gnutls_pkcs7_deinit ()

void
gnutls_pkcs7_deinit (gnutls_pkcs7_t pkcs7);

This function will deinitialize a PKCS7 type.

gnutls_pkcs7_delete_crl ()

int
gnutls_pkcs7_delete_crl (gnutls_pkcs7_t pkcs7,
                         int indx);

This function will delete a crl from a PKCS7 or RFC2630 crl set. Index starts from 0. Returns 0 on success.

gnutls_pkcs7_delete_crt ()

int
gnutls_pkcs7_delete_crt (gnutls_pkcs7_t pkcs7,
                         int indx);

This function will delete a certificate from a PKCS7 or RFC2630 certificate set. Index starts from 0. Returns 0 on success.

gnutls_pkcs7_export ()

int
gnutls_pkcs7_export (gnutls_pkcs7_t pkcs7,
                     gnutls_x509_crt_fmt_t format,
                     void *output_data,
                     size_t *output_data_size);

This function will export the pkcs7 structure to DER or PEM format.

If the buffer provided is not long enough to hold the output, then *output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will be returned.

If the structure is PEM encoded, it will have a header of "BEGIN PKCS7".

gnutls_pkcs7_export2 ()

int
gnutls_pkcs7_export2 (gnutls_pkcs7_t pkcs7,
                      gnutls_x509_crt_fmt_t format,
                      gnutls_datum_t *out);

This function will export the pkcs7 structure to DER or PEM format.

The output buffer is allocated using gnutls_malloc().

If the structure is PEM encoded, it will have a header of "BEGIN PKCS7".

Since: 3.1.3

gnutls_pkcs7_get_crl_count ()

int
gnutls_pkcs7_get_crl_count (gnutls_pkcs7_t pkcs7);

This function will return the number of certificates in the PKCS7 or RFC2630 crl set.

gnutls_pkcs7_get_crl_raw ()

int
gnutls_pkcs7_get_crl_raw (gnutls_pkcs7_t pkcs7,
                          unsigned  indx,
                          void *crl,
                          size_t *crl_size);

This function will return a crl of the PKCS7 or RFC2630 crl set.

gnutls_pkcs7_get_crt_count ()

int
gnutls_pkcs7_get_crt_count (gnutls_pkcs7_t pkcs7);

This function will return the number of certificates in the PKCS7 or RFC2630 certificate set.

gnutls_pkcs7_get_crt_raw ()

int
gnutls_pkcs7_get_crt_raw (gnutls_pkcs7_t pkcs7,
                          unsigned  indx,
                          void *certificate,
                          size_t *certificate_size);

This function will return a certificate of the PKCS7 or RFC2630 certificate set.

After the last certificate has been read GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.

gnutls_pkcs7_import ()

int
gnutls_pkcs7_import (gnutls_pkcs7_t pkcs7,
                     const gnutls_datum_t *data,
                     gnutls_x509_crt_fmt_t format);

This function will convert the given DER or PEM encoded PKCS7 to the native gnutls_pkcs7_t format. The output will be stored in pkcs7 .

If the PKCS7 is PEM encoded it should have a header of "PKCS7".

gnutls_pkcs7_init ()

int
gnutls_pkcs7_init (gnutls_pkcs7_t *pkcs7);

This function will initialize a PKCS7 structure. PKCS7 structures usually contain lists of X.509 Certificates and X.509 Certificate revocation lists.

gnutls_pkcs7_set_crl ()

int
gnutls_pkcs7_set_crl (gnutls_pkcs7_t pkcs7,
                      gnutls_x509_crl_t crl);

This function will add a parsed CRL to the PKCS7 or RFC2630 crl set.

gnutls_pkcs7_set_crl_raw ()

int
gnutls_pkcs7_set_crl_raw (gnutls_pkcs7_t pkcs7,
                          const gnutls_datum_t *crl);

This function will add a crl to the PKCS7 or RFC2630 crl set.

gnutls_pkcs7_set_crt ()

int
gnutls_pkcs7_set_crt (gnutls_pkcs7_t pkcs7,
                      gnutls_x509_crt_t crt);

This function will add a parsed certificate to the PKCS7 or RFC2630 certificate set. This is a wrapper function over gnutls_pkcs7_set_crt_raw() .

gnutls_pkcs7_set_crt_raw ()

int
gnutls_pkcs7_set_crt_raw (gnutls_pkcs7_t pkcs7,
                          const gnutls_datum_t *crt);

This function will add a certificate to the PKCS7 or RFC2630 certificate set.

gnutls_x509_crl_check_issuer ()

unsigned
gnutls_x509_crl_check_issuer (gnutls_x509_crl_t crl,
                              gnutls_x509_crt_t issuer);

This function will check if the given CRL was issued by the given issuer certificate.

gnutls_x509_crl_deinit ()

void
gnutls_x509_crl_deinit (gnutls_x509_crl_t crl);

This function will deinitialize a CRL structure.

gnutls_x509_crl_export ()

int
gnutls_x509_crl_export (gnutls_x509_crl_t crl,
                        gnutls_x509_crt_fmt_t format,
                        void *output_data,
                        size_t *output_data_size);

This function will export the revocation list to DER or PEM format.

If the buffer provided is not long enough to hold the output, then GNUTLS_E_SHORT_MEMORY_BUFFER will be returned.

If the structure is PEM encoded, it will have a header of "BEGIN X509 CRL".

gnutls_x509_crl_export2 ()

int
gnutls_x509_crl_export2 (gnutls_x509_crl_t crl,
                         gnutls_x509_crt_fmt_t format,
                         gnutls_datum_t *out);

This function will export the revocation list to DER or PEM format.

The output buffer is allocated using gnutls_malloc().

