]>
Commit | Line | Data |
---|---|---|
7960dbec DDO |
1 | =pod |
2 | ||
3 | =head1 NAME | |
4 | ||
5 | OSSL_CMP_CTX_new, | |
6 | OSSL_CMP_CTX_free, | |
7 | OSSL_CMP_CTX_reinit, | |
8 | OSSL_CMP_CTX_set_option, | |
9 | OSSL_CMP_CTX_get_option, | |
10 | OSSL_CMP_CTX_set_log_cb, | |
11 | OSSL_CMP_CTX_set_log_verbosity, | |
12 | OSSL_CMP_CTX_print_errors, | |
13 | OSSL_CMP_CTX_set1_serverPath, | |
14 | OSSL_CMP_CTX_set1_serverName, | |
15 | OSSL_CMP_CTX_set_serverPort, | |
16 | OSSL_CMP_CTX_set1_proxyName, | |
17 | OSSL_CMP_CTX_set_proxyPort, | |
18 | OSSL_CMP_DEFAULT_PORT, | |
19 | OSSL_CMP_CTX_set_http_cb, | |
20 | OSSL_CMP_CTX_set_http_cb_arg, | |
21 | OSSL_CMP_CTX_get_http_cb_arg, | |
1f9bfd89 | 22 | OSSL_cmp_transfer_cb_t, |
7960dbec DDO |
23 | OSSL_CMP_CTX_set_transfer_cb, |
24 | OSSL_CMP_CTX_set_transfer_cb_arg, | |
25 | OSSL_CMP_CTX_get_transfer_cb_arg, | |
26 | OSSL_CMP_CTX_set1_srvCert, | |
27 | OSSL_CMP_CTX_set1_expected_sender, | |
28 | OSSL_CMP_CTX_set0_trustedStore, | |
29 | OSSL_CMP_CTX_get0_trustedStore, | |
30 | OSSL_CMP_CTX_set1_untrusted_certs, | |
31 | OSSL_CMP_CTX_get0_untrusted_certs, | |
32 | OSSL_CMP_CTX_set1_clCert, | |
33 | OSSL_CMP_CTX_set1_pkey, | |
34 | OSSL_CMP_CTX_set1_referenceValue, | |
35 | OSSL_CMP_CTX_set1_secretValue, | |
36 | OSSL_CMP_CTX_set1_recipient, | |
37 | OSSL_CMP_CTX_push0_geninfo_ITAV, | |
38 | OSSL_CMP_CTX_set1_extraCertsOut, | |
39 | OSSL_CMP_CTX_set0_newPkey, | |
40 | OSSL_CMP_CTX_get0_newPkey, | |
41 | OSSL_CMP_CTX_set1_issuer, | |
42 | OSSL_CMP_CTX_set1_subjectName, | |
43 | OSSL_CMP_CTX_push1_subjectAltName, | |
44 | OSSL_CMP_CTX_set0_reqExtensions, | |
45 | OSSL_CMP_CTX_reqExtensions_have_SAN, | |
46 | OSSL_CMP_CTX_push0_policy, | |
47 | OSSL_CMP_CTX_set1_oldCert, | |
48 | OSSL_CMP_CTX_set1_p10CSR, | |
49 | OSSL_CMP_CTX_push0_genm_ITAV, | |
1f9bfd89 | 50 | OSSL_cmp_certConf_cb_t, |
7960dbec DDO |
51 | OSSL_CMP_CTX_set_certConf_cb, |
52 | OSSL_CMP_CTX_set_certConf_cb_arg, | |
53 | OSSL_CMP_CTX_get_certConf_cb_arg, | |
54 | OSSL_CMP_CTX_get_status, | |
55 | OSSL_CMP_CTX_get0_statusString, | |
56 | OSSL_CMP_CTX_get_failInfoCode, | |
57 | OSSL_CMP_CTX_get0_newCert, | |
58 | OSSL_CMP_CTX_get1_caPubs, | |
59 | OSSL_CMP_CTX_get1_extraCertsIn, | |
60 | OSSL_CMP_CTX_set1_transactionID, | |
61 | OSSL_CMP_CTX_set1_senderNonce | |
62 | - functions for managing the CMP client context data structure | |
63 | ||
64 | =head1 SYNOPSIS | |
65 | ||
66 | #include <openssl/cmp.h> | |
67 | ||
68 | OSSL_CMP_CTX *OSSL_CMP_CTX_new(void); | |
69 | void OSSL_CMP_CTX_free(OSSL_CMP_CTX *ctx); | |
70 | int OSSL_CMP_CTX_reinit(OSSL_CMP_CTX *ctx); | |
71 | int OSSL_CMP_CTX_set_option(OSSL_CMP_CTX *ctx, int opt, int val); | |
72 | int OSSL_CMP_CTX_get_option(const OSSL_CMP_CTX *ctx, int opt); | |
73 | ||
74 | /* logging and error reporting: */ | |
75 | int OSSL_CMP_CTX_set_log_cb(OSSL_CMP_CTX *ctx, OSSL_cmp_log_cb_t cb); | |
76 | #define OSSL_CMP_CTX_set_log_verbosity(ctx, level) | |
77 | void OSSL_CMP_CTX_print_errors(OSSL_CMP_CTX *ctx); | |
78 | ||
79 | /* message transfer: */ | |
80 | int OSSL_CMP_CTX_set1_serverPath(OSSL_CMP_CTX *ctx, const char *path); | |
81 | int OSSL_CMP_CTX_set1_serverName(OSSL_CMP_CTX *ctx, const char *name); | |
82 | int OSSL_CMP_CTX_set_serverPort(OSSL_CMP_CTX *ctx, int port); | |
83 | int OSSL_CMP_CTX_set1_proxyName(OSSL_CMP_CTX *ctx, const char *name); | |
84 | int OSSL_CMP_CTX_set_proxyPort(OSSL_CMP_CTX *ctx, int port); | |
85 | #define OSSL_CMP_DEFAULT_PORT 80 | |
29f178bd | 86 | int OSSL_CMP_CTX_set_http_cb(OSSL_CMP_CTX *ctx, HTTP_bio_cb_t cb); |
7960dbec DDO |
87 | int OSSL_CMP_CTX_set_http_cb_arg(OSSL_CMP_CTX *ctx, void *arg); |
88 | void *OSSL_CMP_CTX_get_http_cb_arg(const OSSL_CMP_CTX *ctx); | |
29f178bd DDO |
89 | typedef OSSL_CMP_MSG *(*OSSL_cmp_transfer_cb_t)(OSSL_CMP_CTX *ctx, |
90 | const OSSL_CMP_MSG *req); | |
7960dbec DDO |
91 | int OSSL_CMP_CTX_set_transfer_cb(OSSL_CMP_CTX *ctx, |
92 | OSSL_cmp_transfer_cb_t cb); | |
93 | int OSSL_CMP_CTX_set_transfer_cb_arg(OSSL_CMP_CTX *ctx, void *arg); | |
94 | void *OSSL_CMP_CTX_get_transfer_cb_arg(const OSSL_CMP_CTX *ctx); | |
95 | ||
96 | /* server authentication: */ | |
97 | int OSSL_CMP_CTX_set1_srvCert(OSSL_CMP_CTX *ctx, X509 *cert); | |
98 | int OSSL_CMP_CTX_set1_expected_sender(OSSL_CMP_CTX *ctx, | |
