x509-ext

x509-ext

Functions

int gnutls_subject_alt_names_init ()
void gnutls_subject_alt_names_deinit ()
int gnutls_subject_alt_names_get ()
int gnutls_subject_alt_names_set ()
int gnutls_x509_ext_import_subject_alt_names ()
int gnutls_x509_ext_export_subject_alt_names ()
int gnutls_x509_crl_dist_points_init ()
void gnutls_x509_crl_dist_points_deinit ()
int gnutls_x509_crl_dist_points_get ()
int gnutls_x509_crl_dist_points_set ()
int gnutls_x509_ext_import_crl_dist_points ()
int gnutls_x509_ext_export_crl_dist_points ()
int gnutls_x509_ext_import_name_constraints ()
int gnutls_x509_ext_export_name_constraints ()
int gnutls_x509_aia_init ()
void gnutls_x509_aia_deinit ()
int gnutls_x509_aia_get ()
int gnutls_x509_aia_set ()
int gnutls_x509_ext_import_aia ()
int gnutls_x509_ext_export_aia ()
int gnutls_x509_ext_import_subject_key_id ()
int gnutls_x509_ext_export_subject_key_id ()
int gnutls_x509_ext_export_authority_key_id ()
int gnutls_x509_ext_import_authority_key_id ()
int gnutls_x509_othername_to_virtual ()
int gnutls_x509_aki_init ()
int gnutls_x509_aki_get_id ()
int gnutls_x509_aki_get_cert_issuer ()
int gnutls_x509_aki_set_id ()
int gnutls_x509_aki_set_cert_issuer ()
void gnutls_x509_aki_deinit ()
int gnutls_x509_ext_import_private_key_usage_period ()
int gnutls_x509_ext_export_private_key_usage_period ()
int gnutls_x509_ext_import_basic_constraints ()
int gnutls_x509_ext_export_basic_constraints ()
int gnutls_x509_key_purpose_init ()
void gnutls_x509_key_purpose_deinit ()
int gnutls_x509_key_purpose_set ()
int gnutls_x509_key_purpose_get ()
int gnutls_x509_ext_import_key_purposes ()
int gnutls_x509_ext_export_key_purposes ()
int gnutls_x509_ext_import_key_usage ()
int gnutls_x509_ext_export_key_usage ()
int gnutls_x509_ext_import_inhibit_anypolicy ()
int gnutls_x509_ext_export_inhibit_anypolicy ()
int gnutls_x509_ext_import_proxy ()
int gnutls_x509_ext_export_proxy ()
int gnutls_x509_policies_init ()
void gnutls_x509_policies_deinit ()
int gnutls_x509_policies_get ()
int gnutls_x509_policies_set ()
int gnutls_x509_ext_import_policies ()
int gnutls_x509_ext_export_policies ()
int gnutls_x509_ext_import_tlsfeatures ()
int gnutls_x509_ext_export_tlsfeatures ()
int gnutls_x509_tlsfeatures_add ()
int gnutls_x509_ext_ct_scts_init ()
void gnutls_x509_ext_ct_scts_deinit ()
int gnutls_x509_ext_ct_import_scts ()
int gnutls_x509_ext_ct_export_scts ()
int gnutls_x509_ct_sct_get_version ()
int gnutls_x509_ct_sct_get ()

Types and Values

Description

Functions

gnutls_subject_alt_names_init ()

int
gnutls_subject_alt_names_init (gnutls_subject_alt_names_t *Param1);

This function will initialize an alternative names type.

Parameters

p

The key purposes

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_subject_alt_names_deinit ()

void
gnutls_subject_alt_names_deinit (gnutls_subject_alt_names_t sans);

This function will deinitialize an alternative names structure.

Parameters

sans

The alternative names

 

Since: 3.3.0


gnutls_subject_alt_names_get ()

int
gnutls_subject_alt_names_get (gnutls_subject_alt_names_t sans,
                              unsigned int seq,
                              unsigned int *san_type,
                              gnutls_datum_t *san,
                              gnutls_datum_t *othername_oid);

This function will return a specific alternative name as stored in the sans type. The returned values should be treated as constant and valid for the lifetime of sans .

Parameters

sans

The alternative names

 

seq

The index of the name to get

 

san_type

Will hold the type of the name (of gnutls_subject_alt_names_t)

 

san

The alternative name data (should be treated as constant)

 

othername_oid

The object identifier if san_type is GNUTLS_SAN_OTHERNAME (should be treated as constant)

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE if the index is out of bounds, otherwise a negative error value.