If the structure is PEM encoded, it will have a header of "BEGIN X509 CRL".

gnutls_x509_crl_get_authority_key_gn_serial ()

int
gnutls_x509_crl_get_authority_key_gn_serial
                               (gnutls_x509_crl_t crl,
                                unsigned int seq,
                                void *alt,
                                size_t *alt_size,
                                unsigned int *alt_type,
                                void *serial,
                                size_t *serial_size,
                                unsigned int *critical);

This function will return the X.509 authority key identifier when stored as a general name (authorityCertIssuer) and serial number.

Because more than one general names might be stored seq can be used as a counter to request them all until GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE is returned.

Since: 3.0

gnutls_x509_crl_get_authority_key_id ()

int
gnutls_x509_crl_get_authority_key_id (gnutls_x509_crl_t crl,
                                      void *id,
                                      size_t *id_size,
                                      unsigned int *critical);

This function will return the CRL authority's key identifier. This is obtained by the X.509 Authority Key identifier extension field (2.5.29.35). Note that this function only returns the keyIdentifier field of the extension and GNUTLS_E_X509_UNSUPPORTED_EXTENSION, if the extension contains the name and serial number of the certificate. In that case gnutls_x509_crl_get_authority_key_gn_serial() may be used.

Since: 2.8.0

gnutls_x509_crl_get_crt_count ()

int
gnutls_x509_crl_get_crt_count (gnutls_x509_crl_t crl);

This function will return the number of revoked certificates in the given CRL.

gnutls_x509_crl_get_crt_serial ()

int
gnutls_x509_crl_get_crt_serial (gnutls_x509_crl_t crl,
                                unsigned  indx,
                                unsigned char *serial,
                                size_t *serial_size,
                                time_t *t);

This function will retrieve the serial number of the specified, by the index, revoked certificate.

Note that this function will have performance issues in large sequences of revoked certificates. In that case use gnutls_x509_crl_iter_crt_serial().

gnutls_x509_crl_get_dn_oid ()

int
gnutls_x509_crl_get_dn_oid (gnutls_x509_crl_t crl,
                            unsigned  indx,
                            void *oid,
                            size_t *sizeof_oid);

This function will extract the requested OID of the name of the CRL issuer, specified by the given index.

If oid is null then only the size will be filled.

gnutls_x509_crl_get_extension_data ()

int
gnutls_x509_crl_get_extension_data (gnutls_x509_crl_t crl,
                                    unsigned  indx,
                                    void *data,
                                    size_t *sizeof_data);

This function will return the requested extension data in the CRL. The extension data will be stored as a string in the provided buffer.

Use gnutls_x509_crl_get_extension_info() to extract the OID and critical flag. Use gnutls_x509_crl_get_extension_info() instead, if you want to get data indexed by the extension OID rather than sequence.

Since: 2.8.0

gnutls_x509_crl_get_extension_info ()

int
gnutls_x509_crl_get_extension_info (gnutls_x509_crl_t crl,
                                    unsigned  indx,
                                    void *oid,
                                    size_t *sizeof_oid,
                                    unsigned int *critical);

This function will return the requested extension OID in the CRL, and the critical flag for it. The extension OID will be stored as a string in the provided buffer. Use gnutls_x509_crl_get_extension_data() to extract the data.

If the buffer provided is not long enough to hold the output, then *sizeof_oid is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will be returned.

Since: 2.8.0

gnutls_x509_crl_get_extension_oid ()

int
gnutls_x509_crl_get_extension_oid (gnutls_x509_crl_t crl,
                                   unsigned  indx,
                                   void *oid,
                                   size_t *sizeof_oid);

This function will return the requested extension OID in the CRL. The extension OID will be stored as a string in the provided buffer.

Since: 2.8.0

gnutls_x509_crl_get_issuer_dn ()

int
gnutls_x509_crl_get_issuer_dn (gnutls_x509_crl_t crl,
                               char *buf,
                               size_t *sizeof_buf);

This function will copy the name of the CRL issuer in the provided buffer. The name will be in the form "C=xxxx,O=yyyy,CN=zzzz" as described in RFC4514. The output string will be ASCII or UTF-8 encoded, depending on the certificate data.

If buf is NULL then only the size will be filled.

This function does not output a fully RFC4514 compliant string, if that is required see gnutls_x509_crl_get_issuer_dn3().

gnutls_x509_crl_get_issuer_dn_by_oid ()

int
gnutls_x509_crl_get_issuer_dn_by_oid (gnutls_x509_crl_t crl,
                                      const char *oid,
                                      unsigned  indx,
                                      unsigned int raw_flag,
                                      void *buf,
                                      size_t *sizeof_buf);

This function will extract the part of the name of the CRL issuer specified by the given OID. The output will be encoded as described in RFC4514. The output string will be ASCII or UTF-8 encoded, depending on the certificate data.

Some helper macros with popular OIDs can be found in gnutls/x509.h If raw flag is (0), this function will only return known OIDs as text. Other OIDs will be DER encoded, as described in RFC4514 -- in hex format with a '#' prefix. You can check about known OIDs using gnutls_x509_dn_oid_known().

If buf is null then only the size will be filled.

gnutls_x509_crl_get_next_update ()

time_t
gnutls_x509_crl_get_next_update (gnutls_x509_crl_t crl);

This function will return the time the next CRL will be issued. This field is optional in a CRL so it might be normal to get an error instead.

gnutls_x509_crl_get_number ()

int
gnutls_x509_crl_get_number (gnutls_x509_crl_t crl,
                            void *ret,
                            size_t *ret_size,
                            unsigned int *critical);

This function will return the CRL number extension. This is obtained by the CRL Number extension field (2.5.29.20).