99 | const X509_NAME *name); | |
100 | int OSSL_CMP_CTX_set0_trustedStore(OSSL_CMP_CTX *ctx, X509_STORE *store); | |
101 | X509_STORE *OSSL_CMP_CTX_get0_trustedStore(const OSSL_CMP_CTX *ctx); | |
102 | int OSSL_CMP_CTX_set1_untrusted_certs(OSSL_CMP_CTX *ctx, | |
103 | STACK_OF(X509) *certs); | |
104 | STACK_OF(X509) *OSSL_CMP_CTX_get0_untrusted_certs(const OSSL_CMP_CTX *ctx); | |
105 | ||
106 | /* client authentication: */ | |
107 | int OSSL_CMP_CTX_set1_clCert(OSSL_CMP_CTX *ctx, X509 *cert); | |
108 | int OSSL_CMP_CTX_set1_pkey(OSSL_CMP_CTX *ctx, EVP_PKEY *pkey); | |
109 | int OSSL_CMP_CTX_set1_referenceValue(OSSL_CMP_CTX *ctx, | |
110 | const unsigned char *ref, int len); | |
111 | int OSSL_CMP_CTX_set1_secretValue(OSSL_CMP_CTX *ctx, const unsigned char *sec, | |
112 | const int len); | |
113 | ||
114 | /* CMP message header and extra certificates: */ | |
115 | int OSSL_CMP_CTX_set1_recipient(OSSL_CMP_CTX *ctx, const X509_NAME *name); | |
116 | int OSSL_CMP_CTX_push0_geninfo_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav); | |
117 | int OSSL_CMP_CTX_set1_extraCertsOut(OSSL_CMP_CTX *ctx, | |
118 | STACK_OF(X509) *extraCertsOut); | |
119 | ||
120 | /* certificate template: */ | |
121 | int OSSL_CMP_CTX_set0_newPkey(OSSL_CMP_CTX *ctx, int priv, EVP_PKEY *pkey); | |
122 | EVP_PKEY *OSSL_CMP_CTX_get0_newPkey(const OSSL_CMP_CTX *ctx, int priv); | |
123 | int OSSL_CMP_CTX_set1_issuer(OSSL_CMP_CTX *ctx, const X509_NAME *name); | |
124 | int OSSL_CMP_CTX_set1_subjectName(OSSL_CMP_CTX *ctx, const X509_NAME *name); | |
125 | int OSSL_CMP_CTX_push1_subjectAltName(OSSL_CMP_CTX *ctx, | |
126 | const GENERAL_NAME *name); | |
127 | int OSSL_CMP_CTX_set0_reqExtensions(OSSL_CMP_CTX *ctx, X509_EXTENSIONS *exts); | |
128 | int OSSL_CMP_CTX_reqExtensions_have_SAN(OSSL_CMP_CTX *ctx); | |
129 | int OSSL_CMP_CTX_push0_policy(OSSL_CMP_CTX *ctx, POLICYINFO *pinfo); | |
130 | int OSSL_CMP_CTX_set1_oldCert(OSSL_CMP_CTX *ctx, X509 *cert); | |
131 | int OSSL_CMP_CTX_set1_p10CSR(OSSL_CMP_CTX *ctx, const X509_REQ *csr); | |
132 | ||
133 | /* misc body contents: */ | |
134 | int OSSL_CMP_CTX_push0_genm_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav); | |
135 | ||
136 | /* certificate confirmation: */ | |
652fba9e DDO |
137 | typedef int (*OSSL_cmp_certConf_cb_t)(OSSL_CMP_CTX *ctx, X509 *cert, |
138 | int fail_info, const char **txt); | |
7960dbec DDO |
139 | int OSSL_CMP_CTX_set_certConf_cb(OSSL_CMP_CTX *ctx, OSSL_cmp_certConf_cb_t cb); |
140 | int OSSL_CMP_CTX_set_certConf_cb_arg(OSSL_CMP_CTX *ctx, void *arg); | |
141 | void *OSSL_CMP_CTX_get_certConf_cb_arg(const OSSL_CMP_CTX *ctx); | |
142 | ||
143 | /* result fetching: */ | |
144 | int OSSL_CMP_CTX_get_status(const OSSL_CMP_CTX *ctx); | |
145 | OSSL_CMP_PKIFREETEXT *OSSL_CMP_CTX_get0_statusString(const OSSL_CMP_CTX *ctx); | |
146 | int OSSL_CMP_CTX_get_failInfoCode(const OSSL_CMP_CTX *ctx); | |
147 | ||
148 | X509 *OSSL_CMP_CTX_get0_newCert(const OSSL_CMP_CTX *ctx); | |
149 | STACK_OF(X509) *OSSL_CMP_CTX_get1_caPubs(const OSSL_CMP_CTX *ctx); | |
150 | STACK_OF(X509) *OSSL_CMP_CTX_get1_extraCertsIn(const OSSL_CMP_CTX *ctx); | |
151 | ||
152 | /* for test purposes only: */ | |
153 | int OSSL_CMP_CTX_set1_transactionID(OSSL_CMP_CTX *ctx, | |
154 | const ASN1_OCTET_STRING *id); | |
155 | int OSSL_CMP_CTX_set1_senderNonce(OSSL_CMP_CTX *ctx, | |
156 | const ASN1_OCTET_STRING *nonce); | |
157 | ||
158 | =head1 DESCRIPTION | |
159 | ||
160 | This is the context API for using CMP (Certificate Management Protocol) with | |
161 | OpenSSL. | |
162 | ||
163 | OSSL_CMP_CTX_new() allocates and initializes an OSSL_CMP_CTX structure to | |
164 | default values, e.g., proof-of-possession method is set to POPOSigningKey. | |
165 | ||
166 | OSSL_CMP_CTX_free() deallocates an OSSL_CMP_CTX structure. | |
167 | ||
168 | OSSL_CMP_CTX_reinit() prepares the given B<ctx> for a further transaction by | |
169 | clearing the internal CMP transaction (aka session) status, PKIStatusInfo, | |
170 | and any previous results (newCert, caPubs, and extraCertsIn) | |
171 | from the last executed transaction. | |
172 | All other field values (i.e., CMP options) are retained for potential re-use. | |
173 | ||
174 | OSSL_CMP_CTX_set_option() sets the given value for the given option | |
