]>
Commit | Line | Data |
---|---|---|
7960dbec DDO |
1 | =pod |
2 | ||
3 | =head1 NAME | |
4 | ||
5 | OSSL_CMP_CTX_new, | |
6 | OSSL_CMP_CTX_free, | |
7 | OSSL_CMP_CTX_reinit, | |
2da163cb | 8 | OSSL_CMP_CTX_get0_libctx, OSSL_CMP_CTX_get0_propq, |
7960dbec DDO |
9 | OSSL_CMP_CTX_set_option, |
10 | OSSL_CMP_CTX_get_option, | |
11 | OSSL_CMP_CTX_set_log_cb, | |
12 | OSSL_CMP_CTX_set_log_verbosity, | |
13 | OSSL_CMP_CTX_print_errors, | |
14 | OSSL_CMP_CTX_set1_serverPath, | |
4b1fe471 | 15 | OSSL_CMP_CTX_set1_server, |
7960dbec | 16 | OSSL_CMP_CTX_set_serverPort, |
afe554c2 DDO |
17 | OSSL_CMP_CTX_set1_proxy, |
18 | OSSL_CMP_CTX_set1_no_proxy, | |
7960dbec DDO |
19 | OSSL_CMP_CTX_set_http_cb, |
20 | OSSL_CMP_CTX_set_http_cb_arg, | |
21 | OSSL_CMP_CTX_get_http_cb_arg, | |
7e765f46 | 22 | OSSL_CMP_transfer_cb_t, |
7960dbec DDO |
23 | OSSL_CMP_CTX_set_transfer_cb, |
24 | OSSL_CMP_CTX_set_transfer_cb_arg, | |
25 | OSSL_CMP_CTX_get_transfer_cb_arg, | |
26 | OSSL_CMP_CTX_set1_srvCert, | |
27 | OSSL_CMP_CTX_set1_expected_sender, | |
6be83cc6 | 28 | OSSL_CMP_CTX_set0_trusted, |
7960dbec | 29 | OSSL_CMP_CTX_set0_trustedStore, |
6be83cc6 | 30 | OSSL_CMP_CTX_get0_trusted, |
7960dbec | 31 | OSSL_CMP_CTX_get0_trustedStore, |
0b86eefd DDO |
32 | OSSL_CMP_CTX_set1_untrusted, |
33 | OSSL_CMP_CTX_get0_untrusted, | |
63f1883d | 34 | OSSL_CMP_CTX_set1_cert, |
15076c26 | 35 | OSSL_CMP_CTX_build_cert_chain, |
7960dbec DDO |
36 | OSSL_CMP_CTX_set1_pkey, |
37 | OSSL_CMP_CTX_set1_referenceValue, | |
38 | OSSL_CMP_CTX_set1_secretValue, | |
39 | OSSL_CMP_CTX_set1_recipient, | |
40 | OSSL_CMP_CTX_push0_geninfo_ITAV, | |
a2ede039 | 41 | OSSL_CMP_CTX_reset_geninfo_ITAVs, |
7960dbec DDO |
42 | OSSL_CMP_CTX_set1_extraCertsOut, |
43 | OSSL_CMP_CTX_set0_newPkey, | |
44 | OSSL_CMP_CTX_get0_newPkey, | |
45 | OSSL_CMP_CTX_set1_issuer, | |
46 | OSSL_CMP_CTX_set1_subjectName, | |
47 | OSSL_CMP_CTX_push1_subjectAltName, | |
48 | OSSL_CMP_CTX_set0_reqExtensions, | |
49 | OSSL_CMP_CTX_reqExtensions_have_SAN, | |
50 | OSSL_CMP_CTX_push0_policy, | |
51 | OSSL_CMP_CTX_set1_oldCert, | |
52 | OSSL_CMP_CTX_set1_p10CSR, | |
53 | OSSL_CMP_CTX_push0_genm_ITAV, | |
7e765f46 | 54 | OSSL_CMP_certConf_cb_t, |
a0745e2b | 55 | OSSL_CMP_certConf_cb, |
7960dbec DDO |
56 | OSSL_CMP_CTX_set_certConf_cb, |
57 | OSSL_CMP_CTX_set_certConf_cb_arg, | |
58 | OSSL_CMP_CTX_get_certConf_cb_arg, | |
59 | OSSL_CMP_CTX_get_status, | |
60 | OSSL_CMP_CTX_get0_statusString, | |
61 | OSSL_CMP_CTX_get_failInfoCode, | |
b6fbef11 | 62 | OSSL_CMP_CTX_get0_validatedSrvCert, |
7960dbec | 63 | OSSL_CMP_CTX_get0_newCert, |
39082af2 | 64 | OSSL_CMP_CTX_get1_newChain, |
7960dbec DDO |
65 | OSSL_CMP_CTX_get1_caPubs, |
66 | OSSL_CMP_CTX_get1_extraCertsIn, | |
67 | OSSL_CMP_CTX_set1_transactionID, | |
68 | OSSL_CMP_CTX_set1_senderNonce | |
69 | - functions for managing the CMP client context data structure | |
70 | ||
71 | =head1 SYNOPSIS | |
72 | ||
73 | #include <openssl/cmp.h> | |
74 | ||
b4250010 | 75 | OSSL_CMP_CTX *OSSL_CMP_CTX_new(OSSL_LIB_CTX *libctx, const char *propq); |
7960dbec DDO |
76 | void OSSL_CMP_CTX_free(OSSL_CMP_CTX *ctx); |
77 | int OSSL_CMP_CTX_reinit(OSSL_CMP_CTX *ctx); | |
2da163cb DDO |
78 | OSSL_LIB_CTX *OSSL_CMP_CTX_get0_libctx(const OSSL_CMP_CTX *ctx); |
79 | const char *OSSL_CMP_CTX_get0_propq(const OSSL_CMP_CTX *ctx); | |
7960dbec DDO |
80 | int OSSL_CMP_CTX_set_option(OSSL_CMP_CTX *ctx, int opt, int val); |
81 | int OSSL_CMP_CTX_get_option(const OSSL_CMP_CTX *ctx, int opt); | |
82 | ||
83 | /* logging and error reporting: */ | |
7e765f46 | 84 | int OSSL_CMP_CTX_set_log_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_log_cb_t cb); |
7960dbec | 85 | #define OSSL_CMP_CTX_set_log_verbosity(ctx, level) |
c4a9e3eb | 86 | void OSSL_CMP_CTX_print_errors(const OSSL_CMP_CTX *ctx); |
7960dbec DDO |
87 | |
88 | /* message transfer: */ | |
89 | int OSSL_CMP_CTX_set1_serverPath(OSSL_CMP_CTX *ctx, const char *path); | |
4b1fe471 | 90 | int OSSL_CMP_CTX_set1_server(OSSL_CMP_CTX *ctx, const char *address); |
7960dbec | 91 | int OSSL_CMP_CTX_set_serverPort(OSSL_CMP_CTX *ctx, int port); |
afe554c2 DDO |
92 | int OSSL_CMP_CTX_set1_proxy(OSSL_CMP_CTX *ctx, const char *name); |
93 | int OSSL_CMP_CTX_set1_no_proxy(OSSL_CMP_CTX *ctx, const char *names); | |
29f178bd | 94 | int OSSL_CMP_CTX_set_http_cb(OSSL_CMP_CTX *ctx, HTTP_bio_cb_t cb); |
7960dbec DDO |
95 | int OSSL_CMP_CTX_set_http_cb_arg(OSSL_CMP_CTX *ctx, void *arg); |
96 | void *OSSL_CMP_CTX_get_http_cb_arg(const OSSL_CMP_CTX *ctx); | |
7e765f46 | 97 | typedef OSSL_CMP_MSG *(*OSSL_CMP_transfer_cb_t)(OSSL_CMP_CTX *ctx, |
29f178bd | 98 | const OSSL_CMP_MSG *req); |
7960dbec | 99 | int OSSL_CMP_CTX_set_transfer_cb(OSSL_CMP_CTX *ctx, |
7e765f46 | 100 | OSSL_CMP_transfer_cb_t cb); |
7960dbec DDO |
101 | int OSSL_CMP_CTX_set_transfer_cb_arg(OSSL_CMP_CTX *ctx, void *arg); |
102 | void *OSSL_CMP_CTX_get_transfer_cb_arg(const OSSL_CMP_CTX *ctx); | |
103 | ||
104 | /* server authentication: */ | |
105 | int OSSL_CMP_CTX_set1_srvCert(OSSL_CMP_CTX *ctx, X509 *cert); | |
106 | int OSSL_CMP_CTX_set1_expected_sender(OSSL_CMP_CTX *ctx, | |
107 | const X509_NAME *name); | |
6be83cc6 | 108 | #define OSSL_CMP_CTX_set0_trusted OSSL_CMP_CTX_set0_trustedStore |
7960dbec | 109 | int OSSL_CMP_CTX_set0_trustedStore(OSSL_CMP_CTX *ctx, X509_STORE *store); |
6be83cc6 | 110 | #define OSSL_CMP_CTX_get0_trusted OSSL_CMP_CTX_get0_trustedStore |
7960dbec | 111 | X509_STORE *OSSL_CMP_CTX_get0_trustedStore(const OSSL_CMP_CTX *ctx); |
0b86eefd DDO |
112 | int OSSL_CMP_CTX_set1_untrusted(OSSL_CMP_CTX *ctx, STACK_OF(X509) *certs); |
113 | STACK_OF(X509) *OSSL_CMP_CTX_get0_untrusted(const OSSL_CMP_CTX *ctx); | |
7960dbec DDO |
114 | |
115 | /* client authentication: */ | |
63f1883d | 116 | int OSSL_CMP_CTX_set1_cert(OSSL_CMP_CTX *ctx, X509 *cert); |
15076c26 DDO |
117 | int OSSL_CMP_CTX_build_cert_chain(OSSL_CMP_CTX *ctx, X509_STORE *own_trusted, |
118 | STACK_OF(X509) *candidates); | |
7960dbec DDO |
119 | int OSSL_CMP_CTX_set1_pkey(OSSL_CMP_CTX *ctx, EVP_PKEY *pkey); |
120 | int OSSL_CMP_CTX_set1_referenceValue(OSSL_CMP_CTX *ctx, | |