Since: 2.8.0

gnutls_x509_crl_get_raw_issuer_dn ()

int
gnutls_x509_crl_get_raw_issuer_dn (gnutls_x509_crl_t crl,
                                   gnutls_datum_t *dn);

This function will return a pointer to the DER encoded DN structure and the length.

Since: 2.12.0

gnutls_x509_crl_get_signature ()

int
gnutls_x509_crl_get_signature (gnutls_x509_crl_t crl,
                               char *sig,
                               size_t *sizeof_sig);

This function will extract the signature field of a CRL.

gnutls_x509_crl_get_signature_algorithm ()

int
gnutls_x509_crl_get_signature_algorithm
                               (gnutls_x509_crl_t crl);

This function will return a value of the gnutls_sign_algorithm_t enumeration that is the signature algorithm.

gnutls_x509_crl_get_this_update ()

time_t
gnutls_x509_crl_get_this_update (gnutls_x509_crl_t crl);

This function will return the time this CRL was issued.

gnutls_x509_crl_get_version ()

int
gnutls_x509_crl_get_version (gnutls_x509_crl_t crl);

This function will return the version of the specified CRL.

gnutls_x509_crl_import ()

int
gnutls_x509_crl_import (gnutls_x509_crl_t crl,
                        const gnutls_datum_t *data,
                        gnutls_x509_crt_fmt_t format);

This function will convert the given DER or PEM encoded CRL to the native gnutls_x509_crl_t format. The output will be stored in 'crl'.

If the CRL is PEM encoded it should have a header of "X509 CRL".

gnutls_x509_crl_init ()

int
gnutls_x509_crl_init (gnutls_x509_crl_t *crl);

This function will initialize a CRL structure. CRL stands for Certificate Revocation List. A revocation list usually contains lists of certificate serial numbers that have been revoked by an Authority. The revocation lists are always signed with the authority's private key.

gnutls_x509_crl_list_import ()

int
gnutls_x509_crl_list_import (gnutls_x509_crl_t *crls,
                             unsigned int *crl_max,
                             const gnutls_datum_t *data,
                             gnutls_x509_crt_fmt_t format,
                             unsigned int flags);

This function will convert the given PEM encoded CRL list to the native gnutls_x509_crl_t format. The output will be stored in crls . They will be automatically initialized.

If the Certificate is PEM encoded it should have a header of "X509 CRL".

Since: 3.0

gnutls_x509_crl_list_import2 ()

int
gnutls_x509_crl_list_import2 (gnutls_x509_crl_t **crls,
                              unsigned int *size,
                              const gnutls_datum_t *data,
                              gnutls_x509_crt_fmt_t format,
                              unsigned int flags);

This function will convert the given PEM encoded CRL list to the native gnutls_x509_crl_t format. The output will be stored in crls . They will be automatically initialized.

If the Certificate is PEM encoded it should have a header of "X509 CRL".

Since: 3.0

gnutls_x509_crl_print ()

int
gnutls_x509_crl_print (gnutls_x509_crl_t crl,
                       gnutls_certificate_print_formats_t format,
                       gnutls_datum_t *out);

This function will pretty print a X.509 certificate revocation list, suitable for display to a human.

The output out needs to be deallocated using gnutls_free().

gnutls_x509_crl_set_authority_key_id ()

int
gnutls_x509_crl_set_authority_key_id (gnutls_x509_crl_t crl,
                                      const void *id,
                                      size_t id_size);

This function will set the CRL's authority key ID extension. Only the keyIdentifier field can be set with this function. This may be used by an authority that holds multiple private keys, to distinguish the used key.

Since: 2.8.0

gnutls_x509_crl_set_crt ()

int
gnutls_x509_crl_set_crt (gnutls_x509_crl_t crl,
                         gnutls_x509_crt_t crt,
                         time_t revocation_time);

This function will set a revoked certificate's serial number to the CRL.

gnutls_x509_crl_set_crt_serial ()

int
gnutls_x509_crl_set_crt_serial (gnutls_x509_crl_t crl,
                                const void *serial,
                                size_t serial_size,
                                time_t revocation_time);

This function will set a revoked certificate's serial number to the CRL.

gnutls_x509_crl_set_next_update ()

int
gnutls_x509_crl_set_next_update (gnutls_x509_crl_t crl,
                                 time_t exp_time);

This function will set the time this CRL will be updated. This is an optional value to be set on a CRL and this call can be omitted when generating a CRL.

Prior to GnuTLS 3.5.7, setting a nextUpdate field was required in order to generate a CRL.

gnutls_x509_crl_set_number ()

int
gnutls_x509_crl_set_number (gnutls_x509_crl_t crl,
                            const void *nr,
                            size_t nr_size);

This function will set the CRL's number extension. This is to be used as a unique and monotonic number assigned to the CRL by the authority.

Since: 2.8.0

gnutls_x509_crl_set_this_update ()

int
gnutls_x509_crl_set_this_update (gnutls_x509_crl_t crl,
                                 time_t act_time);

This function will set the time this CRL was issued.

gnutls_x509_crl_set_version ()

int
gnutls_x509_crl_set_version (gnutls_x509_crl_t crl,
                             unsigned int version);

This function will set the version of the CRL. This must be one for CRL version 1, and so on. The CRLs generated by gnutls should have a version number of 2.

gnutls_x509_crl_sign2 ()

int
gnutls_x509_crl_sign2 (gnutls_x509_crl_t crl,
                       gnutls_x509_crt_t issuer,
                       gnutls_x509_privkey_t issuer_key,
                       gnutls_digest_algorithm_t dig,
                       unsigned int flags);

This function will sign the CRL with the issuer's private key, and will copy the issuer's information into the CRL.

This must be the last step in a certificate CRL since all the previously set parameters are now signed.