175 | (e.g., OSSL_CMP_OPT_IMPLICITCONFIRM) in the given OSSL_CMP_CTX structure. | |
176 | ||
177 | The following options can be set: | |
178 | ||
179 | =over 4 | |
180 | ||
181 | =item B<OSSL_CMP_OPT_LOG_VERBOSITY> | |
182 | ||
183 | The level of severity needed for actually outputting log messages | |
184 | due to errors, warnings, general info, debugging, etc. | |
185 | Default is OSSL_CMP_LOG_INFO. See also L<OSSL_CMP_log_open(3)>. | |
186 | ||
187 | =item B<OSSL_CMP_OPT_MSGTIMEOUT> | |
188 | ||
189 | Number of seconds (or 0 for infinite) a CMP message round trip is | |
190 | allowed to take before a timeout error is returned. Default is 120. | |
191 | ||
192 | =item B<OSSL_CMP_OPT_TOTALTIMEOUT> | |
193 | ||
194 | Maximum total number of seconds an enrollment (including polling) | |
195 | may take. Default is 0 (infinite). | |
196 | ||
197 | =item B<OSSL_CMP_OPT_VALIDITYDAYS> | |
198 | ||
199 | Number of days new certificates are asked to be valid for. | |
200 | ||
201 | =item B<OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT> | |
202 | ||
203 | Do not take default Subject Alternative Names | |
204 | from the reference certificate. | |
205 | ||
206 | =item B<OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL> | |
207 | ||
208 | Demand that the given Subject Alternative Names are flagged as critical. | |
209 | ||
210 | =item B<OSSL_CMP_OPT_POLICIES_CRITICAL> | |
211 | ||
212 | Demand that the given policies are flagged as critical. | |
213 | ||
214 | =item B<OSSL_CMP_OPT_POPOMETHOD> | |
215 | ||
216 | Select the proof of possession method to use. Possible values are: | |
217 | ||
218 | OSSL_CRMF_POPO_NONE - ProofOfPossession field omitted | |
219 | OSSL_CRMF_POPO_RAVERIFIED - assert that the RA has already | |
220 | verified the PoPo | |
221 | OSSL_CRMF_POPO_SIGNATURE - sign a value with private key, | |
222 | which is the default. | |
223 | OSSL_CRMF_POPO_KEYENC - decrypt the encrypted certificate | |
224 | ("indirect method") | |
225 | ||
226 | Note that a signature-based POPO can only be produced if a private key | |
227 | is provided as the newPkey or client pkey component of the CMP context. | |
228 | ||
229 | =item B<OSSL_CMP_OPT_DIGEST_ALGNID> | |
230 | ||
231 | The digest algorithm NID to be used in RFC 4210's MSG_SIG_ALG, | |
232 | if applicable used for message protection and Proof-of-Possession. | |
233 | Default is SHA256. | |
234 | ||
235 | OSSL_CMP_OPT_OWF_ALGNID | |
236 | The digest algorithm NID to be used as one-way function (OWF) | |
237 | in RFC 4210's MSG_MAC_ALG, if applicable used for message protection. | |
238 | Default is SHA256. | |
239 | ||
240 | OSSL_CMP_OPT_MAC_ALGNID | |
241 | The MAC algorithm NID to be used in RFC 4210's MSG_MAC_ALG, | |
242 | if applicable used for message protection. | |
243 | Default is HMAC-SHA1 as per RFC 4210. | |
244 | ||
245 | =item B<OSSL_CMP_OPT_REVOCATION_REASON> | |
246 | ||
247 | The reason code to be included in a Revocation Request (RR); | |
248 | values: 0..10 (RFC 5210, 5.3.1) or -1 for none, which is the default. | |
249 | ||
250 | =item B<OSSL_CMP_OPT_IMPLICITCONFIRM> | |
251 | ||
252 | Request server to enable implicit confirm mode, where the client | |
253 | does not need to send confirmation upon receiving the | |
254 | certificate. If the server does not enable implicit confirmation | |
255 | in the return message, then confirmation is sent anyway. | |
256 | ||
257 | =item B<OSSL_CMP_OPT_DISABLECONFIRM> | |
258 | ||
259 | Do not confirm enrolled certificates, to cope with broken servers | |
260 | not supporting implicit confirmation correctly. | |
261 | B<WARNING:> This setting leads to unspecified behavior and it is meant | |
262 | exclusively to allow interoperability with server implementations violating | |
263 | RFC 4210. | |
264 | ||
265 | =item B<OSSL_CMP_OPT_UNPROTECTED_SEND> | |
266 | ||
267 | Send messages without CMP-level protection. | |
268 | ||
269 | =item B<OSSL_CMP_OPT_UNPROTECTED_ERRORS> | |
270 | ||
271 | Accept unprotected error responses which are either explicitly | |
272 | unprotected or where protection verification failed. Applies to regular | |
273 | error messages as well as certificate responses (IP/CP/KUP) and | |
274 | revocation responses (RP) with rejection. | |