121 | const unsigned char *ref, int len); | |
122 | int OSSL_CMP_CTX_set1_secretValue(OSSL_CMP_CTX *ctx, const unsigned char *sec, | |
123 | const int len); | |
124 | ||
125 | /* CMP message header and extra certificates: */ | |
126 | int OSSL_CMP_CTX_set1_recipient(OSSL_CMP_CTX *ctx, const X509_NAME *name); | |
127 | int OSSL_CMP_CTX_push0_geninfo_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav); | |
a2ede039 | 128 | int OSSL_CMP_CTX_reset_geninfo_ITAVs(OSSL_CMP_CTX *ctx); |
7960dbec DDO |
129 | int OSSL_CMP_CTX_set1_extraCertsOut(OSSL_CMP_CTX *ctx, |
130 | STACK_OF(X509) *extraCertsOut); | |
131 | ||
132 | /* certificate template: */ | |
133 | int OSSL_CMP_CTX_set0_newPkey(OSSL_CMP_CTX *ctx, int priv, EVP_PKEY *pkey); | |
134 | EVP_PKEY *OSSL_CMP_CTX_get0_newPkey(const OSSL_CMP_CTX *ctx, int priv); | |
135 | int OSSL_CMP_CTX_set1_issuer(OSSL_CMP_CTX *ctx, const X509_NAME *name); | |
136 | int OSSL_CMP_CTX_set1_subjectName(OSSL_CMP_CTX *ctx, const X509_NAME *name); | |
137 | int OSSL_CMP_CTX_push1_subjectAltName(OSSL_CMP_CTX *ctx, | |
138 | const GENERAL_NAME *name); | |
139 | int OSSL_CMP_CTX_set0_reqExtensions(OSSL_CMP_CTX *ctx, X509_EXTENSIONS *exts); | |
140 | int OSSL_CMP_CTX_reqExtensions_have_SAN(OSSL_CMP_CTX *ctx); | |
141 | int OSSL_CMP_CTX_push0_policy(OSSL_CMP_CTX *ctx, POLICYINFO *pinfo); | |
142 | int OSSL_CMP_CTX_set1_oldCert(OSSL_CMP_CTX *ctx, X509 *cert); | |
143 | int OSSL_CMP_CTX_set1_p10CSR(OSSL_CMP_CTX *ctx, const X509_REQ *csr); | |
144 | ||
145 | /* misc body contents: */ | |
146 | int OSSL_CMP_CTX_push0_genm_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav); | |
147 | ||
148 | /* certificate confirmation: */ | |
7e765f46 | 149 | typedef int (*OSSL_CMP_certConf_cb_t)(OSSL_CMP_CTX *ctx, X509 *cert, |
652fba9e | 150 | int fail_info, const char **txt); |
a0745e2b DDO |
151 | int OSSL_CMP_certConf_cb(OSSL_CMP_CTX *ctx, X509 *cert, int fail_info, |
152 | const char **text); | |
7e765f46 | 153 | int OSSL_CMP_CTX_set_certConf_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_certConf_cb_t cb); |
7960dbec DDO |
154 | int OSSL_CMP_CTX_set_certConf_cb_arg(OSSL_CMP_CTX *ctx, void *arg); |
155 | void *OSSL_CMP_CTX_get_certConf_cb_arg(const OSSL_CMP_CTX *ctx); | |
156 | ||
157 | /* result fetching: */ | |
158 | int OSSL_CMP_CTX_get_status(const OSSL_CMP_CTX *ctx); | |
159 | OSSL_CMP_PKIFREETEXT *OSSL_CMP_CTX_get0_statusString(const OSSL_CMP_CTX *ctx); | |
160 | int OSSL_CMP_CTX_get_failInfoCode(const OSSL_CMP_CTX *ctx); | |
161 | ||
b6fbef11 | 162 | X509 *OSSL_CMP_CTX_get0_validatedSrvCert(const OSSL_CMP_CTX *ctx); |
7960dbec | 163 | X509 *OSSL_CMP_CTX_get0_newCert(const OSSL_CMP_CTX *ctx); |
39082af2 | 164 | STACK_OF(X509) *OSSL_CMP_CTX_get1_newChain(const OSSL_CMP_CTX *ctx); |
7960dbec DDO |
165 | STACK_OF(X509) *OSSL_CMP_CTX_get1_caPubs(const OSSL_CMP_CTX *ctx); |
166 | STACK_OF(X509) *OSSL_CMP_CTX_get1_extraCertsIn(const OSSL_CMP_CTX *ctx); | |
167 | ||
7e765f46 | 168 | /* for testing and debugging purposes: */ |
7960dbec DDO |
169 | int OSSL_CMP_CTX_set1_transactionID(OSSL_CMP_CTX *ctx, |
170 | const ASN1_OCTET_STRING *id); | |
171 | int OSSL_CMP_CTX_set1_senderNonce(OSSL_CMP_CTX *ctx, | |
172 | const ASN1_OCTET_STRING *nonce); | |
173 | ||
174 | =head1 DESCRIPTION | |
175 | ||
176 | This is the context API for using CMP (Certificate Management Protocol) with | |
177 | OpenSSL. | |
178 | ||
1a7cd250 DDO |
179 | OSSL_CMP_CTX_new() allocates an B<OSSL_CMP_CTX> structure associated with |
180 | the library context I<libctx> and property query string I<propq>, | |
181 | both of which may be NULL to select the defaults. | |
182 | It initializes the remaining fields to their default values - for instance, | |
183 | the logging verbosity is set to OSSL_CMP_LOG_INFO, | |
184 | the message timeout is set to 120 seconds, | |
185 | and the proof-of-possession method is set to OSSL_CRMF_POPO_SIGNATURE. | |
7960dbec DDO |
186 | |
187 | OSSL_CMP_CTX_free() deallocates an OSSL_CMP_CTX structure. | |
188 | ||
aad086e2 | 189 | OSSL_CMP_CTX_reinit() prepares the given I<ctx> for a further transaction by |
7960dbec | 190 | clearing the internal CMP transaction (aka session) status, PKIStatusInfo, |
39082af2 | 191 | and any previous results (newCert, newChain, caPubs, and extraCertsIn) |
7960dbec | 192 | from the last executed transaction. |
1c04866c | 193 | It also clears any ITAVs that were added by OSSL_CMP_CTX_push0_genm_ITAV(). |
7960dbec DDO |
194 | All other field values (i.e., CMP options) are retained for potential re-use. |
195 | ||
2da163cb DDO |
196 | OSSL_CMP_CTX_get0_libctx() returns the I<libctx> argument that was used |
197 | when constructing I<ctx> with OSSL_CMP_CTX_new(), which may be NULL. | |
198 | ||
199 | OSSL_CMP_CTX_get0_propq() returns the I<propq> argument that was used | |
200 | when constructing I<ctx> with OSSL_CMP_CTX_new(), which may be NULL. | |
201 | ||
7960dbec | 202 | OSSL_CMP_CTX_set_option() sets the given value for the given option |
7e765f46 | 203 | (e.g., OSSL_CMP_OPT_IMPLICIT_CONFIRM) in the given OSSL_CMP_CTX structure. |
7960dbec DDO |
204 | |
205 | The following options can be set: | |
206 | ||
207 | =over 4 | |
208 | ||
209 | =item B<OSSL_CMP_OPT_LOG_VERBOSITY> | |
210 | ||
211 | The level of severity needed for actually outputting log messages | |
212 | due to errors, warnings, general info, debugging, etc. | |
213 | Default is OSSL_CMP_LOG_INFO. See also L<OSSL_CMP_log_open(3)>. | |
214 | ||
19f97fe6 DDO |
215 | =item B<OSSL_CMP_OPT_KEEP_ALIVE> |
216 | ||
217 | If the given value is 0 then HTTP connections are not kept open | |
218 | after receiving a response, which is the default behavior for HTTP 1.0. | |
219 | If the value is 1 or 2 then persistent connections are requested. | |
220 | If the value is 2 then persistent connections are required, | |
221 | i.e., in case the server does not grant them an error occurs. | |
222 | The default value is 1: prefer to keep the connection open. | |
223 | ||
7e765f46 | 224 | =item B<OSSL_CMP_OPT_MSG_TIMEOUT> |
7960dbec | 225 | |
5acd4007 DDO |