A known limitation of this function is, that a newly-signed CRL will not be fully functional (e.g., for signature verification), until it is exported an re-imported.

gnutls_x509_crl_verify ()

int
gnutls_x509_crl_verify (gnutls_x509_crl_t crl,
                        const gnutls_x509_crt_t *CA_list,
                        unsigned  CA_list_length,
                        unsigned int flags,
                        unsigned int *verify);

This function will try to verify the given crl and return its verification status. See gnutls_x509_crt_list_verify() for a detailed description of return values. Note that since GnuTLS 3.1.4 this function includes the time checks.

Note that value in verify is set only when the return value of this function is success (i.e, failure to trust a CRL a certificate does not imply a negative return value).

Before GnuTLS 3.5.7 this function would return zero or a positive number on success.

gnutls_x509_crq_deinit ()

void
gnutls_x509_crq_deinit (gnutls_x509_crq_t crq);

This function will deinitialize a PKCS10 certificate request structure.

gnutls_x509_crq_export ()

int
gnutls_x509_crq_export (gnutls_x509_crq_t crq,
                        gnutls_x509_crt_fmt_t format,
                        void *output_data,
                        size_t *output_data_size);

This function will export the certificate request to a PEM or DER encoded PKCS10 structure.

If the buffer provided is not long enough to hold the output, then GNUTLS_E_SHORT_MEMORY_BUFFER will be returned and *output_data_size will be updated.

If the structure is PEM encoded, it will have a header of "BEGIN NEW CERTIFICATE REQUEST".

gnutls_x509_crq_export2 ()

int
gnutls_x509_crq_export2 (gnutls_x509_crq_t crq,
                         gnutls_x509_crt_fmt_t format,
                         gnutls_datum_t *out);

This function will export the certificate request to a PEM or DER encoded PKCS10 structure.

The output buffer is allocated using gnutls_malloc().

If the structure is PEM encoded, it will have a header of "BEGIN NEW CERTIFICATE REQUEST".

gnutls_x509_crq_get_attribute_by_oid ()

int
gnutls_x509_crq_get_attribute_by_oid (gnutls_x509_crq_t crq,
                                      const char *oid,
                                      unsigned  indx,
                                      void *buf,
                                      size_t *sizeof_buf);

This function will return the attribute in the certificate request specified by the given Object ID. The attribute will be DER encoded.

Attributes in a certificate request is an optional set of data appended to the request. Their interpretation depends on the CA policy.

gnutls_x509_crq_get_attribute_data ()

int
gnutls_x509_crq_get_attribute_data (gnutls_x509_crq_t crq,
                                    unsigned  indx,
                                    void *data,
                                    size_t *sizeof_data);

This function will return the requested attribute data in the certificate request. The attribute data will be stored as a string in the provided buffer.

Use gnutls_x509_crq_get_attribute_info() to extract the OID. Use gnutls_x509_crq_get_attribute_by_oid() instead, if you want to get data indexed by the attribute OID rather than sequence.

Since: 2.8.0

gnutls_x509_crq_get_attribute_info ()

int
gnutls_x509_crq_get_attribute_info (gnutls_x509_crq_t crq,
                                    unsigned  indx,
                                    void *oid,
                                    size_t *sizeof_oid);

This function will return the requested attribute OID in the certificate, and the critical flag for it. The attribute OID will be stored as a string in the provided buffer. Use gnutls_x509_crq_get_attribute_data() to extract the data.

If the buffer provided is not long enough to hold the output, then *sizeof_oid is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will be returned.

Since: 2.8.0

gnutls_x509_crq_get_basic_constraints ()

int
gnutls_x509_crq_get_basic_constraints (gnutls_x509_crq_t crq,
                                       unsigned int *critical,
                                       unsigned int *ca,
                                       int *pathlen);

This function will read the certificate's basic constraints, and return the certificates CA status. It reads the basicConstraints X.509 extension (2.5.29.19).

Since: 2.8.0

gnutls_x509_crq_get_challenge_password ()

int
gnutls_x509_crq_get_challenge_password
                               (gnutls_x509_crq_t crq,
                                char *pass,
                                size_t *sizeof_pass);

This function will return the challenge password in the request. The challenge password is intended to be used for requesting a revocation of the certificate.

gnutls_x509_crq_get_dn ()

int
gnutls_x509_crq_get_dn (gnutls_x509_crq_t crq,
                        char *buf,
                        size_t *sizeof_buf);

This function will copy the name of the Certificate request subject to the provided buffer. The name will be in the form "C=xxxx,O=yyyy,CN=zzzz" as described in RFC 2253. The output string buf will be ASCII or UTF-8 encoded, depending on the certificate data.

This function does not output a fully RFC4514 compliant string, if that is required see gnutls_x509_crq_get_dn3().

gnutls_x509_crq_get_dn_by_oid ()

int
gnutls_x509_crq_get_dn_by_oid (gnutls_x509_crq_t crq,
                               const char *oid,
                               unsigned  indx,
                               unsigned int raw_flag,
                               void *buf,
                               size_t *sizeof_buf);

This function will extract the part of the name of the Certificate request subject, specified by the given OID. The output will be encoded as described in RFC2253. The output string will be ASCII or UTF-8 encoded, depending on the certificate data.