275 | B<WARNING:> This setting leads to unspecified behavior and it is meant | |
276 | exclusively to allow interoperability with server implementations violating | |
277 | RFC 4210. | |
278 | ||
279 | =item B<OSSL_CMP_OPT_IGNORE_KEYUSAGE> | |
280 | ||
281 | Ignore key usage restrictions in signer certificate when | |
282 | validating signature-based protection in received CMP messages. | |
283 | Else, 'digitalSignature' must be allowed by CMP signer certificates. | |
284 | ||
285 | =item B<OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR> | |
286 | ||
287 | Allow retrieving a trust anchor from extraCerts and using that | |
288 | to validate the certificate chain of an IP message. | |
289 | ||
290 | =back | |
291 | ||
292 | OSSL_CMP_CTX_get_option() reads the current value of the given option | |
293 | (e.g., OSSL_CMP_OPT_IMPLICITCONFIRM) from the given OSSL_CMP_CTX structure. | |
294 | ||
295 | OSSL_CMP_CTX_set_log_cb() sets in B<ctx> the callback function C<cb> | |
296 | for handling error queue entries and logging messages. | |
297 | When C<cb> is NULL errors are printed to STDERR (if available, else ignored) | |
298 | any log messages are ignored. | |
299 | Alternatively, L<OSSL_CMP_log_open(3)> may be used to direct logging to STDOUT. | |
300 | ||
301 | OSSL_CMP_CTX_set_log_verbosity() is a macro setting the | |
302 | OSSL_CMP_OPT_LOG_VERBOSITY context option to the given level. | |
303 | ||
304 | OSSL_CMP_CTX_print_errors() outputs any entries in the OpenSSL error queue. | |
305 | It is similar to B<ERR_print_errors_cb()> but uses the CMP log callback function | |
306 | if set in the C<ctx> for uniformity with CMP logging if given. Otherwise it uses | |
307 | B<ERR_print_errors(3)> to print to STDERR (unless OPENSSL_NO_STDIO is defined). | |
308 | ||
309 | OSSL_CMP_CTX_set1_serverPath() sets the HTTP path of the CMP server on the host. | |
310 | ||
311 | OSSL_CMP_CTX_set1_serverName() sets the given server Address (as IP or name) | |
312 | in the given OSSL_CMP_CTX structure. | |
313 | ||
314 | OSSL_CMP_CTX_set_serverPort() sets the port of the CMP server to connect to. | |
315 | Port defaults to OSSL_CMP_DEFAULT_PORT = 80 if not set explicitly. | |
316 | ||
9c0586d5 | 317 | OSSL_CMP_CTX_set1_proxyName() sets the hostname of the HTTP proxy to be used |
7960dbec DDO |
318 | for connecting to the CA server. |
319 | ||
320 | OSSL_CMP_CTX_set_proxyPort() sets the port of the HTTP proxy. | |
321 | Port defaults to OSSL_CMP_DEFAULT_PORT = 80 if not set explicitly. | |
322 | ||
29f178bd | 323 | OSSL_CMP_CTX_set_http_cb() sets the optional BIO connect/disconnect callback |
7960dbec DDO |
324 | function, which has the prototype |
325 | ||
29f178bd | 326 | typedef BIO *(*HTTP_bio_cb_t) (BIO *bio, void *ctx, int connect, int detail); |
7960dbec | 327 | |
29f178bd DDO |
328 | The callback may modify the BIO B<bio> provided by OSSL_CMP_MSG_http_perform(), |
329 | whereby it may make use of a custom defined argument B<ctx> | |
330 | stored in the OSSL_CMP_CTX by means of OSSL_CMP_CTX_set_http_cb_arg(). | |
331 | During connection establishment, just after calling BIO_connect_retry(), | |
332 | the function is invoked with the B<connect> argument being 1 and the B<detail> | |
333 | argument being 1 if HTTPS is requested, i.e., SSL/TLS should be enabled. On | |
334 | disconnect B<connect> is 0 and B<detail> is 1 in case no error occurred, else 0. | |
335 | For instance, on connect the function may prepend a TLS BIO to implement HTTPS; | |
336 | after disconnect it may do some diagnostic output and/or specific cleanup. | |
337 | The function should return NULL to indicate failure. | |
338 | After disconnect the modified BIO will be deallocated using BIO_free_all(). | |
7960dbec DDO |
339 | |
340 | OSSL_CMP_CTX_set_http_cb_arg() sets an argument, respectively a pointer to | |
341 | a structure containing arguments, | |
342 | optionally to be used by the http connect/disconnect callback function. | |
343 | B<arg> is not consumed, and it must therefore explicitly be freed when not | |
344 | needed any more. B<arg> may be NULL to clear the entry. | |
345 | ||
346 | OSSL_CMP_CTX_get_http_cb_arg() gets the argument, respectively the pointer to a | |
347 | structure containing arguments, previously set by | |