226 | Number of seconds a CMP request-response message round trip |
227 | is allowed to take before a timeout error is returned. | |
228 | A value <= 0 means no limitation (waiting indefinitely). | |
229 | Default is to use the B<OSSL_CMP_OPT_TOTAL_TIMEOUT> setting. | |
7960dbec | 230 | |
7e765f46 | 231 | =item B<OSSL_CMP_OPT_TOTAL_TIMEOUT> |
7960dbec | 232 | |
5acd4007 DDO |
233 | Maximum total number of seconds a transaction may take, |
234 | including polling etc. | |
235 | A value <= 0 means no limitation (waiting indefinitely). | |
236 | Default is 0. | |
7960dbec | 237 | |
7e765f46 | 238 | =item B<OSSL_CMP_OPT_VALIDITY_DAYS> |
7960dbec DDO |
239 | |
240 | Number of days new certificates are asked to be valid for. | |
241 | ||
242 | =item B<OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT> | |
243 | ||
244 | Do not take default Subject Alternative Names | |
245 | from the reference certificate. | |
246 | ||
247 | =item B<OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL> | |
248 | ||
249 | Demand that the given Subject Alternative Names are flagged as critical. | |
250 | ||
251 | =item B<OSSL_CMP_OPT_POLICIES_CRITICAL> | |
252 | ||
253 | Demand that the given policies are flagged as critical. | |
254 | ||
7e765f46 | 255 | =item B<OSSL_CMP_OPT_POPO_METHOD> |
7960dbec DDO |
256 | |
257 | Select the proof of possession method to use. Possible values are: | |
258 | ||
259 | OSSL_CRMF_POPO_NONE - ProofOfPossession field omitted | |
260 | OSSL_CRMF_POPO_RAVERIFIED - assert that the RA has already | |
261 | verified the PoPo | |
262 | OSSL_CRMF_POPO_SIGNATURE - sign a value with private key, | |
263 | which is the default. | |
264 | OSSL_CRMF_POPO_KEYENC - decrypt the encrypted certificate | |
265 | ("indirect method") | |
266 | ||
267 | Note that a signature-based POPO can only be produced if a private key | |
92cae9b4 | 268 | is provided as the newPkey or client's pkey component of the CMP context. |
7960dbec DDO |
269 | |
270 | =item B<OSSL_CMP_OPT_DIGEST_ALGNID> | |
271 | ||
d3d0784e DDO |
272 | The NID of the digest algorithm to be used in RFC 4210's MSG_SIG_ALG |
273 | for signature-based message protection and Proof-of-Possession (POPO). | |
7960dbec DDO |
274 | Default is SHA256. |
275 | ||
d3d0784e DDO |
276 | =item B<OSSL_CMP_OPT_OWF_ALGNID> |
277 | The NID of the digest algorithm to be used as one-way function (OWF) | |
278 | in RFC 4210's MSG_MAC_ALG for PBM-based message protection. | |
7960dbec DDO |
279 | Default is SHA256. |
280 | ||
d3d0784e DDO |
281 | =item B<OSSL_CMP_OPT_MAC_ALGNID> |
282 | The NID of the MAC algorithm to be used in RFC 4210's MSG_MAC_ALG | |
283 | for PBM-based message protection. | |
7960dbec DDO |
284 | Default is HMAC-SHA1 as per RFC 4210. |
285 | ||
286 | =item B<OSSL_CMP_OPT_REVOCATION_REASON> | |
287 | ||
288 | The reason code to be included in a Revocation Request (RR); | |
289 | values: 0..10 (RFC 5210, 5.3.1) or -1 for none, which is the default. | |
290 | ||
7e765f46 | 291 | =item B<OSSL_CMP_OPT_IMPLICIT_CONFIRM> |
7960dbec DDO |
292 | |
293 | Request server to enable implicit confirm mode, where the client | |
294 | does not need to send confirmation upon receiving the | |
295 | certificate. If the server does not enable implicit confirmation | |
296 | in the return message, then confirmation is sent anyway. | |
297 | ||
7e765f46 | 298 | =item B<OSSL_CMP_OPT_DISABLE_CONFIRM> |
7960dbec DDO |
299 | |
300 | Do not confirm enrolled certificates, to cope with broken servers | |
301 | not supporting implicit confirmation correctly. | |
302 | B<WARNING:> This setting leads to unspecified behavior and it is meant | |
303 | exclusively to allow interoperability with server implementations violating | |
304 | RFC 4210. | |
305 | ||
306 | =item B<OSSL_CMP_OPT_UNPROTECTED_SEND> | |
307 | ||
308 | Send messages without CMP-level protection. | |
309 | ||
310 | =item B<OSSL_CMP_OPT_UNPROTECTED_ERRORS> | |
311 | ||
312 | Accept unprotected error responses which are either explicitly | |
313 | unprotected or where protection verification failed. Applies to regular | |
314 | error messages as well as certificate responses (IP/CP/KUP) and | |
315 | revocation responses (RP) with rejection. | |
316 | B<WARNING:> This setting leads to unspecified behavior and it is meant | |
317 | exclusively to allow interoperability with server implementations violating | |
318 | RFC 4210. | |
319 | ||
320 | =item B<OSSL_CMP_OPT_IGNORE_KEYUSAGE> | |
321 | ||
aad086e2 | 322 | Ignore key usage restrictions in the signer's certificate when |
7960dbec DDO |
323 | validating signature-based protection in received CMP messages. |
324 | Else, 'digitalSignature' must be allowed by CMP signer certificates. | |
325 | ||
326 | =item B<OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR> | |
327 | ||
328 | Allow retrieving a trust anchor from extraCerts and using that | |
329 | to validate the certificate chain of an IP message. | |
330 | ||
331 | =back | |
332 | ||
333 | OSSL_CMP_CTX_get_option() reads the current value of the given option | |
7e765f46 | 334 | (e.g., OSSL_CMP_OPT_IMPLICIT_CONFIRM) from the given OSSL_CMP_CTX structure. |
7960dbec | 335 | |
aad086e2 | 336 | OSSL_CMP_CTX_set_log_cb() sets in I<ctx> the callback function I<cb> |
7960dbec | 337 | for handling error queue entries and logging messages. |
aad086e2 | 338 | When I<cb> is NULL errors are printed to STDERR (if available, else ignored) |
7960dbec DDO |
339 | any log messages are ignored. |
340 | Alternatively, L<OSSL_CMP_log_open(3)> may be used to direct logging to STDOUT. | |
341 | ||
342 | OSSL_CMP_CTX_set_log_verbosity() is a macro setting the | |
343 | OSSL_CMP_OPT_LOG_VERBOSITY context option to the given level. | |
344 | ||
aad086e2 DDO |
345 | OSSL_CMP_CTX_print_errors() outputs any entries in the OpenSSL error queue. It |
346 | is similar to L<ERR_print_errors_cb(3)> but uses the CMP log callback function | |
f5f4fbaa | 347 | if set in the I<ctx> for uniformity with CMP logging if given. Otherwise it uses |
aad086e2 | 348 | L<ERR_print_errors(3)> to print to STDERR (unless OPENSSL_NO_STDIO is defined). |