Some helper macros with popular OIDs can be found in gnutls/x509.h If raw flag is (0), this function will only return known OIDs as text. Other OIDs will be DER encoded, as described in RFC2253 -- in hex format with a '#' prefix. You can check about known OIDs using gnutls_x509_dn_oid_known().

gnutls_x509_crq_get_dn_oid ()

int
gnutls_x509_crq_get_dn_oid (gnutls_x509_crq_t crq,
                            unsigned  indx,
                            void *oid,
                            size_t *sizeof_oid);

This function will extract the requested OID of the name of the certificate request subject, specified by the given index.

gnutls_x509_crq_get_extension_by_oid ()

int
gnutls_x509_crq_get_extension_by_oid (gnutls_x509_crq_t crq,
                                      const char *oid,
                                      unsigned  indx,
                                      void *buf,
                                      size_t *sizeof_buf,
                                      unsigned int *critical);

This function will return the extension specified by the OID in the certificate. The extensions will be returned as binary data DER encoded, in the provided buffer.

Since: 2.8.0

gnutls_x509_crq_get_extension_data ()

int
gnutls_x509_crq_get_extension_data (gnutls_x509_crq_t crq,
                                    unsigned  indx,
                                    void *data,
                                    size_t *sizeof_data);

This function will return the requested extension data in the certificate. The extension data will be stored as a string in the provided buffer.

Use gnutls_x509_crq_get_extension_info() to extract the OID and critical flag. Use gnutls_x509_crq_get_extension_by_oid() instead, if you want to get data indexed by the extension OID rather than sequence.

Since: 2.8.0

gnutls_x509_crq_get_extension_info ()

int
gnutls_x509_crq_get_extension_info (gnutls_x509_crq_t crq,
                                    unsigned  indx,
                                    void *oid,
                                    size_t *sizeof_oid,
                                    unsigned int *critical);

This function will return the requested extension OID in the certificate, and the critical flag for it. The extension OID will be stored as a string in the provided buffer. Use gnutls_x509_crq_get_extension_data() to extract the data.

If the buffer provided is not long enough to hold the output, then *sizeof_oid is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will be returned.

Since: 2.8.0

gnutls_x509_crq_get_key_id ()

int
gnutls_x509_crq_get_key_id (gnutls_x509_crq_t crq,
                            unsigned int flags,
                            unsigned char *output_data,
                            size_t *output_data_size);

This function will return a unique ID that depends on the public key parameters. This ID can be used in checking whether a certificate corresponds to the given private key.

If the buffer provided is not long enough to hold the output, then *output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will be returned. The output will normally be a SHA-1 hash output, which is 20 bytes.

Since: 2.8.0

gnutls_x509_crq_get_key_purpose_oid ()

int
gnutls_x509_crq_get_key_purpose_oid (gnutls_x509_crq_t crq,
                                     unsigned  indx,
                                     void *oid,
                                     size_t *sizeof_oid,
                                     unsigned int *critical);

This function will extract the key purpose OIDs of the Certificate specified by the given index. These are stored in the Extended Key Usage extension (2.5.29.37). See the GNUTLS_KP_* definitions for human readable names.

Since: 2.8.0

gnutls_x509_crq_get_key_rsa_raw ()

int
gnutls_x509_crq_get_key_rsa_raw (gnutls_x509_crq_t crq,
                                 gnutls_datum_t *m,
                                 gnutls_datum_t *e);

This function will export the RSA public key's parameters found in the given structure. The new parameters will be allocated using gnutls_malloc() and will be stored in the appropriate datum.

Since: 2.8.0

gnutls_x509_crq_get_key_usage ()

int
gnutls_x509_crq_get_key_usage (gnutls_x509_crq_t crq,
                               unsigned int *key_usage,
                               unsigned int *critical);

This function will return certificate's key usage, by reading the keyUsage X.509 extension (2.5.29.15). The key usage value will ORed values of the: GNUTLS_KEY_DIGITAL_SIGNATURE, GNUTLS_KEY_NON_REPUDIATION, GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DATA_ENCIPHERMENT, GNUTLS_KEY_KEY_AGREEMENT, GNUTLS_KEY_KEY_CERT_SIGN, GNUTLS_KEY_CRL_SIGN, GNUTLS_KEY_ENCIPHER_ONLY, GNUTLS_KEY_DECIPHER_ONLY.

Since: 2.8.0

gnutls_x509_crq_get_pk_algorithm ()

int
gnutls_x509_crq_get_pk_algorithm (gnutls_x509_crq_t crq,
                                  unsigned int *bits);

This function will return the public key algorithm of a PKCS10 certificate request.

If bits is non-NULL, it should have enough size to hold the parameters size in bits. For RSA the bits returned is the modulus. For DSA the bits returned are of the public exponent.

gnutls_x509_crq_get_private_key_usage_period ()

int
gnutls_x509_crq_get_private_key_usage_period
                               (gnutls_x509_crq_t cert,
                                time_t *activation,
                                time_t *expiration,
                                unsigned int *critical);

This function will return the expiration and activation times of the private key of the certificate.

gnutls_x509_crq_get_subject_alt_name ()

int
gnutls_x509_crq_get_subject_alt_name (gnutls_x509_crq_t crq,
                                      unsigned int seq,
                                      void *ret,
                                      size_t *ret_size,
                                      unsigned int *ret_type,
                                      unsigned int *critical);

This function will return the alternative names, contained in the given certificate. It is the same as gnutls_x509_crq_get_subject_alt_name() except for the fact that it will return the type of the alternative name in ret_type even if the function fails for some reason (i.e. the buffer provided is not enough).

Since: 2.8.0

gnutls_x509_crq_get_subject_alt_othername_oid ()

int
gnutls_x509_crq_get_subject_alt_othername_oid
                               (gnutls_x509_crq_t crq,
                                unsigned int seq,
                                void *ret,
                                size_t *ret_size);

This function will extract the type OID of an otherName Subject Alternative Name, contained in the given certificate, and return the type as an enumerated element.

This function is only useful if gnutls_x509_crq_get_subject_alt_name() returned GNUTLS_SAN_OTHERNAME.

