ext_import_key_purposes (const gnutls_datum_t *ext
,gnutls_x509_key_purposes_t Param2
,unsigned int flags
);
This function will extract the key purposes in the provided DER-encoded
ExtKeyUsageSyntax PKIX extension, to a gnutls_x509_key_purposes_t
type.
The data must be initialized.
Since: 3.3.0
int gnutls_x509_ext_export_key_purposes (gnutls_x509_key_purposes_t Param1
,gnutls_datum_t *ext
);
This function will convert the key purposes type to a
DER-encoded PKIX ExtKeyUsageSyntax (2.5.29.37) extension. The output data in
ext
will be allocated using gnutls_malloc()
.
p |
The key purposes |
|
ext |
The DER-encoded extension data; must be freed using |
Since: 3.3.0
int gnutls_x509_ext_import_key_usage (const gnutls_datum_t *ext
,unsigned int *key_usage
);
This function will return certificate's key usage, by reading the DER
data of the keyUsage X.509 extension (2.5.29.15). The key usage value will ORed
values of the: GNUTLS_KEY_DIGITAL_SIGNATURE
,
GNUTLS_KEY_NON_REPUDIATION
, GNUTLS_KEY_KEY_ENCIPHERMENT
,
GNUTLS_KEY_DATA_ENCIPHERMENT
, GNUTLS_KEY_KEY_AGREEMENT
,
GNUTLS_KEY_KEY_CERT_SIGN
, GNUTLS_KEY_CRL_SIGN
,
GNUTLS_KEY_ENCIPHER_ONLY
, GNUTLS_KEY_DECIPHER_ONLY
.
the certificate key usage, or a negative error code in case of
parsing error. If the certificate does not contain the keyUsage
extension GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
will be
returned.
Since: 3.3.0
int gnutls_x509_ext_export_key_usage (unsigned int key_usage
,gnutls_datum_t *ext
);
This function will convert the keyUsage bit string to a DER
encoded PKIX extension. The ext
data will be allocated using
gnutls_malloc()
.
usage |
an ORed sequence of the GNUTLS_KEY_* elements. |
|
ext |
The DER-encoded extension data; must be freed using |
Since: 3.3.0
int gnutls_x509_ext_import_inhibit_anypolicy (const gnutls_datum_t *ext
,unsigned int *skipcerts
);
This function will return certificate's value of SkipCerts, by reading the DER data of the Inhibit anyPolicy X.509 extension (2.5.29.54).
The skipcerts
value is the number of additional certificates that
may appear in the path before the anyPolicy (GNUTLS_X509_OID_POLICY_ANY
)
is no longer acceptable.
ext |
the DER encoded extension data |
|
skipcerts |
will hold the number of certificates after which anypolicy is no longer acceptable. |
zero, or a negative error code in case of
parsing error. If the certificate does not contain the Inhibit anyPolicy
extension GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
will be
returned.
Since: 3.6.0
int gnutls_x509_ext_export_inhibit_anypolicy (unsigned int skipcerts
,gnutls_datum_t *ext
);
This function will convert the skipcerts
value to a DER
encoded Inhibit AnyPolicy PKIX extension. The ext
data will be allocated using
gnutls_malloc()
.
skipcerts |
number of certificates after which anypolicy is no longer acceptable. |
|
ext |
The DER-encoded extension data; must be freed using |
Since: 3.6.0
int gnutls_x509_ext_import_proxy (const gnutls_datum_t *ext
,int *pathlen
,char **policyLanguage
,char **policy
,size_t *sizeof_policy
);
This function will return the information from a proxy certificate
extension. It reads the ProxyCertInfo X.509 extension (1.3.6.1.5.5.7.1.14).
The policyLanguage
and policy
values must be deinitialized using gnutls_free()
after use.
ext |
the DER encoded extension data |
|
pathlen |
pointer to output integer indicating path length (may be NULL), non-negative error codes indicate a present pCPathLenConstraint field and the actual value, -1 indicate that the field is absent. |
|
policyLanguage |
output variable with OID of policy language |
|
policy |
output variable with policy data |
|
sizeof_policy |
output variable with size of policy data |
Since: 3.3.0
int gnutls_x509_ext_export_proxy (int pathLenConstraint
,const char *policyLanguage
,const char *policy
,size_t sizeof_policy
,gnutls_datum_t *ext
);
This function will convert the parameters provided to a proxyCertInfo extension.
The ext
data will be allocated using gnutls_malloc()
.
pathLenConstraint |
A negative value will remove the path length constraint, while non-negative values will be set as the length of the pathLenConstraints field. |
|
policyLanguage |
OID describing the language of |
|
policy |
uint8_t byte array with policy language, can be |
|
sizeof_policy |
size of |
|
ext |
The DER-encoded extension data; must be freed using |
Since: 3.3.0
int
gnutls_x509_policies_init (gnutls_x509_policies_t *Param1
);
This function will initialize an authority key ID type.
Since: 3.3.0
void
gnutls_x509_policies_deinit (gnutls_x509_policies_t Param1
);
This function will deinitialize an authority key identifier type.
Since: 3.3.0
int gnutls_x509_policies_get (gnutls_x509_policies_t policies
,unsigned int seq
,struct gnutls_x509_policy_st *policy
);
This function will return a specific policy as stored in
the policies
type. The returned values should be treated as constant
and valid for the lifetime of policies
.
The any policy OID is available as the GNUTLS_X509_OID_POLICY_ANY
macro.