7960dbec | 349 | |
4b1fe471 DDO |
350 | OSSL_CMP_CTX_set1_serverPath() sets the HTTP path of the CMP server on the host, |
351 | also known as "CMP alias". | |
aad086e2 | 352 | The default is C</>. |
7960dbec | 353 | |
aad086e2 DDO |
354 | OSSL_CMP_CTX_set1_server() sets the given server I<address> |
355 | (which may be a hostname or IP address or NULL) in the given I<ctx>. | |
7960dbec DDO |
356 | |
357 | OSSL_CMP_CTX_set_serverPort() sets the port of the CMP server to connect to. | |
aad086e2 | 358 | If not used or the I<port> argument is 0 |
4b1fe471 DDO |
359 | the default port applies, which is 80 for HTTP and 443 for HTTPS. |
360 | ||
361 | OSSL_CMP_CTX_set1_proxy() sets the HTTP proxy to be used for connecting to | |
362 | the given CMP server unless overruled by any "no_proxy" settings (see below). | |
363 | If TLS is not used this defaults to the value of | |
aad086e2 DDO |
364 | the environment variable C<http_proxy> if set, else C<HTTP_PROXY>. |
365 | Otherwise defaults to the value of C<https_proxy> if set, else C<HTTPS_PROXY>. | |
4b1fe471 | 366 | An empty proxy string specifies not to use a proxy. |
aad086e2 | 367 | Else the format is C<[http[s]://]address[:port][/path]>, |
4b1fe471 | 368 | where any path given is ignored. |
aad086e2 | 369 | The default port number is 80, or 443 in case C<https:> is given. |
7960dbec | 370 | |
afe554c2 DDO |
371 | OSSL_CMP_CTX_set1_no_proxy() sets the list of server hostnames not to use |
372 | an HTTP proxy for. The names may be separated by commas and/or whitespace. | |
aad086e2 | 373 | Defaults to the environment variable C<no_proxy> if set, else C<NO_PROXY>. |
7960dbec | 374 | |
29f178bd | 375 | OSSL_CMP_CTX_set_http_cb() sets the optional BIO connect/disconnect callback |
7960dbec DDO |
376 | function, which has the prototype |
377 | ||
29f178bd | 378 | typedef BIO *(*HTTP_bio_cb_t) (BIO *bio, void *ctx, int connect, int detail); |
7960dbec | 379 | |
aad086e2 DDO |
380 | The callback may modify the I<bio> provided by L<OSSL_CMP_MSG_http_perform(3)>, |
381 | whereby it may make use of a custom defined argument I<ctx> | |
29f178bd | 382 | stored in the OSSL_CMP_CTX by means of OSSL_CMP_CTX_set_http_cb_arg(). |
e98c7350 | 383 | During connection establishment, just after calling BIO_do_connect_retry(), |
aad086e2 | 384 | the function is invoked with the I<connect> argument being 1 and the I<detail> |
29f178bd | 385 | argument being 1 if HTTPS is requested, i.e., SSL/TLS should be enabled. On |
aad086e2 | 386 | disconnect I<connect> is 0 and I<detail> is 1 in case no error occurred, else 0. |
29f178bd DDO |
387 | For instance, on connect the function may prepend a TLS BIO to implement HTTPS; |
388 | after disconnect it may do some diagnostic output and/or specific cleanup. | |
389 | The function should return NULL to indicate failure. | |
390 | After disconnect the modified BIO will be deallocated using BIO_free_all(). | |
7960dbec DDO |
391 | |
392 | OSSL_CMP_CTX_set_http_cb_arg() sets an argument, respectively a pointer to | |
393 | a structure containing arguments, | |
394 | optionally to be used by the http connect/disconnect callback function. | |
aad086e2 DDO |
395 | I<arg> is not consumed, and it must therefore explicitly be freed when not |
396 | needed any more. I<arg> may be NULL to clear the entry. | |
7960dbec DDO |
397 | |
398 | OSSL_CMP_CTX_get_http_cb_arg() gets the argument, respectively the pointer to a | |
399 | structure containing arguments, previously set by | |
400 | OSSL_CMP_CTX_set_http_cb_arg() or NULL if unset. | |
401 | ||
402 | OSSL_CMP_CTX_set_transfer_cb() sets the message transfer callback function, | |
403 | which has the type | |
404 | ||
7e765f46 | 405 | typedef OSSL_CMP_MSG *(*OSSL_CMP_transfer_cb_t) (OSSL_CMP_CTX *ctx, |
29f178bd DDO |
406 | const OSSL_CMP_MSG *req); |
407 | ||
7960dbec DDO |
408 | Returns 1 on success, 0 on error. |
409 | ||
410 | Default is NULL, which implies the use of L<OSSL_CMP_MSG_http_perform(3)>. | |
aad086e2 | 411 | The callback should send the CMP request message it obtains via the I<req> |
7e765f46 | 412 | parameter and on success return the response, else it must return NULL. |
7960dbec DDO |
413 | The transfer callback may make use of a custom defined argument stored in |
414 | the ctx by means of OSSL_CMP_CTX_set_transfer_cb_arg(), which may be retrieved | |
415 | again through OSSL_CMP_CTX_get_transfer_cb_arg(). | |
7960dbec | 416 | |
7960dbec DDO |
417 | OSSL_CMP_CTX_set_transfer_cb_arg() sets an argument, respectively a pointer to a |
418 | structure containing arguments, optionally to be used by the transfer callback. | |
aad086e2 DDO |
419 | I<arg> is not consumed, and it must therefore explicitly be freed when not |
420 | needed any more. I<arg> may be NULL to clear the entry. | |
7960dbec DDO |
421 | |
422 | OSSL_CMP_CTX_get_transfer_cb_arg() gets the argument, respectively the pointer | |
423 | to a structure containing arguments, previously set by | |
424 | OSSL_CMP_CTX_set_transfer_cb_arg() or NULL if unset. | |
425 | ||
aad086e2 | 426 | OSSL_CMP_CTX_set1_srvCert() sets the expected server cert in I<ctx> and trusts |
0d17c2f4 | 427 | it directly (even if it is expired) when verifying signed response messages. |
6be83cc6 | 428 | May be used alternatively to OSSL_CMP_CTX_set0_trusted() |
0d17c2f4 DDO |
429 | to pin the accepted server. |
430 | Any previously set value is freed. | |
aad086e2 | 431 | The I<cert> argument may be NULL to clear the entry. |
0d17c2f4 DDO |
432 | If set, the subject of the certificate is also used |
433 | as default value for the recipient of CMP requests | |
434 | and as default value for the expected sender of CMP responses. | |
435 | ||
436 | OSSL_CMP_CTX_set1_expected_sender() sets the Distinguished Name (DN) | |
6d934add | 437 | expected in the sender field of CMP response messages. |
aad086e2 | 438 | Defaults to the subject of the pinned server certificate, if any. |
0d17c2f4 DDO |
439 | This can be used to make sure that only a particular entity is accepted as |