Since: 3.3.0


gnutls_subject_alt_names_set ()

int
gnutls_subject_alt_names_set (gnutls_subject_alt_names_t sans,
                              unsigned int san_type,
                              const gnutls_datum_t *san,
                              const char *othername_oid);

This function will store the specified alternative name in the sans .

Since version 3.5.7 the GNUTLS_SAN_RFC822NAME, GNUTLS_SAN_DNSNAME, and GNUTLS_SAN_OTHERNAME_XMPP are converted to ACE format when necessary.

Parameters

sans

The alternative names

 

san_type

The type of the name (of gnutls_subject_alt_names_t)

 

san

The alternative name data

 

othername_oid

The object identifier if san_type is GNUTLS_SAN_OTHERNAME

 

Returns

On success, GNUTLS_E_SUCCESS (0), otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_import_subject_alt_names ()

int
gnutls_x509_ext_import_subject_alt_names
                               (const gnutls_datum_t *ext,
                                gnutls_subject_alt_names_t Param2,
                                unsigned int flags);

This function will export the alternative names in the provided DER-encoded SubjectAltName PKIX extension, to a gnutls_subject_alt_names_t type. sans must be initialized.

This function will succeed even if there no subject alternative names in the structure.

Parameters

ext

The DER-encoded extension data

 

sans

The alternative names

 

flags

should be zero

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_export_subject_alt_names ()

int
gnutls_x509_ext_export_subject_alt_names
                               (gnutls_subject_alt_names_t Param1,
                                gnutls_datum_t *ext);

This function will convert the provided alternative names structure to a DER-encoded SubjectAltName PKIX extension. The output data in ext will be allocated using gnutls_malloc().

Parameters

sans

The alternative names

 

ext

The DER-encoded extension data; must be freed using gnutls_free().

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_crl_dist_points_init ()

int
gnutls_x509_crl_dist_points_init (gnutls_x509_crl_dist_points_t *Param1);

This function will initialize a CRL distribution points type.

Parameters

cdp

The CRL distribution points

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_crl_dist_points_deinit ()

void
gnutls_x509_crl_dist_points_deinit (gnutls_x509_crl_dist_points_t Param1);

This function will deinitialize a CRL distribution points type.

Parameters

cdp

The CRL distribution points

 

Since: 3.3.0


gnutls_x509_crl_dist_points_get ()

int
gnutls_x509_crl_dist_points_get (gnutls_x509_crl_dist_points_t Param1,
                                 unsigned int seq,
                                 unsigned int *type,
                                 gnutls_datum_t *dist,
                                 unsigned int *reason_flags);

This function retrieves the individual CRL distribution points (2.5.29.31), contained in provided type.

Parameters

cdp

The CRL distribution points

 

seq

specifies the sequence number of the distribution point (0 for the first one, 1 for the second etc.)

 

type

The name type of the corresponding name (gnutls_x509_subject_alt_name_t)

 

san

The distribution point names (to be treated as constant)

 

reasons

Revocation reasons. An ORed sequence of flags from gnutls_x509_crl_reason_flags_t.

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE if the index is out of bounds, otherwise a negative error value.


gnutls_x509_crl_dist_points_set ()

int
gnutls_x509_crl_dist_points_set (gnutls_x509_crl_dist_points_t Param1,
                                 gnutls_x509_subject_alt_name_t type,
                                 const gnutls_datum_t *dist,
                                 unsigned int reason_flags);

This function will store the specified CRL distribution point value the cdp type.

Parameters

cdp

The CRL distribution points

 

type

The type of the name (of gnutls_subject_alt_names_t)

 

san

The point name data

 

reasons

Revocation reasons. An ORed sequence of flags from gnutls_x509_crl_reason_flags_t.

 

Returns

On success, GNUTLS_E_SUCCESS (0), otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_import_crl_dist_points ()

int
gnutls_x509_ext_import_crl_dist_points
                               (const gnutls_datum_t *ext,
                                gnutls_x509_crl_dist_points_t dp,
                                unsigned int flags);

This function will extract the CRL distribution points extension (2.5.29.31) and store it into the provided type.

Parameters

ext

the DER encoded extension data

 

cdp

A pointer to an initialized CRL distribution points.