Since: 2.8.0

gnutls_x509_crq_get_version ()

int
gnutls_x509_crq_get_version (gnutls_x509_crq_t crq);

This function will return the version of the specified Certificate request.

gnutls_x509_crq_import ()

int
gnutls_x509_crq_import (gnutls_x509_crq_t crq,
                        const gnutls_datum_t *data,
                        gnutls_x509_crt_fmt_t format);

This function will convert the given DER or PEM encoded certificate request to a gnutls_x509_crq_t type. The output will be stored in crq .

If the Certificate is PEM encoded it should have a header of "NEW CERTIFICATE REQUEST".

gnutls_x509_crq_init ()

int
gnutls_x509_crq_init (gnutls_x509_crq_t *crq);

This function will initialize a PKCS10 certificate request structure.

gnutls_x509_crq_print ()

int
gnutls_x509_crq_print (gnutls_x509_crq_t crq,
                       gnutls_certificate_print_formats_t format,
                       gnutls_datum_t *out);

This function will pretty print a certificate request, suitable for display to a human.

The output out needs to be deallocated using gnutls_free().

Since: 2.8.0

gnutls_x509_crq_set_attribute_by_oid ()

int
gnutls_x509_crq_set_attribute_by_oid (gnutls_x509_crq_t crq,
                                      const char *oid,
                                      void *buf,
                                      size_t sizeof_buf);

This function will set the attribute in the certificate request specified by the given Object ID. The provided attribute must be be DER encoded.

Attributes in a certificate request is an optional set of data appended to the request. Their interpretation depends on the CA policy.

gnutls_x509_crq_set_basic_constraints ()

int
gnutls_x509_crq_set_basic_constraints (gnutls_x509_crq_t crq,
                                       unsigned int ca,
                                       int pathLenConstraint);

This function will set the basicConstraints certificate extension.

Since: 2.8.0

gnutls_x509_crq_set_challenge_password ()

int
gnutls_x509_crq_set_challenge_password
                               (gnutls_x509_crq_t crq,
                                const char *pass);

This function will set a challenge password to be used when revoking the request.

gnutls_x509_crq_set_dn_by_oid ()

int
gnutls_x509_crq_set_dn_by_oid (gnutls_x509_crq_t crq,
                               const char *oid,
                               unsigned int raw_flag,
                               const void *data,
                               unsigned int sizeof_data);

This function will set the part of the name of the Certificate request subject, specified by the given OID. The input string should be ASCII or UTF-8 encoded.

Some helper macros with popular OIDs can be found in gnutls/x509.h With this function you can only set the known OIDs. You can test for known OIDs using gnutls_x509_dn_oid_known(). For OIDs that are not known (by gnutls) you should properly DER encode your data, and call this function with raw_flag set.

gnutls_x509_crq_set_key ()

int
gnutls_x509_crq_set_key (gnutls_x509_crq_t crq,
                         gnutls_x509_privkey_t key);

This function will set the public parameters from the given private key to the request.

gnutls_x509_crq_set_key_purpose_oid ()

int
gnutls_x509_crq_set_key_purpose_oid (gnutls_x509_crq_t crq,
                                     const void *oid,
                                     unsigned int critical);

This function will set the key purpose OIDs of the Certificate. These are stored in the Extended Key Usage extension (2.5.29.37) See the GNUTLS_KP_* definitions for human readable names.

Subsequent calls to this function will append OIDs to the OID list.

Since: 2.8.0

gnutls_x509_crq_set_key_rsa_raw ()

int
gnutls_x509_crq_set_key_rsa_raw (gnutls_x509_crq_t crq,
                                 const gnutls_datum_t *m,
                                 const gnutls_datum_t *e);

This function will set the public parameters from the given private key to the request. Only RSA keys are currently supported.

Since: 2.6.0

gnutls_x509_crq_set_key_usage ()

int
gnutls_x509_crq_set_key_usage (gnutls_x509_crq_t crq,
                               unsigned int usage);

This function will set the keyUsage certificate extension.

Since: 2.8.0

gnutls_x509_crq_set_private_key_usage_period ()

int
gnutls_x509_crq_set_private_key_usage_period
                               (gnutls_x509_crq_t crq,
                                time_t activation,
                                time_t expiration);

This function will set the private key usage period extension (2.5.29.16).

gnutls_x509_crq_set_subject_alt_name ()

int
gnutls_x509_crq_set_subject_alt_name (gnutls_x509_crq_t crq,
                                      gnutls_x509_subject_alt_name_t nt,
                                      const void *data,
                                      unsigned int data_size,
                                      unsigned int flags);

This function will set the subject alternative name certificate extension. It can set the following types:

GNUTLS_SAN_DNSNAME: as a text string

GNUTLS_SAN_RFC822NAME: as a text string

GNUTLS_SAN_URI: as a text string

GNUTLS_SAN_IPADDRESS: as a binary IP address (4 or 16 bytes)

GNUTLS_SAN_OTHERNAME_XMPP: as a UTF8 string

Since version 3.5.7 the GNUTLS_SAN_RFC822NAME, GNUTLS_SAN_DNSNAME, and GNUTLS_SAN_OTHERNAME_XMPP are converted to ACE format when necessary.

Since: 2.8.0

gnutls_x509_crq_set_version ()

int
gnutls_x509_crq_set_version (gnutls_x509_crq_t crq,
                             unsigned int version);

This function will set the version of the certificate request. For version 1 requests this must be one.

gnutls_x509_crq_sign2 ()

int
gnutls_x509_crq_sign2 (gnutls_x509_crq_t crq,
                       gnutls_x509_privkey_t key,
                       gnutls_digest_algorithm_t dig,
                       unsigned int flags);

This function will sign the certificate request with a private key. This must be the same key as the one used in gnutls_x509_crt_set_key() since a certificate request is self signed.