440 | CMP message signer, and attackers are not able to use arbitrary certificates | |
441 | of a trusted PKI hierarchy to fraudulently pose as CMP server. | |
442 | Note that this gives slightly more freedom than OSSL_CMP_CTX_set1_srvCert(), | |
443 | which pins the server to the holder of a particular certificate, while the | |
444 | expected sender name will continue to match after updates of the server cert. | |
445 | ||
6be83cc6 DDO |
446 | OSSL_CMP_CTX_set0_trusted() is an alias of the original |
447 | OSSL_CMP_CTX_set0_trustedStore(). | |
448 | It sets in the CMP context I<ctx> the certificate store of type X509_STORE | |
0d17c2f4 DDO |
449 | containing trusted (root) CA certificates. |
450 | The store may also hold CRLs and | |
451 | a certificate verification callback function used for CMP server authentication. | |
452 | Any store entry already set before is freed. | |
453 | When given a NULL parameter the entry is cleared. | |
454 | ||
6be83cc6 DDO |
455 | OSSL_CMP_CTX_get0_trusted() is an alias of the original |
456 | OSSL_CMP_CTX_get0_trustedStore(). | |
457 | It extracts from the CMP context I<ctx> the pointer to the currently set | |
0d17c2f4 | 458 | certificate store containing trusted cert etc., or an empty store if unset. |
7960dbec | 459 | |
0b86eefd | 460 | OSSL_CMP_CTX_set1_untrusted() sets up a list of non-trusted certificates |
8b22c283 DDO |
461 | of intermediate CAs that may be useful for path construction for the CMP client |
462 | certificate, for the TLS client certificate (if any), when verifying | |
463 | the CMP server certificate, and when verifying newly enrolled certificates. | |
7960dbec DDO |
464 | The reference counts of those certificates handled successfully are increased. |
465 | ||
2da163cb DDO |
466 | OSSL_CMP_CTX_get0_untrusted() returns a pointer to the |
467 | list of untrusted certs in I<ctx>, which may be empty if unset. | |
7960dbec | 468 | |
92cae9b4 | 469 | OSSL_CMP_CTX_set1_cert() sets the certificate related to the client's private key |
aad086e2 DDO |
470 | used for CMP message protection. |
471 | Therefore the public key of this I<cert> must correspond to | |
472 | the private key set before or thereafter via OSSL_CMP_CTX_set1_pkey(). | |
62dcd2aa | 473 | When using signature-based protection of CMP request messages |
aad086e2 | 474 | this CMP signer certificate will be included first in the extraCerts field. |
d718521f | 475 | It serves as fallback reference certificate, see OSSL_CMP_CTX_set1_oldCert(). |
aad086e2 | 476 | The subject of this I<cert> will be used as the sender field of outgoing |
cd7ec0bc DDO |
477 | messages, while the subject of any cert set via OSSL_CMP_CTX_set1_oldCert(), |
478 | the subject of any PKCS#10 CSR set via OSSL_CMP_CTX_set1_p10CSR(), | |
aad086e2 | 479 | and any value set via OSSL_CMP_CTX_set1_subjectName() are used as fallback. |
d718521f | 480 | |
aad086e2 | 481 | The I<cert> argument may be NULL to clear the entry. |
62dcd2aa | 482 | |
15076c26 | 483 | OSSL_CMP_CTX_build_cert_chain() builds a certificate chain for the CMP signer |
aad086e2 | 484 | certificate previously set in the I<ctx>. It adds the optional I<candidates>, |
15076c26 | 485 | a list of intermediate CA certs that may already constitute the targeted chain, |
aad086e2 | 486 | to the untrusted certs that may already exist in the I<ctx>. |
15076c26 DDO |
487 | Then the function uses this augumented set of certs for chain construction. |
488 | If I<own_trusted> is NULL it builds the chain as far down as possible and | |
489 | ignores any verification errors. Else the CMP signer certificate must be | |
490 | verifiable where the chain reaches a trust anchor contained in I<own_trusted>. | |
aad086e2 | 491 | On success the function stores the resulting chain in I<ctx> |
15076c26 DDO |
492 | for inclusion in the extraCerts field of signature-protected messages. |
493 | Calling this function is optional; by default a chain construction | |
494 | is performed on demand that is equivalent to calling this function | |
aad086e2 | 495 | with the I<candidates> and I<own_trusted> arguments being NULL. |
15076c26 | 496 | |
92cae9b4 | 497 | OSSL_CMP_CTX_set1_pkey() sets the client's private key corresponding to the |
aad086e2 | 498 | CMP signer certificate set via OSSL_CMP_CTX_set1_cert(). |
62dcd2aa DDO |
499 | This key is used create signature-based protection (protectionAlg = MSG_SIG_ALG) |
500 | of outgoing messages | |
aad086e2 DDO |
501 | unless a PBM secret has been set via OSSL_CMP_CTX_set1_secretValue(). |
502 | The I<pkey> argument may be NULL to clear the entry. | |
62dcd2aa | 503 | |
aad086e2 DDO |
504 | OSSL_CMP_CTX_set1_secretValue() sets the byte string I<sec> with length I<len> |
505 | as PBM secret in the given I<ctx> or clears it if the I<sec> argument is NULL. | |
62dcd2aa DDO |
506 | If present, this secret is used to create PBM-based protection of outgoing |
507 | messages and to verify any PBM-based protection of incoming messages | |
508 | (protectionAlg = MSG_MAC_ALG). PBM stands for Password-Based MAC. | |
509 | PBM-based protection takes precedence over signature-based protection. | |
510 | ||
aad086e2 DDO |
511 | OSSL_CMP_CTX_set1_referenceValue() sets the given referenceValue I<ref> with |
512 | length I<len> in the given I<ctx> or clears it if the I<ref> argument is NULL. | |
8b22c283 | 513 | According to RFC 4210 section 5.1.1, if no value for the sender field in |
aad086e2 DDO |
514 | CMP message headers can be determined (i.e., no CMP signer certificate |
515 | and no subject DN is set via OSSL_CMP_CTX_set1_subjectName() | |
516 | then the sender field will contain the NULL-DN | |
62dcd2aa DDO |
517 | and the senderKID field of the CMP message header must be set. |
518 | When signature-based protection is used the senderKID will be set to | |
aad086e2 | 519 | the subjectKeyIdentifier of the CMP signer certificate as far as present. |
62dcd2aa | 520 | If not present or when PBM-based protection is used |
aad086e2 | 521 | the I<ref> value is taken as the fallback value for the senderKID. |