 

flags

should be zero

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_export_crl_dist_points ()

int
gnutls_x509_ext_export_crl_dist_points
                               (gnutls_x509_crl_dist_points_t dp,
                                gnutls_datum_t *ext);

This function will convert the provided policies, to a certificate policy DER encoded extension (2.5.29.31).

The ext data will be allocated using gnutls_malloc().

Parameters

cdp

A pointer to an initialized CRL distribution points.

 

ext

The DER-encoded extension data; must be freed using gnutls_free().

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_import_name_constraints ()

int
gnutls_x509_ext_import_name_constraints
                               (const gnutls_datum_t *ext,
                                gnutls_x509_name_constraints_t nc,
                                unsigned int flags);

This function will return an intermediate type containing the name constraints of the provided NameConstraints extension. That can be used in combination with gnutls_x509_name_constraints_check() to verify whether a server's name is in accordance with the constraints.

When the flags is set to GNUTLS_NAME_CONSTRAINTS_FLAG_APPEND, then if the nc type is empty this function will behave identically as if the flag was not set. Otherwise if there are elements in the nc structure then the constraints will be merged with the existing constraints following RFC5280 p6.1.4 (excluded constraints will be appended, permitted will be intersected).

Note that nc must be initialized prior to calling this function.

Parameters

ext

a DER encoded extension

 

nc

The nameconstraints

 

flags

zero or GNUTLS_NAME_CONSTRAINTS_FLAG_APPEND

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE if the extension is not present, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_export_name_constraints ()

int
gnutls_x509_ext_export_name_constraints
                               (gnutls_x509_name_constraints_t nc,
                                gnutls_datum_t *ext);

This function will convert the provided name constraints type to a DER-encoded PKIX NameConstraints (2.5.29.30) extension. The output data in ext will be allocated using gnutls_malloc().

Parameters

nc

The nameconstraints

 

ext

The DER-encoded extension data; must be freed using gnutls_free().

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_aia_init ()

int
gnutls_x509_aia_init (gnutls_x509_aia_t *Param1);

This function will initialize an authority info access type.

Parameters

aia

The authority info access

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_aia_deinit ()

void
gnutls_x509_aia_deinit (gnutls_x509_aia_t Param1);

This function will deinitialize an authority info access type.

Parameters

aia

The authority info access

 

Since: 3.3.0


gnutls_x509_aia_get ()

int
gnutls_x509_aia_get (gnutls_x509_aia_t aia,
                     unsigned int seq,
                     gnutls_datum_t *oid,
                     unsigned *san_type,
                     gnutls_datum_t *san);

This function reads from the Authority Information Access type.

The seq input parameter is used to indicate which member of the sequence the caller is interested in. The first member is 0, the second member 1 and so on. When the seq value is out of bounds, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE is returned.

Typically oid is GNUTLS_OID_AD_CAISSUERS or GNUTLS_OID_AD_OCSP.

Parameters

aia

The authority info access

 

seq

specifies the sequence number of the access descriptor (0 for the first one, 1 for the second etc.)

 

oid

the type of available data; to be treated as constant.

 

san_type

Will hold the type of the name of gnutls_subject_alt_names_t (may be null).

 

san

the access location name; to be treated as constant (may be null).

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_aia_set ()

int
gnutls_x509_aia_set (gnutls_x509_aia_t aia,
                     const char *oid,
                     unsigned  san_type,
                     const gnutls_datum_t *san);

This function will store the specified alternative name in the aia type.

Typically the value for oid should be GNUTLS_OID_AD_OCSP, or GNUTLS_OID_AD_CAISSUERS.

Since version 3.5.7 the GNUTLS_SAN_RFC822NAME, and GNUTLS_SAN_DNSNAME, are converted to ACE format when necessary.

Parameters

aia

The authority info access

 

oid

the type of data.

 

san_type

The type of the name (of gnutls_subject_alt_names_t)

 

san

The alternative name data

 

othername_oid

The object identifier if san_type is GNUTLS_SAN_OTHERNAME

 

Returns

On success, GNUTLS_E_SUCCESS (0), otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_import_aia ()

int
gnutls_x509_ext_import_aia (const gnutls_datum_t *ext,
                            gnutls_x509_aia_t Param2,
                            unsigned int flags);

This function extracts the Authority Information Access (AIA) extension from the provided DER-encoded data; see RFC 5280 section 4.2.2.1 for more information on the extension. The AIA extension holds a sequence of AccessDescription (AD) data.