348 | OSSL_CMP_CTX_set_http_cb_arg() or NULL if unset. | |
349 | ||
350 | OSSL_CMP_CTX_set_transfer_cb() sets the message transfer callback function, | |
351 | which has the type | |
352 | ||
29f178bd DDO |
353 | typedef OSSL_CMP_MSG *(*OSSL_cmp_transfer_cb_t) (OSSL_CMP_CTX *ctx, |
354 | const OSSL_CMP_MSG *req); | |
355 | ||
7960dbec DDO |
356 | Returns 1 on success, 0 on error. |
357 | ||
358 | Default is NULL, which implies the use of L<OSSL_CMP_MSG_http_perform(3)>. | |
29f178bd DDO |
359 | The callback should send the CMP request message it obtains via the B<req> |
360 | parameter and on success return the response. | |
7960dbec DDO |
361 | The transfer callback may make use of a custom defined argument stored in |
362 | the ctx by means of OSSL_CMP_CTX_set_transfer_cb_arg(), which may be retrieved | |
363 | again through OSSL_CMP_CTX_get_transfer_cb_arg(). | |
7960dbec DDO |
364 | |
365 | ||
366 | OSSL_CMP_CTX_set_transfer_cb_arg() sets an argument, respectively a pointer to a | |
367 | structure containing arguments, optionally to be used by the transfer callback. | |
368 | B<arg> is not consumed, and it must therefore explicitly be freed when not | |
369 | needed any more. B<arg> may be NULL to clear the entry. | |
370 | ||
371 | OSSL_CMP_CTX_get_transfer_cb_arg() gets the argument, respectively the pointer | |
372 | to a structure containing arguments, previously set by | |
373 | OSSL_CMP_CTX_set_transfer_cb_arg() or NULL if unset. | |
374 | ||
375 | OSSL_CMP_CTX_set1_srvCert() pins the server certificate to be directly trusted | |
376 | (even if it is expired) for verifying response messages. | |
377 | The cert pointer is not consumed. It may be NULL to clear the entry. | |
378 | ||
379 | OSSL_CMP_CTX_set1_expected_sender() sets the Distinguished Name (DN) expected to | |
380 | be given in the sender response for messages protected with MSG_SIG_ALG. This | |
381 | may be used to enforce that during validation of received messages the given DN | |
382 | matches the sender field of the PKIMessage header, which in turn is used to | |
383 | identify the server certificate. | |
384 | This can be used to ensure that only a particular entity is accepted to act as | |
385 | CMP server, and attackers are not able to use arbitrary certificates of a | |
386 | trusted PKI hierarchy to fraudulently pose as server. | |
387 | This defaults to the subject DN of the certificate set via | |
388 | OSSL_CMP_CTX_set1_srvCert(), if any. | |
389 | ||
390 | OSSL_CMP_CTX_set0_trustedStore() sets the X509_STORE type certificate store | |
391 | containing trusted (root) CA certificates. The certificate store may also hold | |
392 | CRLs and a certificate verification callback function used for CMP server | |
393 | authentication. Any already existing store entry is freed. When given a NULL | |
394 | parameter the entry is cleared. | |
395 | ||
396 | OSSL_CMP_CTX_get0_trustedStore() returns a pointer to the certificate store | |
397 | containing trusted root CA certificates, which may be empty if unset. | |
398 | ||
399 | OSSL_CMP_CTX_set1_untrusted_certs() takes over a list of certificates containing | |
400 | non-trusted intermediate certs used for path construction in authentication | |
401 | of the CMP server and potentially others (TLS server, newly enrolled cert). | |
402 | The reference counts of those certificates handled successfully are increased. | |
403 | ||
404 | OSSL_CMP_CTX_get0_untrusted_certs(OSSL_CMP_CTX *ctx) returns a pointer to the | |
405 | list of untrusted certs, which my be empty if unset. | |
406 | ||
407 | OSSL_CMP_CTX_set1_clCert() sets the client certificate in the given | |
408 | OSSL_CMP_CTX structure. The client certificate will then be used by the | |
409 | functions to set the "sender" field for outgoing messages and it will be | |
410 | included in the extraCerts field. | |
411 | ||
412 | OSSL_CMP_CTX_set1_pkey() sets the private key corresponding to the client | |
413 | certificate set with B<OSSL_CMP_CTX_set1_clCert()> in the given CMP context. | |
414 | Used to create the protection in case of MSG_SIG_ALG. | |
415 | ||
416 | OSSL_CMP_CTX_set1_referenceValue() sets the given referenceValue in the given | |
417 | B<ctx> or clears it if the B<ref> argument is NULL. | |