This must be the last step in a certificate request generation since all the previously set parameters are now signed.

gnutls_x509_crq_verify ()

int
gnutls_x509_crq_verify (gnutls_x509_crq_t crq,
                        unsigned int flags);

This function will verify self signature in the certificate request and return its status.

gnutls_x509_crt_check_hostname ()

unsigned
gnutls_x509_crt_check_hostname (gnutls_x509_crt_t cert,
                                const char *hostname);

This function will check if the given certificate's subject matches the given hostname. This is a basic implementation of the matching described in RFC6125, and takes into account wildcards, and the DNSName/IPAddress subject alternative name PKIX extension.

For details see also gnutls_x509_crt_check_hostname2().

gnutls_x509_crt_check_issuer ()

unsigned
gnutls_x509_crt_check_issuer (gnutls_x509_crt_t cert,
                              gnutls_x509_crt_t issuer);

This function will check if the given certificate was issued by the given issuer. It checks the DN fields and the authority key identifier and subject key identifier fields match.

If the same certificate is provided at the cert and issuer fields, it will check whether the certificate is self-signed.

gnutls_x509_crt_check_revocation ()

int
gnutls_x509_crt_check_revocation (gnutls_x509_crt_t cert,
                                  const gnutls_x509_crl_t *crl_list,
                                  unsigned  crl_list_length);

This function will check if the given certificate is revoked. It is assumed that the CRLs have been verified before.

gnutls_x509_crt_cpy_crl_dist_points ()

int
gnutls_x509_crt_cpy_crl_dist_points (gnutls_x509_crt_t dst,
                                     gnutls_x509_crt_t src);

This function will copy the CRL distribution points certificate extension, from the source to the destination certificate. This may be useful to copy from a CA certificate to issued ones.

gnutls_x509_crt_deinit ()

void
gnutls_x509_crt_deinit (gnutls_x509_crt_t cert);

This function will deinitialize a certificate structure.

gnutls_x509_crt_export ()

int
gnutls_x509_crt_export (gnutls_x509_crt_t cert,
                        gnutls_x509_crt_fmt_t format,
                        void *output_data,
                        size_t *output_data_size);

This function will export the certificate to DER or PEM format.

If the buffer provided is not long enough to hold the output, then *output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will be returned.

If the structure is PEM encoded, it will have a header of "BEGIN CERTIFICATE".

gnutls_x509_crt_export2 ()

int
gnutls_x509_crt_export2 (gnutls_x509_crt_t cert,
                         gnutls_x509_crt_fmt_t format,
                         gnutls_datum_t *out);

This function will export the certificate to DER or PEM format. The output buffer is allocated using gnutls_malloc().

If the structure is PEM encoded, it will have a header of "BEGIN CERTIFICATE".

Since: 3.1.3

gnutls_x509_crt_get_activation_time ()

time_t
gnutls_x509_crt_get_activation_time (gnutls_x509_crt_t cert);

This function will return the time this Certificate was or will be activated.

gnutls_x509_crt_get_authority_info_access ()

int
gnutls_x509_crt_get_authority_info_access
                               (gnutls_x509_crt_t crt,
                                unsigned int seq,
                                int what,
                                gnutls_datum_t *data,
                                unsigned int *critical);

Note that a simpler API to access the authority info data is provided by gnutls_x509_aia_get() and gnutls_x509_ext_import_aia().

This function extracts the Authority Information Access (AIA) extension, see RFC 5280 section 4.2.2.1 for more information. The AIA extension holds a sequence of AccessDescription (AD) data.

The seq input parameter is used to indicate which member of the sequence the caller is interested in. The first member is 0, the second member 1 and so on. When the seq value is out of bounds, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE is returned.

The type of data returned in data is specified via what which should be gnutls_info_access_what_t values.

If what is GNUTLS_IA_ACCESSMETHOD_OID then data will hold the accessMethod OID (e.g., "1.3.6.1.5.5.7.48.1").

If what is GNUTLS_IA_ACCESSLOCATION_GENERALNAME_TYPE, data will hold the accessLocation GeneralName type (e.g., "uniformResourceIdentifier").

If what is GNUTLS_IA_URI, data will hold the accessLocation URI data. Requesting this what value leads to an error if the accessLocation is not of the "uniformResourceIdentifier" type.

If what is GNUTLS_IA_OCSP_URI, data will hold the OCSP URI. Requesting this what value leads to an error if the accessMethod is not 1.3.6.1.5.5.7.48.1 aka OCSP, or if accessLocation is not of the "uniformResourceIdentifier" type. In that case GNUTLS_E_UNKNOWN_ALGORITHM will be returned, and seq should be increased and this function called again.

If what is GNUTLS_IA_CAISSUERS_URI, data will hold the caIssuers URI. Requesting this what value leads to an error if the accessMethod is not 1.3.6.1.5.5.7.48.2 aka caIssuers, or if accessLocation is not of the "uniformResourceIdentifier" type. In that case handle as in GNUTLS_IA_OCSP_URI.

More what values may be allocated in the future as needed.

If data is NULL, the function does the same without storing the output data, that is, it will set critical and do error checking as usual.

The value of the critical flag is returned in *critical . Supply a NULL critical if you want the function to make sure the extension is non-critical, as required by RFC 5280.

Since: 3.0

gnutls_x509_crt_get_authority_key_gn_serial ()

int
gnutls_x509_crt_get_authority_key_gn_serial
                               (gnutls_x509_crt_t cert,
                                unsigned int seq,
                                void *alt,
                                size_t *alt_size,
                                unsigned int *alt_type,
                                void *serial,
                                size_t *serial_size,
                                unsigned int *critical);

This function will return the X.509 authority key identifier when stored as a general name (authorityCertIssuer) and serial number.