Parameters

ext

The DER-encoded extension data

 

aia

The authority info access

 

flags

should be zero

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_export_aia ()

int
gnutls_x509_ext_export_aia (gnutls_x509_aia_t aia,
                            gnutls_datum_t *ext);

This function will DER encode the Authority Information Access (AIA) extension; see RFC 5280 section 4.2.2.1 for more information on the extension.

Parameters

aia

The authority info access

 

ext

The DER-encoded extension data; must be freed using gnutls_free().

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_import_subject_key_id ()

int
gnutls_x509_ext_import_subject_key_id (const gnutls_datum_t *ext,
                                       gnutls_datum_t *id);

This function will return the subject key ID stored in the provided SubjectKeyIdentifier extension. The ID will be allocated using gnutls_malloc().

Parameters

ext

a DER encoded extension

 

id

will contain the subject key ID

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE if the extension is not present, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_export_subject_key_id ()

int
gnutls_x509_ext_export_subject_key_id (const gnutls_datum_t *id,
                                       gnutls_datum_t *ext);

This function will convert the provided key identifier to a DER-encoded PKIX SubjectKeyIdentifier extension. The output data in ext will be allocated using gnutls_malloc().

Parameters

id

The key identifier

 

ext

The DER-encoded extension data; must be freed using gnutls_free().

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_export_authority_key_id ()

int
gnutls_x509_ext_export_authority_key_id
                               (gnutls_x509_aki_t Param1,
                                gnutls_datum_t *ext);

This function will convert the provided key identifier to a DER-encoded PKIX AuthorityKeyIdentifier extension. The output data in ext will be allocated using gnutls_malloc().

Parameters

aki

An initialized authority key identifier

 

ext

The DER-encoded extension data; must be freed using gnutls_free().

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_import_authority_key_id ()

int
gnutls_x509_ext_import_authority_key_id
                               (const gnutls_datum_t *ext,
                                gnutls_x509_aki_t Param2,
                                unsigned int flags);

This function will return the subject key ID stored in the provided AuthorityKeyIdentifier extension.

Parameters

ext

a DER encoded extension

 

aki

An initialized authority key identifier type

 

flags

should be zero

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE if the extension is not present, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_othername_to_virtual ()

int
gnutls_x509_othername_to_virtual (const char *oid,
                                  const gnutls_datum_t *othername,
                                  unsigned int *virt_type,
                                  gnutls_datum_t *virt);

This function will parse and convert the othername data to a virtual type supported by gnutls.

Parameters

oid

The othername object identifier

 

othername

The othername data

 

virt_type

GNUTLS_SAN_OTHERNAME_XXX

 

virt

allocated printable data

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.8


gnutls_x509_aki_init ()

int
gnutls_x509_aki_init (gnutls_x509_aki_t *Param1);

This function will initialize an authority key ID.

Parameters

aki

The authority key ID type

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_aki_get_id ()

int
gnutls_x509_aki_get_id (gnutls_x509_aki_t Param1,
                        gnutls_datum_t *id);

This function will return the key identifier as stored in the aki type. The identifier should be treated as constant.

Parameters

aki

The authority key ID

 

id

Will hold the identifier

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE if the index is out of bounds, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_aki_get_cert_issuer ()

int
gnutls_x509_aki_get_cert_issuer (gnutls_x509_aki_t aki,
                                 unsigned int seq,
                                 unsigned int *san_type,
                                 gnutls_datum_t *san,
                                 gnutls_datum_t *othername_oid,
                                 gnutls_datum_t *serial);

This function will return a specific authorityCertIssuer name as stored in the aki type, as well as the authorityCertSerialNumber. All the returned values should be treated as constant, and may be set to NULL when are not required.

Parameters

aki

The authority key ID

 

seq

The index of the name to get

 

san_type

Will hold the type of the name (of gnutls_subject_alt_names_t)

 

san

The alternative name data

 

othername_oid

The object identifier if san_type is GNUTLS_SAN_OTHERNAME

 

serial

The authorityCertSerialNumber number

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE if the index is out of bounds, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_aki_set_id ()

int
gnutls_x509_aki_set_id (gnutls_x509_aki_t aki,
                        const gnutls_datum_t *id);

This function will set the keyIdentifier to be stored in the aki type.