7960dbec DDO |
522 | |
523 | OSSL_CMP_CTX_set1_recipient() sets the recipient name that will be used in the | |
0d17c2f4 DDO |
524 | PKIHeader of CMP request messages, i.e. the X509 name of the (CA) server. |
525 | ||
526 | The recipient field in the header of a CMP message is mandatory. | |
527 | If not given explicitly the recipient is determined in the following order: | |
528 | the subject of the CMP server certificate set using OSSL_CMP_CTX_set1_srvCert(), | |
529 | the value set using OSSL_CMP_CTX_set1_issuer(), | |
530 | the issuer of the certificate set using OSSL_CMP_CTX_set1_oldCert(), | |
aad086e2 | 531 | the issuer of the CMP signer certificate, |
0d17c2f4 | 532 | as far as any of those is present, else the NULL-DN as last resort. |
7960dbec | 533 | |
aad086e2 | 534 | OSSL_CMP_CTX_push0_geninfo_ITAV() adds I<itav> to the stack in the I<ctx> to be |
7960dbec | 535 | added to the GeneralInfo field of the CMP PKIMessage header of a request |
cfca56df | 536 | message sent with this context. |
7960dbec | 537 | |
a2ede039 DDO |
538 | OSSL_CMP_CTX_reset_geninfo_ITAVs() |
539 | clears any ITAVs that were added by OSSL_CMP_CTX_push0_geninfo_ITAV(). | |
540 | ||
7960dbec DDO |
541 | OSSL_CMP_CTX_set1_extraCertsOut() sets the stack of extraCerts that will be |
542 | sent to remote. | |
543 | ||
544 | OSSL_CMP_CTX_set0_newPkey() can be used to explicitly set the given EVP_PKEY | |
545 | structure as the private or public key to be certified in the CMP context. | |
aad086e2 | 546 | The I<priv> parameter must be 0 if and only if the given key is a public key. |
7960dbec DDO |
547 | |
548 | OSSL_CMP_CTX_get0_newPkey() gives the key to use for certificate enrollment | |
549 | dependent on fields of the CMP context structure: | |
550 | the newPkey (which may be a private or public key) if present, | |
92cae9b4 | 551 | else the public key in the p10CSR if present, else the client's private key. |
aad086e2 | 552 | If the I<priv> parameter is not 0 and the selected key does not have a |
7960dbec DDO |
553 | private component then NULL is returned. |
554 | ||
555 | OSSL_CMP_CTX_set1_issuer() sets the name of the intended issuer that | |
556 | will be set in the CertTemplate, i.e., the X509 name of the CA server. | |
557 | ||
558 | OSSL_CMP_CTX_set1_subjectName() sets the subject DN that will be used in | |
559 | the CertTemplate structure when requesting a new cert. For Key Update Requests | |
aad086e2 DDO |
560 | (KUR), it defaults to the subject DN of the reference certificate, |
561 | see OSSL_CMP_CTX_set1_oldCert(). This default is used for Initialization | |
7960dbec | 562 | Requests (IR) and Certification Requests (CR) only if no SANs are set. |
aad086e2 DDO |
563 | The I<subjectName> is also used as fallback for the sender field |
564 | of outgoing CMP messages if no reference certificate is available. | |
7960dbec DDO |
565 | |
566 | OSSL_CMP_CTX_push1_subjectAltName() adds the given X509 name to the list of | |
567 | alternate names on the certificate template request. This cannot be used if | |
568 | any Subject Alternative Name extension is set via | |
569 | OSSL_CMP_CTX_set0_reqExtensions(). | |
c8c92345 | 570 | By default, unless B<OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT> has been set, |
aad086e2 DDO |
571 | the Subject Alternative Names are copied from the reference certificate, |
572 | see OSSL_CMP_CTX_set1_oldCert(). | |
573 | If set and the subject DN is not set with OSSL_CMP_CTX_set1_subjectName() then | |
7960dbec | 574 | the certificate template of an IR and CR will not be filled with the default |
aad086e2 | 575 | subject DN from the reference certificate. |
7960dbec DDO |
576 | If a subject DN is desired it needs to be set explicitly with |
577 | OSSL_CMP_CTX_set1_subjectName(). | |
578 | ||
579 | OSSL_CMP_CTX_set0_reqExtensions() sets the X.509v3 extensions to be used in | |
580 | IR/CR/KUR. | |
581 | ||
582 | OSSL_CMP_CTX_reqExtensions_have_SAN() returns 1 if the context contains | |
583 | a Subject Alternative Name extension, else 0 or -1 on error. | |
584 | ||
585 | OSSL_CMP_CTX_push0_policy() adds the certificate policy info object | |
586 | to the X509_EXTENSIONS of the requested certificate template. | |
587 | ||
588 | OSSL_CMP_CTX_set1_oldCert() sets the old certificate to be updated in | |
589 | Key Update Requests (KUR) or to be revoked in Revocation Requests (RR). | |
aad086e2 | 590 | It must be given for RR, else it defaults to the CMP signer certificate. |
c8c92345 DDO |
591 | The I<reference certificate> determined in this way, if any, is also used for |
592 | deriving default subject DN, public key, Subject Alternative Names, and the | |
d718521f | 593 | default issuer entry in the requested certificate template of IR/CR/KUR. |
aad086e2 DDO |
594 | The subject of the reference certificate is used as the sender field value |
595 | in CMP message headers. | |
16931355 | 596 | Its issuer is used as default recipient in CMP message headers. |
7960dbec | 597 | |
c8c92345 DDO |
598 | OSSL_CMP_CTX_set1_p10CSR() sets the PKCS#10 CSR to use in P10CR messages. |
599 | If such a CSR is provided, its subject, public key, and extension fields are | |
600 | also used as fallback values for the certificate template of IR/CR/KUR messages. | |
7960dbec | 601 | |
aad086e2 | 602 | OSSL_CMP_CTX_push0_genm_ITAV() adds I<itav> to the stack in the I<ctx> which |
7960dbec | 603 | will be the body of a General Message sent with this context. |
7960dbec | 604 | |
a0745e2b DDO |
605 | OSSL_CMP_certConf_cb() is the default certificate confirmation callback function. |
606 | If the callback argument is not NULL it must point to a trust store. | |
607 | In this case the function checks that the newly enrolled certificate can be | |
aad086e2 | 608 | verified using this trust store and untrusted certificates from the I<ctx>, |
a0745e2b DDO |
609 | which have been augmented by the list of extraCerts received. |
610 | If the callback argument is NULL the function tries building an approximate | |
aad086e2 | 611 | chain as far as possible using the same untrusted certificates from the I<ctx>, |