418 | ||
419 | OSSL_CMP_CTX_set1_secretValue() sets the B<sec> with the length B<len> in the | |
420 | given B<ctx> or clears it if the B<sec> argument is NULL. | |
421 | ||
422 | OSSL_CMP_CTX_set1_recipient() sets the recipient name that will be used in the | |
423 | PKIHeader of a request message, i.e. the X509 name of the (CA) server. | |
424 | Setting is overruled by subject of srvCert if set. | |
425 | If neither srvCert nor recipient are set, the recipient of the PKI message is | |
426 | determined in the following order: issuer, issuer of old cert (oldCert), | |
427 | issuer of client cert (clCert), else NULL-DN. | |
428 | When a response is received, its sender must match the recipient of the request. | |
429 | ||
430 | OSSL_CMP_CTX_push0_geninfo_ITAV() adds B<itav> to the stack in the B<ctx> to be | |
431 | added to the GeneralInfo field of the CMP PKIMessage header of a request | |
432 | message sent with this context. Consumes the pointer to B<itav>. | |
433 | ||
434 | OSSL_CMP_CTX_set1_extraCertsOut() sets the stack of extraCerts that will be | |
435 | sent to remote. | |
436 | ||
437 | OSSL_CMP_CTX_set0_newPkey() can be used to explicitly set the given EVP_PKEY | |
438 | structure as the private or public key to be certified in the CMP context. | |
439 | The B<priv> parameter must be 0 if and only if the given key is a public key. | |
440 | ||
441 | OSSL_CMP_CTX_get0_newPkey() gives the key to use for certificate enrollment | |
442 | dependent on fields of the CMP context structure: | |
443 | the newPkey (which may be a private or public key) if present, | |
444 | else the public key in the p10CSR if present, else the client private key. | |
445 | If the B<priv> parameter is not 0 and the selected key does not have a | |
446 | private component then NULL is returned. | |
447 | ||
448 | OSSL_CMP_CTX_set1_issuer() sets the name of the intended issuer that | |
449 | will be set in the CertTemplate, i.e., the X509 name of the CA server. | |
450 | ||
451 | OSSL_CMP_CTX_set1_subjectName() sets the subject DN that will be used in | |
452 | the CertTemplate structure when requesting a new cert. For Key Update Requests | |
453 | (KUR), it defaults to the subject DN of the reference certificate, | |
454 | see B<OSSL_CMP_CTX_set1_oldCert()>. This default is used for Initialization | |
455 | Requests (IR) and Certification Requests (CR) only if no SANs are set. | |
456 | ||
457 | If clCert is not set (e.g. in case of IR with MSG_MAC_ALG), the subject DN | |
458 | is also used as sender of the PKI message. | |
459 | ||
460 | OSSL_CMP_CTX_push1_subjectAltName() adds the given X509 name to the list of | |
461 | alternate names on the certificate template request. This cannot be used if | |
462 | any Subject Alternative Name extension is set via | |
463 | OSSL_CMP_CTX_set0_reqExtensions(). | |
464 | By default, unless OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT has been set, | |
465 | the Subject Alternative Names are copied from the reference certificate, | |
466 | see OSSL_CMP_CTX_set1_oldCert(). | |
467 | ||
468 | If set and the subject DN is not set with OSSL_CMP_CTX_set1_subjectName(), then | |
469 | the certificate template of an IR and CR will not be filled with the default | |
470 | subject DN from the reference certificate (see OSSL_CMP_CTX_set1_oldCert(). | |
471 | If a subject DN is desired it needs to be set explicitly with | |
472 | OSSL_CMP_CTX_set1_subjectName(). | |
473 | ||
474 | OSSL_CMP_CTX_set0_reqExtensions() sets the X.509v3 extensions to be used in | |
475 | IR/CR/KUR. | |
476 | ||
477 | OSSL_CMP_CTX_reqExtensions_have_SAN() returns 1 if the context contains | |
478 | a Subject Alternative Name extension, else 0 or -1 on error. | |
479 | ||
480 | OSSL_CMP_CTX_push0_policy() adds the certificate policy info object | |
481 | to the X509_EXTENSIONS of the requested certificate template. | |
482 | ||
483 | OSSL_CMP_CTX_set1_oldCert() sets the old certificate to be updated in | |
484 | Key Update Requests (KUR) or to be revoked in Revocation Requests (RR). | |
485 | It must be given for RR, else it defaults to B<clCert>. | |
486 | The reference certificate determined in this way, if any, is also used for | |