Parameters

aki

The authority key ID

 

id

the key identifier

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_aki_set_cert_issuer ()

int
gnutls_x509_aki_set_cert_issuer (gnutls_x509_aki_t aki,
                                 unsigned int san_type,
                                 const gnutls_datum_t *san,
                                 const char *othername_oid,
                                 const gnutls_datum_t *serial);

This function will set the authorityCertIssuer name and the authorityCertSerialNumber to be stored in the aki type. When storing multiple names, the serial should be set on the first call, and subsequent calls should use a NULL serial.

Since version 3.5.7 the GNUTLS_SAN_RFC822NAME, GNUTLS_SAN_DNSNAME, and GNUTLS_SAN_OTHERNAME_XMPP are converted to ACE format when necessary.

Parameters

aki

The authority key ID

 

san_type

the type of the name (of gnutls_subject_alt_names_t), may be null

 

san

The alternative name data

 

othername_oid

The object identifier if san_type is GNUTLS_SAN_OTHERNAME

 

serial

The authorityCertSerialNumber number (may be null)

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_aki_deinit ()

void
gnutls_x509_aki_deinit (gnutls_x509_aki_t Param1);

This function will deinitialize an authority key identifier.

Parameters

aki

The authority key identifier type

 

Since: 3.3.0


gnutls_x509_ext_import_private_key_usage_period ()

int
gnutls_x509_ext_import_private_key_usage_period
                               (const gnutls_datum_t *ext,
                                time_t *activation,
                                time_t *expiration);

This function will return the expiration and activation times of the private key as written in the PKIX extension 2.5.29.16.

Parameters

ext

the DER encoded extension data

 

activation

Will hold the activation time

 

expiration

Will hold the expiration time

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_export_private_key_usage_period ()

int
gnutls_x509_ext_export_private_key_usage_period
                               (time_t activation,
                                time_t expiration,
                                gnutls_datum_t *ext);

This function will convert the periods provided to a private key usage DER encoded extension (2.5.29.16). ( The ext data will be allocated using gnutls_malloc().

Parameters

activation

The activation time

 

expiration

The expiration time

 

ext

The DER-encoded extension data; must be freed using gnutls_free().

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_import_basic_constraints ()

int
gnutls_x509_ext_import_basic_constraints
                               (const gnutls_datum_t *ext,
                                unsigned int *ca,
                                int *pathlen);

This function will return the CA status and path length constraint as written in the PKIX extension 2.5.29.19.

Parameters

ext

the DER encoded extension data

 

ca

will be non zero if the CA status is true

 

pathlen

the path length constraint; will be set to -1 for no limit

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_export_basic_constraints ()

int
gnutls_x509_ext_export_basic_constraints
                               (unsigned int ca,
                                int pathlen,
                                gnutls_datum_t *ext);

This function will convert the parameters provided to a basic constraints DER encoded extension (2.5.29.19). ( The ext data will be allocated using gnutls_malloc().

Parameters

ca

non-zero for a CA

 

pathlen

The path length constraint (set to -1 for no constraint)

 

ext

The DER-encoded extension data; must be freed using gnutls_free().

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_key_purpose_init ()

int
gnutls_x509_key_purpose_init (gnutls_x509_key_purposes_t *p);

gnutls_x509_key_purpose_deinit ()

void
gnutls_x509_key_purpose_deinit (gnutls_x509_key_purposes_t p);

This function will deinitialize a key purposes type.

Parameters

p

The key purposes

 

Since: 3.3.0


gnutls_x509_key_purpose_set ()

int
gnutls_x509_key_purpose_set (gnutls_x509_key_purposes_t p,
                             const char *oid);

This function will store the specified key purpose in the purposes.

Parameters

p

The key purposes

 

oid

The object identifier of the key purpose

 

Returns

On success, GNUTLS_E_SUCCESS (0), otherwise a negative error value.

Since: 3.3.0


gnutls_x509_key_purpose_get ()

int
gnutls_x509_key_purpose_get (gnutls_x509_key_purposes_t p,
                             unsigned  idx,
                             gnutls_datum_t *oid);

This function will retrieve the specified by the index key purpose in the purposes type. The object identifier will be a null terminated string.

Parameters

p

The key purposes

 

idx

The index of the key purpose to retrieve

 

oid

Will hold the object identifier of the key purpose (to be treated as constant)

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE if the index is out of bounds, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_import_key_purposes ()

int
gnutls_x509_ext_import_key_purposes (const gnutls_datum_t *ext,
                                     gnutls_x509_key_purposes_t Param2,
                                     unsigned int flags);

This function will extract the key purposes in the provided DER-encoded ExtKeyUsageSyntax PKIX extension, to a gnutls_x509_key_purposes_t type. The data must be initialized.