a0745e2b DDO |
612 | and if this fails it takes the received extraCerts as fallback. |
613 | The resulting cert chain can be retrieved using OSSL_CMP_CTX_get1_newChain(). | |
614 | ||
7960dbec DDO |
615 | OSSL_CMP_CTX_set_certConf_cb() sets the callback used for evaluating the newly |
616 | enrolled certificate before the library sends, depending on its result, | |
617 | a positive or negative certConf message to the server. The callback has type | |
618 | ||
7e765f46 | 619 | typedef int (*OSSL_CMP_certConf_cb_t) (OSSL_CMP_CTX *ctx, X509 *cert, |
7960dbec DDO |
620 | int fail_info, const char **txt); |
621 | ||
aad086e2 DDO |
622 | and should inspect the certificate it obtains via the I<cert> parameter and may |
623 | overrule the pre-decision given in the I<fail_info> and I<*txt> parameters. | |
7960dbec DDO |
624 | If it accepts the certificate it must return 0, indicating success. Else it must |
625 | return a bit field reflecting PKIFailureInfo with at least one failure bit and | |
aad086e2 | 626 | may set the I<*txt> output parameter to point to a string constant with more |
7960dbec | 627 | detail. The transfer callback may make use of a custom defined argument stored |
aad086e2 | 628 | in the I<ctx> by means of OSSL_CMP_CTX_set_certConf_cb_arg(), which may be |
7960dbec DDO |
629 | retrieved again through OSSL_CMP_CTX_get_certConf_cb_arg(). |
630 | Typically, the callback will check at least that the certificate can be verified | |
631 | using a set of trusted certificates. | |
632 | It also could compare the subject DN and other fields of the newly | |
633 | enrolled certificate with the certificate template of the request. | |
634 | ||
635 | OSSL_CMP_CTX_set_certConf_cb_arg() sets an argument, respectively a pointer to a | |
636 | structure containing arguments, optionally to be used by the certConf callback. | |
aad086e2 DDO |
637 | I<arg> is not consumed, and it must therefore explicitly be freed when not |
638 | needed any more. I<arg> may be NULL to clear the entry. | |
7960dbec DDO |
639 | |
640 | OSSL_CMP_CTX_get_certConf_cb_arg() gets the argument, respectively the pointer | |
641 | to a structure containing arguments, previously set by | |
642 | OSSL_CMP_CTX_set_certConf_cb_arg(), or NULL if unset. | |
643 | ||
19ddcc4c DDO |
644 | OSSL_CMP_CTX_get_status() returns for client contexts the PKIstatus from |
645 | the last received CertRepMessage or Revocation Response or error message: | |
a53d4f83 | 646 | =item B<OSSL_CMP_PKISTATUS_accepted> on successful receipt of a GENP message: |
19ddcc4c DDO |
647 | |
648 | =over 4 | |
649 | ||
650 | =item B<OSSL_CMP_PKISTATUS_request> | |
651 | ||
652 | if an IR/CR/KUR/RR/GENM request message could not be produced, | |
653 | ||
654 | =item B<OSSL_CMP_PKISTATUS_trans> | |
655 | ||
656 | on a transmission error or transaction error for this type of request, and | |
657 | ||
658 | =item B<OSSL_CMP_PKISTATUS_unspecified> | |
659 | ||
660 | if no such request was attempted or OSSL_CMP_CTX_reinit() has been called. | |
661 | ||
662 | =back | |
663 | ||
664 | For server contexts it returns | |
665 | B<OSSL_CMP_PKISTATUS_trans> if a transaction is open, | |
666 | otherwise B<OSSL_CMP_PKISTATUS_unspecified>. | |
7960dbec DDO |
667 | |
668 | OSSL_CMP_CTX_get0_statusString() returns the statusString from the last received | |
669 | CertRepMessage or Revocation Response or error message, or NULL if unset. | |
670 | ||
671 | OSSL_CMP_CTX_get_failInfoCode() returns the error code from the failInfo field | |
cba0e2af DDO |
672 | of the last received CertRepMessage or Revocation Response or error message, |
673 | or -1 if no such response was received or OSSL_CMP_CTX_reinit() has been called. | |
6e4618a0 RS |
674 | This is a bit field and the flags for it are specified in the header file |
675 | F<< <openssl/cmp.h> >>. | |
7960dbec DDO |
676 | The flags start with OSSL_CMP_CTX_FAILINFO, for example: |
677 | OSSL_CMP_CTX_FAILINFO_badAlg. Returns -1 if the failInfoCode field is unset. | |
678 | ||
b6fbef11 DDO |
679 | OSSL_CMP_CTX_get0_validatedSrvCert() returns |
680 | the successfully validated certificate, if any, that the CMP server used | |
681 | in the current transaction for signature-based response message protection, | |
682 | or NULL if the server used MAC-based protection. | |
683 | The value is relevant only at the end of a successful transaction. | |
684 | It may be used to check the authorization of the server based on its cert. | |
685 | ||
7960dbec DDO |
686 | OSSL_CMP_CTX_get0_newCert() returns the pointer to the newly obtained |
687 | certificate in case it is available, else NULL. | |
688 | ||
39082af2 DDO |
689 | OSSL_CMP_CTX_get1_newChain() returns a pointer to a duplicate of the stack of |
690 | X.509 certificates computed by OSSL_CMP_certConf_cb() (if this function has | |
691 | been called) on the last received certificate response message IP/CP/KUP. | |
692 | ||
bb30bce2 | 693 | OSSL_CMP_CTX_get1_caPubs() returns a pointer to a duplicate of the list of |
1cd77e2e DDO |
694 | X.509 certificates in the caPubs field of the last received certificate |
695 | response message (of type IP, CP, or KUP), | |
696 | or an empty stack if no caPubs have been received in the current transaction. | |
7960dbec | 697 | |
bb30bce2 DDO |
698 | OSSL_CMP_CTX_get1_extraCertsIn() returns a pointer to a duplicate of the list |
699 | of X.509 certificates contained in the extraCerts field of the last received | |
700 | response message (except for pollRep and PKIConf), or | |
701 | an empty stack if no extraCerts have been received in the current transaction. | |
7960dbec DDO |
702 | |
703 | OSSL_CMP_CTX_set1_transactionID() sets the given transaction ID in the given | |
704 | OSSL_CMP_CTX structure. | |
705 | ||
aad086e2 DDO |
706 | OSSL_CMP_CTX_set1_senderNonce() stores the last sent sender I<nonce> in |
707 | the I<ctx>. This will be used to validate the recipNonce in incoming messages. | |
7960dbec DDO |
708 | |
709 | =head1 NOTES | |
710 | ||
711 | CMP is defined in RFC 4210 (and CRMF in RFC 4211). | |