487 | deriving default subject DN and Subject Alternative Names for IR, CR, and KUR. | |
488 | Its issuer, if any, is used as default recipient in the CMP message header. | |
489 | ||
490 | OSSL_CMP_CTX_set1_p10CSR() sets the PKCS#10 CSR to be used in P10CR. | |
491 | ||
492 | OSSL_CMP_CTX_push0_genm_ITAV() adds B<itav> to the stack in the B<ctx> which | |
493 | will be the body of a General Message sent with this context. | |
494 | Consumes the pointer to B<itav>. | |
495 | ||
496 | OSSL_CMP_CTX_set_certConf_cb() sets the callback used for evaluating the newly | |
497 | enrolled certificate before the library sends, depending on its result, | |
498 | a positive or negative certConf message to the server. The callback has type | |
499 | ||
500 | typedef int (*OSSL_cmp_certConf_cb_t) (OSSL_CMP_CTX *ctx, X509 *cert, | |
501 | int fail_info, const char **txt); | |
502 | ||
503 | and should inspect the certificate it obtains via the B<cert> parameter and may | |
504 | overrule the pre-decision given in the B<fail_info> and B<*txt> parameters. | |
505 | If it accepts the certificate it must return 0, indicating success. Else it must | |
506 | return a bit field reflecting PKIFailureInfo with at least one failure bit and | |
507 | may set the B<*txt> output parameter to point to a string constant with more | |
508 | detail. The transfer callback may make use of a custom defined argument stored | |
509 | in the B<ctx> by means of OSSL_CMP_CTX_set_certConf_cb_arg(), which may be | |
510 | retrieved again through OSSL_CMP_CTX_get_certConf_cb_arg(). | |
511 | Typically, the callback will check at least that the certificate can be verified | |
512 | using a set of trusted certificates. | |
513 | It also could compare the subject DN and other fields of the newly | |
514 | enrolled certificate with the certificate template of the request. | |
515 | ||
516 | OSSL_CMP_CTX_set_certConf_cb_arg() sets an argument, respectively a pointer to a | |
517 | structure containing arguments, optionally to be used by the certConf callback. | |
518 | B<arg> is not consumed, and it must therefore explicitly be freed when not | |
519 | needed any more. B<arg> may be NULL to clear the entry. | |
520 | ||
521 | OSSL_CMP_CTX_get_certConf_cb_arg() gets the argument, respectively the pointer | |
522 | to a structure containing arguments, previously set by | |
523 | OSSL_CMP_CTX_set_certConf_cb_arg(), or NULL if unset. | |
524 | ||
525 | OSSL_CMP_CTX_get_status() returns the PKIstatus from the last received | |
526 | CertRepMessage or Revocation Response or error message, or -1 if unset. | |
527 | ||
528 | OSSL_CMP_CTX_get0_statusString() returns the statusString from the last received | |
529 | CertRepMessage or Revocation Response or error message, or NULL if unset. | |
530 | ||
531 | OSSL_CMP_CTX_get_failInfoCode() returns the error code from the failInfo field | |
532 | of the last received CertRepMessage or Revocation Response or error message. | |
6e4618a0 RS |
533 | This is a bit field and the flags for it are specified in the header file |
534 | F<< <openssl/cmp.h> >>. | |
7960dbec DDO |
535 | The flags start with OSSL_CMP_CTX_FAILINFO, for example: |
536 | OSSL_CMP_CTX_FAILINFO_badAlg. Returns -1 if the failInfoCode field is unset. | |
537 | ||
538 | OSSL_CMP_CTX_get0_newCert() returns the pointer to the newly obtained | |
539 | certificate in case it is available, else NULL. | |
540 | ||
541 | OSSL_CMP_CTX_get1_caPubs() returns a pointer to a duplicate of the stack of | |
542 | X.509 certificates received in the caPubs field of last received certificate | |
543 | response message IP/CP/KUP. | |
544 | ||
545 | OSSL_CMP_CTX_get1_extraCertsIn() returns a pointer to a duplicate of the stack | |
546 | of X.509 certificates received in the last received non-empty extraCerts field. | |
547 | Returns an empty stack if no extraCerts have been received in the current | |
548 | transaction. | |
549 | ||
550 | OSSL_CMP_CTX_set1_transactionID() sets the given transaction ID in the given | |
551 | OSSL_CMP_CTX structure. | |
552 | ||
553 | OSSL_CMP_CTX_set1_senderNonce() stores the last sent sender B<nonce> in | |
554 | the B<ctx>. This will be used to validate the recipNonce in incoming messages. | |
555 | ||
556 | =head1 NOTES | |
557 | ||