Parameters

ext

The DER-encoded extension data

 

p

The key purposes

 

flags

should be zero

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_export_key_purposes ()

int
gnutls_x509_ext_export_key_purposes (gnutls_x509_key_purposes_t Param1,
                                     gnutls_datum_t *ext);

This function will convert the key purposes type to a DER-encoded PKIX ExtKeyUsageSyntax (2.5.29.37) extension. The output data in ext will be allocated using gnutls_malloc().

Parameters

p

The key purposes

 

ext

The DER-encoded extension data; must be freed using gnutls_free().

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_import_key_usage ()

int
gnutls_x509_ext_import_key_usage (const gnutls_datum_t *ext,
                                  unsigned int *key_usage);

This function will return certificate's key usage, by reading the DER data of the keyUsage X.509 extension (2.5.29.15). The key usage value will ORed values of the: GNUTLS_KEY_DIGITAL_SIGNATURE, GNUTLS_KEY_NON_REPUDIATION, GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DATA_ENCIPHERMENT, GNUTLS_KEY_KEY_AGREEMENT, GNUTLS_KEY_KEY_CERT_SIGN, GNUTLS_KEY_CRL_SIGN, GNUTLS_KEY_ENCIPHER_ONLY, GNUTLS_KEY_DECIPHER_ONLY.

Parameters

ext

the DER encoded extension data

 

key_usage

where the key usage bits will be stored

 

Returns

the certificate key usage, or a negative error code in case of parsing error. If the certificate does not contain the keyUsage extension GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.

Since: 3.3.0


gnutls_x509_ext_export_key_usage ()

int
gnutls_x509_ext_export_key_usage (unsigned int key_usage,
                                  gnutls_datum_t *ext);

This function will convert the keyUsage bit string to a DER encoded PKIX extension. The ext data will be allocated using gnutls_malloc().

Parameters

usage

an ORed sequence of the GNUTLS_KEY_* elements.

 

ext

The DER-encoded extension data; must be freed using gnutls_free().

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_import_inhibit_anypolicy ()

int
gnutls_x509_ext_import_inhibit_anypolicy
                               (const gnutls_datum_t *ext,
                                unsigned int *skipcerts);

This function will return certificate's value of SkipCerts, by reading the DER data of the Inhibit anyPolicy X.509 extension (2.5.29.54).

The skipcerts value is the number of additional certificates that may appear in the path before the anyPolicy (GNUTLS_X509_OID_POLICY_ANY) is no longer acceptable.

Parameters

ext

the DER encoded extension data

 

skipcerts

will hold the number of certificates after which anypolicy is no longer acceptable.

 

Returns

zero, or a negative error code in case of parsing error. If the certificate does not contain the Inhibit anyPolicy extension GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.

Since: 3.6.0


gnutls_x509_ext_export_inhibit_anypolicy ()

int
gnutls_x509_ext_export_inhibit_anypolicy
                               (unsigned int skipcerts,
                                gnutls_datum_t *ext);

This function will convert the skipcerts value to a DER encoded Inhibit AnyPolicy PKIX extension. The ext data will be allocated using gnutls_malloc().

Parameters

skipcerts

number of certificates after which anypolicy is no longer acceptable.

 

ext

The DER-encoded extension data; must be freed using gnutls_free().

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.6.0


gnutls_x509_ext_import_proxy ()

int
gnutls_x509_ext_import_proxy (const gnutls_datum_t *ext,
                              int *pathlen,
                              char **policyLanguage,
                              char **policy,
                              size_t *sizeof_policy);

This function will return the information from a proxy certificate extension. It reads the ProxyCertInfo X.509 extension (1.3.6.1.5.5.7.1.14). The policyLanguage and policy values must be deinitialized using gnutls_free() after use.

Parameters

ext

the DER encoded extension data

 

pathlen

pointer to output integer indicating path length (may be NULL), non-negative error codes indicate a present pCPathLenConstraint field and the actual value, -1 indicate that the field is absent.

 

policyLanguage

output variable with OID of policy language

 

policy

output variable with policy data

 

sizeof_policy

output variable with size of policy data

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_export_proxy ()

int
gnutls_x509_ext_export_proxy (int pathLenConstraint,
                              const char *policyLanguage,
                              const char *policy,
                              size_t sizeof_policy,
                              gnutls_datum_t *ext);

This function will convert the parameters provided to a proxyCertInfo extension.