712 | ||
713 | =head1 RETURN VALUES | |
714 | ||
715 | OSSL_CMP_CTX_free() and OSSL_CMP_CTX_print_errors() do not return anything. | |
716 | ||
717 | OSSL_CMP_CTX_new(), | |
2da163cb | 718 | OSSL_CMP_CTX_get0_libctx(), OSSL_CMP_CTX_get0_propq(), |
7960dbec DDO |
719 | OSSL_CMP_CTX_get_http_cb_arg(), |
720 | OSSL_CMP_CTX_get_transfer_cb_arg(), | |
6be83cc6 | 721 | OSSL_CMP_CTX_get0_trusted(), |
0b86eefd | 722 | OSSL_CMP_CTX_get0_untrusted(), |
7960dbec DDO |
723 | OSSL_CMP_CTX_get0_newPkey(), |
724 | OSSL_CMP_CTX_get_certConf_cb_arg(), | |
725 | OSSL_CMP_CTX_get0_statusString(), | |
b6fbef11 | 726 | OSSL_CMP_CTX_get0_validatedSrvCert(), |
7960dbec | 727 | OSSL_CMP_CTX_get0_newCert(), |
39082af2 | 728 | OSSL_CMP_CTX_get0_newChain(), |
7960dbec DDO |
729 | OSSL_CMP_CTX_get1_caPubs(), and |
730 | OSSL_CMP_CTX_get1_extraCertsIn() | |
731 | return the intended pointer value as described above or NULL on error. | |
732 | ||
733 | OSSL_CMP_CTX_get_option(), | |
734 | OSSL_CMP_CTX_reqExtensions_have_SAN(), | |
735 | OSSL_CMP_CTX_get_status(), and | |
736 | OSSL_CMP_CTX_get_failInfoCode() | |
737 | return the intended value as described above or -1 on error. | |
738 | ||
aad086e2 DDO |
739 | OSSL_CMP_certConf_cb() returns I<fail_info> if it is not equal to 0, |
740 | else 0 on successful validation, | |
a0745e2b DDO |
741 | or else a bit field with the B<OSSL_CMP_PKIFAILUREINFO_incorrectData> bit set. |
742 | ||
a2ede039 DDO |
743 | All other functions, including OSSL_CMP_CTX_reinit() |
744 | and OSSL_CMP_CTX_reset_geninfo_ITAVs(), | |
1c04866c | 745 | return 1 on success, 0 on error. |
7960dbec DDO |
746 | |
747 | =head1 EXAMPLES | |
748 | ||
63f1883d | 749 | The following code omits error handling. |
7960dbec | 750 | |
63f1883d | 751 | Set up a CMP client context for sending requests and verifying responses: |
7960dbec | 752 | |
63f1883d DDO |
753 | cmp_ctx = OSSL_CMP_CTX_new(); |
754 | OSSL_CMP_CTX_set1_server(cmp_ctx, name_or_address); | |
755 | OSSL_CMP_CTX_set1_serverPort(cmp_ctx, port_string); | |
756 | OSSL_CMP_CTX_set1_serverPath(cmp_ctx, path_or_alias); | |
6be83cc6 | 757 | OSSL_CMP_CTX_set0_trusted(cmp_ctx, ts); |
7960dbec | 758 | |
63f1883d | 759 | Set up client credentials for password-based protection (PBM): |
7960dbec | 760 | |
63f1883d DDO |
761 | OSSL_CMP_CTX_set1_referenceValue(cmp_ctx, ref, ref_len); |
762 | OSSL_CMP_CTX_set1_secretValue(cmp_ctx, sec, sec_len); | |
7960dbec | 763 | |
63f1883d | 764 | Set up the details for certificate requests: |
7960dbec | 765 | |
63f1883d DDO |
766 | OSSL_CMP_CTX_set1_subjectName(cmp_ctx, name); |
767 | OSSL_CMP_CTX_set0_newPkey(cmp_ctx, 1, initialKey); | |
7960dbec | 768 | |
63f1883d | 769 | Perform an Initialization Request transaction: |
7960dbec | 770 | |
63f1883d | 771 | initialCert = OSSL_CMP_exec_IR_ses(cmp_ctx); |
7960dbec | 772 | |
63f1883d | 773 | Reset the transaction state of the CMP context and the credentials: |
7960dbec | 774 | |
63f1883d DDO |
775 | OSSL_CMP_CTX_reinit(cmp_ctx); |
776 | OSSL_CMP_CTX_set1_referenceValue(cmp_ctx, NULL, 0); | |
777 | OSSL_CMP_CTX_set1_secretValue(cmp_ctx, NULL, 0); | |
7960dbec | 778 | |
63f1883d | 779 | Perform a Certification Request transaction, making use of the new credentials: |
7960dbec | 780 | |
63f1883d DDO |
781 | OSSL_CMP_CTX_set1_cert(cmp_ctx, initialCert); |
782 | OSSL_CMP_CTX_set1_pkey(cmp_ctx, initialKey); | |
783 | OSSL_CMP_CTX_set0_newPkey(cmp_ctx, 1, curentKey); | |
784 | currentCert = OSSL_CMP_exec_CR_ses(cmp_ctx); | |
785 | ||
786 | Perform a Key Update Request, signed using the cert (and key) to be updated: | |
787 | ||
788 | OSSL_CMP_CTX_reinit(cmp_ctx); | |
789 | OSSL_CMP_CTX_set1_cert(cmp_ctx, currentCert); | |
790 | OSSL_CMP_CTX_set1_pkey(cmp_ctx, currentKey); | |
791 | OSSL_CMP_CTX_set0_newPkey(cmp_ctx, 1, updatedKey); | |
792 | currentCert = OSSL_CMP_exec_KUR_ses(cmp_ctx); | |
793 | currentKey = updatedKey; | |
794 | ||
795 | Perform a General Message transaction including, as an example, | |
796 | the id-it-signKeyPairTypes OID and prints info on the General Response contents: | |
797 | ||
798 | OSSL_CMP_CTX_reinit(cmp_ctx); | |
7960dbec DDO |
799 | |
800 | ASN1_OBJECT *type = OBJ_txt2obj("1.3.6.1.5.5.7.4.2", 1); | |
1c04866c | 801 | OSSL_CMP_ITAV *itav = OSSL_CMP_ITAV_create(type, NULL); |
7960dbec DDO |
802 | OSSL_CMP_CTX_push0_genm_ITAV(cmp_ctx, itav); |
803 | ||
804 | STACK_OF(OSSL_CMP_ITAV) *itavs; | |
805 | itavs = OSSL_CMP_exec_GENM_ses(cmp_ctx); | |
806 | print_itavs(itavs); | |
807 | sk_OSSL_CMP_ITAV_pop_free(itavs, OSSL_CMP_ITAV_free); | |
808 | ||
809 | =head1 SEE ALSO | |
810 | ||
299e0f1e DDO |
811 | L<OSSL_CMP_exec_IR_ses(3)>, L<OSSL_CMP_exec_CR_ses(3)>, |
812 | L<OSSL_CMP_exec_KUR_ses(3)>, L<OSSL_CMP_exec_GENM_ses(3)>, | |
aad086e2 DDO |
813 | L<OSSL_CMP_exec_certreq(3)>, L<OSSL_CMP_MSG_http_perform(3)>, |
814 | L<ERR_print_errors_cb(3)> | |
7960dbec DDO |
815 | |
816 | =head1 HISTORY | |
817 | ||
818 | The OpenSSL CMP support was added in OpenSSL 3.0. | |
819 | ||
6be83cc6 DDO |
820 | OSSL_CMP_CTX_get0_trustedStore() was renamed to OSSL_CMP_CTX_get0_trusted() and |
821 | OSSL_CMP_CTX_set0_trustedStore() was renamed to OSSL_CMP_CTX_set0_trusted(), | |
822 | using macros, while keeping the old names for backward compatibility, | |
45ada6b9 | 823 | in OpenSSL 3.2. |
6be83cc6 | 824 | |
a2ede039 DDO |
825 | OSSL_CMP_CTX_reset_geninfo_ITAVs() was added in OpenSSL 3.0.8. |
826 | ||
2da163cb DDO |
827 | OSSL_CMP_CTX_get0_libctx(), OSSL_CMP_CTX_get0_propq(), and |
828 | OSSL_CMP_CTX_get0_validatedSrvCert() were added in OpenSSL 3.2. | |
b6fbef11 | 829 | |
7960dbec DDO |
830 | =head1 COPYRIGHT |
831 | ||
fecb3aae | 832 | Copyright 2007-2022 The OpenSSL Project Authors. All Rights Reserved. |
7960dbec DDO |
833 | |
834 | Licensed under the Apache License 2.0 (the "License"). You may not use | |
835 | this file except in compliance with the License. You can obtain a copy | |
836 | in the file LICENSE in the source distribution or at | |
837 | L<https://www.openssl.org/source/license.html>. | |
838 | ||
839 | =cut |