On success, GNUTLS_E_SUCCESS
(0) is returned, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
if the index is out of bounds, otherwise a negative error value.
Since: 3.3.0
int gnutls_x509_policies_set (gnutls_x509_policies_t policies
,const struct gnutls_x509_policy_st *policy
);
This function will store the specified policy in
the provided policies
.
policies |
An initialized policies |
|
seq |
The index of the name to get |
|
policy |
Contains the policy to set |
Since: 3.3.0
int gnutls_x509_ext_import_policies (const gnutls_datum_t *ext
,gnutls_x509_policies_t policies
,unsigned int flags
);
This function will extract the certificate policy extension (2.5.29.32) and store it the provided policies.
ext |
the DER encoded extension data |
|
policies |
A pointer to an initialized policies. |
|
flags |
should be zero |
Since: 3.3.0
int gnutls_x509_ext_export_policies (gnutls_x509_policies_t policies
,gnutls_datum_t *ext
);
This function will convert the provided policies, to a certificate policy DER encoded extension (2.5.29.32).
The ext
data will be allocated using gnutls_malloc()
.
policies |
A pointer to an initialized policies. |
|
ext |
The DER-encoded extension data; must be freed using |
Since: 3.3.0
int gnutls_x509_ext_import_tlsfeatures (const gnutls_datum_t *ext
,gnutls_x509_tlsfeatures_t Param2
,unsigned int flags
);
This function will export the features in the provided DER-encoded
TLS Features PKIX extension, to a gnutls_x509_tlsfeatures_t
type. f
must be initialized.
When the flags
is set to GNUTLS_EXT_FLAG_APPEND
,
then if the features
structure is empty this function will behave
identically as if the flag was not set. Otherwise if there are elements
in the features
structure then they will be merged with.
ext |
The DER-encoded extension data |
|
f |
The features structure |
|
flags |
zero or |
Since: 3.5.1
int gnutls_x509_ext_export_tlsfeatures (gnutls_x509_tlsfeatures_t f
,gnutls_datum_t *ext
);
This function will convert the provided TLS features structure structure to a
DER-encoded TLS features PKIX extension. The output data in ext
will be allocated using
gnutls_malloc()
.
f |
The features structure |
|
ext |
The DER-encoded extension data; must be freed using |
Since: 3.5.1
int gnutls_x509_tlsfeatures_add (gnutls_x509_tlsfeatures_t f
,unsigned int feature
);
This function will append a feature to the X.509 TLS features extension structure.
Since: 3.5.1
int
gnutls_x509_ext_ct_scts_init (gnutls_x509_ct_scts_t *scts
);
This function will initialize a Certificate Transparency SCT list.
void
gnutls_x509_ext_ct_scts_deinit (gnutls_x509_ct_scts_t scts
);
This function will deinitialize a Certificate Transparency SCT list.
int gnutls_x509_ext_ct_import_scts (const gnutls_datum_t *ext
,gnutls_x509_ct_scts_t scts
,unsigned int flags
);
This function will read a SignedCertificateTimestampList structure from the DER data of the X.509 Certificate Transparency SCT extension (OID 1.3.6.1.4.1.11129.2.4.2).
The list of SCTs (Signed Certificate Timestamps) is placed on scts
,
which must be previously initialized with gnutls_x509_ext_ct_scts_init()
.
int gnutls_x509_ext_ct_export_scts (const gnutls_x509_ct_scts_t scts
,gnutls_datum_t *ext
);
This function will convert the provided list of SCTs to a DER-encoded
SignedCertificateTimestampList extension (1.3.6.1.4.1.11129.2.4.2).
The output data in ext
will be allocated using gnutls_malloc()
.
scts |
An initialized SCT list |
|
ext |
The DER-encoded extension data; must be freed with |
int gnutls_x509_ct_sct_get_version (const gnutls_x509_ct_scts_t scts
,unsigned idx
,unsigned int *version_out
);
This function obtains the version of the SCT at the given position in the SCT list.
The version of that SCT will be placed on version_out
.
Return : GNUTLS_E_SUCCESS
(0) is returned on success,
GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
if idx
exceeds the number of SCTs in the list
and GNUTLS_E_INVALID_REQUEST
if the SCT's version is different than 1, as that's currently
the only defined version.
int gnutls_x509_ct_sct_get (const gnutls_x509_ct_scts_t scts
,unsigned idx
,time_t *timestamp
,gnutls_datum_t *logid
,gnutls_sign_algorithm_t *sigalg
,gnutls_datum_t *signature
);
This function will return a specific SCT (Signed Certificate Timestamp)
stored in the SCT list scts
.
The datums holding the SCT's LogId and signature will be allocated
using gnutls_malloc()
.
scts |
A list of SCTs |
|
idx |
The index of the target SCT in the list |
|
timestamp |
The timestamp of the SCT |
|
logid |
The LogID field of the SCT; must be freed with |
|
sigalg |
The signature algorithm |
|
signature |
The signature of the SCT; must be freed with |
GNUTLS_E_SUCCESS
(0) will be returned on success,
GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
if idx
exceeds the number of SCTs in the list
or a negative error value.
#define gnutls_x509_ext_import_issuer_alt_name gnutls_x509_ext_import_subject_alt_name
#define gnutls_x509_ext_export_issuer_alt_name gnutls_x509_ext_export_subject_alt_name
typedef struct gnutls_x509_crl_dist_points_st *gnutls_x509_crl_dist_points_t;