The ext data will be allocated using gnutls_malloc().

Parameters

pathLenConstraint

A negative value will remove the path length constraint, while non-negative values will be set as the length of the pathLenConstraints field.

 

policyLanguage

OID describing the language of policy .

 

policy

uint8_t byte array with policy language, can be NULL

 

sizeof_policy

size of policy .

 

ext

The DER-encoded extension data; must be freed using gnutls_free().

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_policies_init ()

int
gnutls_x509_policies_init (gnutls_x509_policies_t *Param1);

This function will initialize an authority key ID type.

Parameters

policies

The authority key ID

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_policies_deinit ()

void
gnutls_x509_policies_deinit (gnutls_x509_policies_t Param1);

This function will deinitialize an authority key identifier type.

Parameters

policies

The authority key identifier

 

Since: 3.3.0


gnutls_x509_policies_get ()

int
gnutls_x509_policies_get (gnutls_x509_policies_t policies,
                          unsigned int seq,
                          struct gnutls_x509_policy_st *policy);

This function will return a specific policy as stored in the policies type. The returned values should be treated as constant and valid for the lifetime of policies .

The any policy OID is available as the GNUTLS_X509_OID_POLICY_ANY macro.

Parameters

policies

The policies

 

seq

The index of the name to get

 

policy

Will hold the policy

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE if the index is out of bounds, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_policies_set ()

int
gnutls_x509_policies_set (gnutls_x509_policies_t policies,
                          const struct gnutls_x509_policy_st *policy);

This function will store the specified policy in the provided policies .

Parameters

policies

An initialized policies

 

seq

The index of the name to get

 

policy

Contains the policy to set

 

Returns

On success, GNUTLS_E_SUCCESS (0), otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_import_policies ()

int
gnutls_x509_ext_import_policies (const gnutls_datum_t *ext,
                                 gnutls_x509_policies_t policies,
                                 unsigned int flags);

This function will extract the certificate policy extension (2.5.29.32) and store it the provided policies.

Parameters

ext

the DER encoded extension data

 

policies

A pointer to an initialized policies.

 

flags

should be zero

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_export_policies ()

int
gnutls_x509_ext_export_policies (gnutls_x509_policies_t policies,
                                 gnutls_datum_t *ext);

This function will convert the provided policies, to a certificate policy DER encoded extension (2.5.29.32).

The ext data will be allocated using gnutls_malloc().

Parameters

policies

A pointer to an initialized policies.

 

ext

The DER-encoded extension data; must be freed using gnutls_free().

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.3.0


gnutls_x509_ext_import_tlsfeatures ()

int
gnutls_x509_ext_import_tlsfeatures (const gnutls_datum_t *ext,
                                    gnutls_x509_tlsfeatures_t Param2,
                                    unsigned int flags);

This function will export the features in the provided DER-encoded TLS Features PKIX extension, to a gnutls_x509_tlsfeatures_t type. f must be initialized.

When the flags is set to GNUTLS_EXT_FLAG_APPEND, then if the features structure is empty this function will behave identically as if the flag was not set. Otherwise if there are elements in the features structure then they will be merged with.

Parameters

ext

The DER-encoded extension data

 

f

The features structure

 

flags

zero or GNUTLS_EXT_FLAG_APPEND

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.5.1


gnutls_x509_ext_export_tlsfeatures ()

int
gnutls_x509_ext_export_tlsfeatures (gnutls_x509_tlsfeatures_t f,
                                    gnutls_datum_t *ext);

This function will convert the provided TLS features structure structure to a DER-encoded TLS features PKIX extension. The output data in ext will be allocated using gnutls_malloc().

Parameters

f

The features structure

 

ext

The DER-encoded extension data; must be freed using gnutls_free().

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.5.1


gnutls_x509_tlsfeatures_add ()

int
gnutls_x509_tlsfeatures_add (gnutls_x509_tlsfeatures_t f,
                             unsigned int feature);

This function will append a feature to the X.509 TLS features extension structure.

Parameters

f

The TLS features

 

feature

The feature to add

 

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Since: 3.5.1


gnutls_x509_ext_ct_scts_init ()

int
gnutls_x509_ext_ct_scts_init (gnutls_x509_ct_scts_t *scts);

This function will initialize a Certificate Transparency SCT list.