558 | CMP is defined in RFC 4210 (and CRMF in RFC 4211). | |
559 | ||
560 | =head1 RETURN VALUES | |
561 | ||
562 | OSSL_CMP_CTX_free() and OSSL_CMP_CTX_print_errors() do not return anything. | |
563 | ||
564 | OSSL_CMP_CTX_new(), | |
565 | OSSL_CMP_CTX_get_http_cb_arg(), | |
566 | OSSL_CMP_CTX_get_transfer_cb_arg(), | |
567 | OSSL_CMP_CTX_get0_trustedStore(), | |
568 | OSSL_CMP_CTX_get0_untrusted_certs(), | |
569 | OSSL_CMP_CTX_get0_newPkey(), | |
570 | OSSL_CMP_CTX_get_certConf_cb_arg(), | |
571 | OSSL_CMP_CTX_get0_statusString(), | |
572 | OSSL_CMP_CTX_get0_newCert(), | |
573 | OSSL_CMP_CTX_get1_caPubs(), and | |
574 | OSSL_CMP_CTX_get1_extraCertsIn() | |
575 | return the intended pointer value as described above or NULL on error. | |
576 | ||
577 | OSSL_CMP_CTX_get_option(), | |
578 | OSSL_CMP_CTX_reqExtensions_have_SAN(), | |
579 | OSSL_CMP_CTX_get_status(), and | |
580 | OSSL_CMP_CTX_get_failInfoCode() | |
581 | return the intended value as described above or -1 on error. | |
582 | ||
583 | All other functions return 1 on success, 0 on error. | |
584 | ||
585 | =head1 EXAMPLES | |
586 | ||
587 | The following code does an Initialization Request: | |
588 | ||
589 | cmp_ctx = OSSL_CMP_CTX_new(); | |
590 | OSSL_CMP_CTX_set1_serverName(cmp_ctx, opt_serverName); | |
591 | OSSL_CMP_CTX_set1_referenceValue(cmp_ctx, ref, ref_len); | |
592 | OSSL_CMP_CTX_set1_secretValue(cmp_ctx, sec, sec_len); | |
593 | OSSL_CMP_CTX_set0_newPkey(cmp_ctx, new_pkey, 1); | |
594 | OSSL_CMP_CTX_set1_caCert(cmp_ctx, ca_cert); | |
595 | ||
596 | initialClCert = OSSL_CMP_exec_IR_ses(cmp_ctx); | |
597 | ||
598 | The following code does an Initialization Request using an | |
599 | external identity certificate (RFC 4210, Appendix E.7): | |
600 | ||
601 | cmp_ctx = OSSL_CMP_CTX_new(); | |
602 | OSSL_CMP_CTX_set1_serverName(cmp_ctx, sname); | |
603 | OSSL_CMP_CTX_set1_clCert(cmp_ctx, cl_cert); | |
604 | OSSL_CMP_CTX_set1_pkey(cmp_ctx, pkey); | |
605 | OSSL_CMP_CTX_set0_newPkey(cmp_ctx, new_pkey, 1); | |
606 | OSSL_CMP_CTX_set1_caCert(cmp_ctx, ca_cert); | |
607 | ||
608 | initialClCert = OSSL_CMP_exec_IR_ses(cmp_ctx); | |
609 | ||
610 | Here externalCert is an X509 certificate granted to the EE by another CA | |
611 | which is trusted by the current CA the code will connect to. | |
612 | ||
613 | ||
614 | The following code does a Key Update Request: | |
615 | ||
616 | cmp_ctx = OSSL_CMP_CTX_new(); | |
617 | OSSL_CMP_CTX_set1_serverName(cmp_ctx, sname); | |
618 | OSSL_CMP_CTX_set1_pkey(cmp_ctx, pkey); | |
619 | OSSL_CMP_CTX_set0_newPkey(cmp_ctx, new_pkey, 1); | |
620 | OSSL_CMP_CTX_set1_clCert(cmp_ctx, cl_cert); | |
621 | OSSL_CMP_CTX_set1_caCert(cmp_ctx, ca_cert); | |
622 | ||
623 | updatedClCert = OSSL_CMP_exec_KUR_ses(cmp_ctx); | |
624 | ||
625 | The following code (which omits error handling) sends a General Message | |
626 | including, as an example, the id-it-signKeyPairTypes OID and prints info on | |
627 | the General Response contents. | |
628 | ||
629 | cmp_ctx = OSSL_CMP_CTX_new(); | |
630 | OSSL_CMP_CTX_set1_serverName(cmp_ctx, sname); | |
631 | OSSL_CMP_CTX_set1_referenceValue(cmp_ctx, ref, ref_len); | |
632 | OSSL_CMP_CTX_set1_secretValue(cmp_ctx, sec, sec_len); | |
633 | ||
634 | ASN1_OBJECT *type = OBJ_txt2obj("1.3.6.1.5.5.7.4.2", 1); | |
635 | OSSL_CMP_ITAV *itav = OSSL_CMP_ITAV_new(type, NULL); | |
636 | OSSL_CMP_CTX_push0_genm_ITAV(cmp_ctx, itav); | |
637 | ||
638 | STACK_OF(OSSL_CMP_ITAV) *itavs; | |
639 | itavs = OSSL_CMP_exec_GENM_ses(cmp_ctx); | |
640 | print_itavs(itavs); | |
641 | sk_OSSL_CMP_ITAV_pop_free(itavs, OSSL_CMP_ITAV_free); | |
642 | ||
643 | =head1 SEE ALSO | |
644 | ||
645 | L<OSSL_CMP_exec_IR_ses(3)>, L<OSSL_CMP_exec_KUR_ses(3)>, | |
646 | L<OSSL_CMP_exec_GENM_ses(3)> | |
647 | ||
648 | =head1 HISTORY | |
649 | ||
650 | The OpenSSL CMP support was added in OpenSSL 3.0. | |
651 | ||
652 | =head1 COPYRIGHT | |
653 | ||
654 | Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved. | |
655 | ||
656 | Licensed under the Apache License 2.0 (the "License"). You may not use | |
657 | this file except in compliance with the License. You can obtain a copy | |
658 | in the file LICENSE in the source distribution or at | |
659 | L<https://www.openssl.org/source/license.html>. | |
660 | ||
661 | =cut |