Because more than one general names might be stored seq can be used as a counter to request them all until GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE is returned.

Since: 3.0

gnutls_x509_crt_get_authority_key_id ()

int
gnutls_x509_crt_get_authority_key_id (gnutls_x509_crt_t cert,
                                      void *id,
                                      size_t *id_size,
                                      unsigned int *critical);

This function will return the X.509v3 certificate authority's key identifier. This is obtained by the X.509 Authority Key identifier extension field (2.5.29.35). Note that this function only returns the keyIdentifier field of the extension and GNUTLS_E_X509_UNSUPPORTED_EXTENSION, if the extension contains the name and serial number of the certificate. In that case gnutls_x509_crt_get_authority_key_gn_serial() may be used.

gnutls_x509_crt_get_basic_constraints ()

int
gnutls_x509_crt_get_basic_constraints (gnutls_x509_crt_t cert,
                                       unsigned int *critical,
                                       unsigned int *ca,
                                       int *pathlen);

This function will read the certificate's basic constraints, and return the certificates CA status. It reads the basicConstraints X.509 extension (2.5.29.19).

gnutls_x509_crt_get_ca_status ()

int
gnutls_x509_crt_get_ca_status (gnutls_x509_crt_t cert,
                               unsigned int *critical);

This function will return certificates CA status, by reading the basicConstraints X.509 extension (2.5.29.19). If the certificate is a CA a positive value will be returned, or (0) if the certificate does not have CA flag set.

Use gnutls_x509_crt_get_basic_constraints() if you want to read the pathLenConstraint field too.

gnutls_x509_crt_get_crl_dist_points ()

int
gnutls_x509_crt_get_crl_dist_points (gnutls_x509_crt_t cert,
                                     unsigned int seq,
                                     void *ret,
                                     size_t *ret_size,
                                     unsigned int *reason_flags,
                                     unsigned int *critical);

This function retrieves the CRL distribution points (2.5.29.31), contained in the given certificate in the X509v3 Certificate Extensions.

gnutls_x509_crt_get_dn ()

int
gnutls_x509_crt_get_dn (gnutls_x509_crt_t cert,
                        char *buf,
                        size_t *buf_size);

This function will copy the name of the Certificate in the provided buffer. The name will be in the form "C=xxxx,O=yyyy,CN=zzzz" as described in RFC4514. The output string will be ASCII or UTF-8 encoded, depending on the certificate data.

If buf is null then only the size will be filled.

This function does not output a fully RFC4514 compliant string, if that is required see gnutls_x509_crt_get_dn3().

gnutls_x509_crt_get_dn_by_oid ()

int
gnutls_x509_crt_get_dn_by_oid (gnutls_x509_crt_t cert,
                               const char *oid,
                               unsigned  indx,
                               unsigned int raw_flag,
                               void *buf,
                               size_t *buf_size);

This function will extract the part of the name of the Certificate subject specified by the given OID. The output, if the raw flag is not used, will be encoded as described in RFC4514. Thus a string that is ASCII or UTF-8 encoded, depending on the certificate data.

Some helper macros with popular OIDs can be found in gnutls/x509.h If raw flag is (0), this function will only return known OIDs as text. Other OIDs will be DER encoded, as described in RFC4514 -- in hex format with a '#' prefix. You can check about known OIDs using gnutls_x509_dn_oid_known().

If buf is null then only the size will be filled. If the raw_flag is not specified the output is always null terminated, although the buf_size will not include the null character.

gnutls_x509_crt_get_dn_oid ()

int
gnutls_x509_crt_get_dn_oid (gnutls_x509_crt_t cert,
                            unsigned  indx,
                            void *oid,
                            size_t *oid_size);

This function will extract the OIDs of the name of the Certificate subject specified by the given index.

If oid is null then only the size will be filled. The oid returned will be null terminated, although oid_size will not account for the trailing null.

gnutls_x509_crt_get_expiration_time ()

time_t
gnutls_x509_crt_get_expiration_time (gnutls_x509_crt_t cert);

This function will return the time this Certificate was or will be expired.

The no well defined expiration time can be checked against with the GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION macro.

gnutls_x509_crt_get_extension_by_oid ()

int
gnutls_x509_crt_get_extension_by_oid (gnutls_x509_crt_t cert,
                                      const char *oid,
                                      unsigned  indx,
                                      void *buf,
                                      size_t *buf_size,
                                      unsigned int *critical);

This function will return the extension specified by the OID in the certificate. The extensions will be returned as binary data DER encoded, in the provided buffer.

gnutls_x509_crt_get_extension_data ()

int
gnutls_x509_crt_get_extension_data (gnutls_x509_crt_t cert,
                                    unsigned  indx,
                                    void *data,
                                    size_t *sizeof_data);

This function will return the requested extension data in the certificate. The extension data will be stored in the provided buffer.

Use gnutls_x509_crt_get_extension_info() to extract the OID and critical flag. Use gnutls_x509_crt_get_extension_by_oid() instead, if you want to get data indexed by the extension OID rather than sequence.

gnutls_x509_crt_get_extension_info ()

int
gnutls_x509_crt_get_extension_info (gnutls_x509_crt_t cert,
                                    unsigned  indx,
                                    void *oid,
                                    size_t *oid_size,
                                    unsigned int *critical);

This function will return the requested extension OID in the certificate, and the critical flag for it. The extension OID will be stored as a string in the provided buffer. Use gnutls_x509_crt_get_extension() to extract the data.

If the buffer provided is not long enough to hold the output, then oid_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will be returned. The oid returned will be null terminated, although oid_size will not account for the trailing null.