Parameters

scts

The SCT list

 

Returns

GNUTLS_E_SUCCESS (0) on success, otherwise a negative error value.


gnutls_x509_ext_ct_scts_deinit ()

void
gnutls_x509_ext_ct_scts_deinit (gnutls_x509_ct_scts_t scts);

This function will deinitialize a Certificate Transparency SCT list.

Parameters

scts

The SCT list

 

gnutls_x509_ext_ct_import_scts ()

int
gnutls_x509_ext_ct_import_scts (const gnutls_datum_t *ext,
                                gnutls_x509_ct_scts_t scts,
                                unsigned int flags);

This function will read a SignedCertificateTimestampList structure from the DER data of the X.509 Certificate Transparency SCT extension (OID 1.3.6.1.4.1.11129.2.4.2).

The list of SCTs (Signed Certificate Timestamps) is placed on scts , which must be previously initialized with gnutls_x509_ext_ct_scts_init().

Parameters

ext

a DER-encoded extension

 

scts

The SCT list

 

flags

should be zero

 

Returns

GNUTLS_E_SUCCESS (0) on success or a negative error value.


gnutls_x509_ext_ct_export_scts ()

int
gnutls_x509_ext_ct_export_scts (const gnutls_x509_ct_scts_t scts,
                                gnutls_datum_t *ext);

This function will convert the provided list of SCTs to a DER-encoded SignedCertificateTimestampList extension (1.3.6.1.4.1.11129.2.4.2). The output data in ext will be allocated using gnutls_malloc().

Parameters

scts

An initialized SCT list

 

ext

The DER-encoded extension data; must be freed with gnutls_free()

 

Returns

GNUTLS_E_SUCCESS (0) on success or a negative error value.


gnutls_x509_ct_sct_get_version ()

int
gnutls_x509_ct_sct_get_version (const gnutls_x509_ct_scts_t scts,
                                unsigned  idx,
                                unsigned int *version_out);

This function obtains the version of the SCT at the given position in the SCT list.

The version of that SCT will be placed on version_out .

Return : GNUTLS_E_SUCCESS (0) is returned on success, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE if idx exceeds the number of SCTs in the list and GNUTLS_E_INVALID_REQUEST if the SCT's version is different than 1, as that's currently the only defined version.

Parameters

scts

A list of SCTs

 

idx

The index of the target SCT in the list

 

version_out

The version of the target SCT.

 

gnutls_x509_ct_sct_get ()

int
gnutls_x509_ct_sct_get (const gnutls_x509_ct_scts_t scts,
                        unsigned  idx,
                        time_t *timestamp,
                        gnutls_datum_t *logid,
                        gnutls_sign_algorithm_t *sigalg,
                        gnutls_datum_t *signature);

This function will return a specific SCT (Signed Certificate Timestamp) stored in the SCT list scts .

The datums holding the SCT's LogId and signature will be allocated using gnutls_malloc().

Parameters

scts

A list of SCTs

 

idx

The index of the target SCT in the list

 

timestamp

The timestamp of the SCT

 

logid

The LogID field of the SCT; must be freed with gnutls_free()

 

sigalg

The signature algorithm

 

signature

The signature of the SCT; must be freed with gnutls_free()

 

Returns

GNUTLS_E_SUCCESS (0) will be returned on success, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE if idx exceeds the number of SCTs in the list or a negative error value.

Types and Values

gnutls_subject_alt_names_t

typedef struct gnutls_subject_alt_names_st *gnutls_subject_alt_names_t;

gnutls_x509_ext_import_issuer_alt_name

#define gnutls_x509_ext_import_issuer_alt_name gnutls_x509_ext_import_subject_alt_name

gnutls_x509_ext_export_issuer_alt_name

#define gnutls_x509_ext_export_issuer_alt_name gnutls_x509_ext_export_subject_alt_name

gnutls_x509_crl_dist_points_t

typedef struct gnutls_x509_crl_dist_points_st *gnutls_x509_crl_dist_points_t;

gnutls_x509_aia_t

typedef struct gnutls_x509_aia_st *gnutls_x509_aia_t;

gnutls_x509_aki_t

typedef struct gnutls_x509_aki_st *gnutls_x509_aki_t;

gnutls_x509_key_purposes_t

typedef struct gnutls_x509_key_purposes_st *gnutls_x509_key_purposes_t;

gnutls_x509_policies_t

typedef struct gnutls_x509_policies_st *gnutls_x509_policies_t;

gnutls_x509_ct_scts_t

typedef struct gnutls_x509_ct_scts_st *gnutls_x509_ct_scts_t;