]>
Commit | Line | Data |
---|---|---|
7960dbec DDO |
1 | =pod |
2 | ||
3 | =head1 NAME | |
4 | ||
5 | OSSL_CMP_CTX_new, | |
6 | OSSL_CMP_CTX_free, | |
7 | OSSL_CMP_CTX_reinit, | |
2da163cb | 8 | OSSL_CMP_CTX_get0_libctx, OSSL_CMP_CTX_get0_propq, |
7960dbec DDO |
9 | OSSL_CMP_CTX_set_option, |
10 | OSSL_CMP_CTX_get_option, | |
11 | OSSL_CMP_CTX_set_log_cb, | |
12 | OSSL_CMP_CTX_set_log_verbosity, | |
13 | OSSL_CMP_CTX_print_errors, | |
14 | OSSL_CMP_CTX_set1_serverPath, | |
4b1fe471 | 15 | OSSL_CMP_CTX_set1_server, |
7960dbec | 16 | OSSL_CMP_CTX_set_serverPort, |
afe554c2 DDO |
17 | OSSL_CMP_CTX_set1_proxy, |
18 | OSSL_CMP_CTX_set1_no_proxy, | |
7960dbec DDO |
19 | OSSL_CMP_CTX_set_http_cb, |
20 | OSSL_CMP_CTX_set_http_cb_arg, | |
21 | OSSL_CMP_CTX_get_http_cb_arg, | |
7e765f46 | 22 | OSSL_CMP_transfer_cb_t, |
7960dbec DDO |
23 | OSSL_CMP_CTX_set_transfer_cb, |
24 | OSSL_CMP_CTX_set_transfer_cb_arg, | |
25 | OSSL_CMP_CTX_get_transfer_cb_arg, | |
26 | OSSL_CMP_CTX_set1_srvCert, | |
27 | OSSL_CMP_CTX_set1_expected_sender, | |
6be83cc6 | 28 | OSSL_CMP_CTX_set0_trusted, |
7960dbec | 29 | OSSL_CMP_CTX_set0_trustedStore, |
6be83cc6 | 30 | OSSL_CMP_CTX_get0_trusted, |
7960dbec | 31 | OSSL_CMP_CTX_get0_trustedStore, |
0b86eefd DDO |
32 | OSSL_CMP_CTX_set1_untrusted, |
33 | OSSL_CMP_CTX_get0_untrusted, | |
63f1883d | 34 | OSSL_CMP_CTX_set1_cert, |
15076c26 | 35 | OSSL_CMP_CTX_build_cert_chain, |
7960dbec DDO |
36 | OSSL_CMP_CTX_set1_pkey, |
37 | OSSL_CMP_CTX_set1_referenceValue, | |
38 | OSSL_CMP_CTX_set1_secretValue, | |
39 | OSSL_CMP_CTX_set1_recipient, | |
40 | OSSL_CMP_CTX_push0_geninfo_ITAV, | |
a2ede039 | 41 | OSSL_CMP_CTX_reset_geninfo_ITAVs, |
7960dbec DDO |
42 | OSSL_CMP_CTX_set1_extraCertsOut, |
43 | OSSL_CMP_CTX_set0_newPkey, | |
44 | OSSL_CMP_CTX_get0_newPkey, | |
45 | OSSL_CMP_CTX_set1_issuer, | |
1d32ec20 | 46 | OSSL_CMP_CTX_set1_serialNumber, |
7960dbec DDO |
47 | OSSL_CMP_CTX_set1_subjectName, |
48 | OSSL_CMP_CTX_push1_subjectAltName, | |
49 | OSSL_CMP_CTX_set0_reqExtensions, | |
50 | OSSL_CMP_CTX_reqExtensions_have_SAN, | |
51 | OSSL_CMP_CTX_push0_policy, | |
52 | OSSL_CMP_CTX_set1_oldCert, | |
53 | OSSL_CMP_CTX_set1_p10CSR, | |
54 | OSSL_CMP_CTX_push0_genm_ITAV, | |
7e765f46 | 55 | OSSL_CMP_certConf_cb_t, |
a0745e2b | 56 | OSSL_CMP_certConf_cb, |
7960dbec DDO |
57 | OSSL_CMP_CTX_set_certConf_cb, |
58 | OSSL_CMP_CTX_set_certConf_cb_arg, | |
59 | OSSL_CMP_CTX_get_certConf_cb_arg, | |
60 | OSSL_CMP_CTX_get_status, | |
61 | OSSL_CMP_CTX_get0_statusString, | |
62 | OSSL_CMP_CTX_get_failInfoCode, | |
b6fbef11 | 63 | OSSL_CMP_CTX_get0_validatedSrvCert, |
7960dbec | 64 | OSSL_CMP_CTX_get0_newCert, |
39082af2 | 65 | OSSL_CMP_CTX_get1_newChain, |
7960dbec DDO |
66 | OSSL_CMP_CTX_get1_caPubs, |
67 | OSSL_CMP_CTX_get1_extraCertsIn, | |
68 | OSSL_CMP_CTX_set1_transactionID, | |
69 | OSSL_CMP_CTX_set1_senderNonce | |
70 | - functions for managing the CMP client context data structure | |
71 | ||
72 | =head1 SYNOPSIS | |
73 | ||
74 | #include <openssl/cmp.h> | |
75 | ||
b4250010 | 76 | OSSL_CMP_CTX *OSSL_CMP_CTX_new(OSSL_LIB_CTX *libctx, const char *propq); |
7960dbec DDO |
77 | void OSSL_CMP_CTX_free(OSSL_CMP_CTX *ctx); |
78 | int OSSL_CMP_CTX_reinit(OSSL_CMP_CTX *ctx); | |
2da163cb DDO |
79 | OSSL_LIB_CTX *OSSL_CMP_CTX_get0_libctx(const OSSL_CMP_CTX *ctx); |
80 | const char *OSSL_CMP_CTX_get0_propq(const OSSL_CMP_CTX *ctx); | |
7960dbec DDO |
81 | int OSSL_CMP_CTX_set_option(OSSL_CMP_CTX *ctx, int opt, int val); |
82 | int OSSL_CMP_CTX_get_option(const OSSL_CMP_CTX *ctx, int opt); | |
83 | ||
84 | /* logging and error reporting: */ | |
7e765f46 | 85 | int OSSL_CMP_CTX_set_log_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_log_cb_t cb); |
7960dbec | 86 | #define OSSL_CMP_CTX_set_log_verbosity(ctx, level) |
c4a9e3eb | 87 | void OSSL_CMP_CTX_print_errors(const OSSL_CMP_CTX *ctx); |
7960dbec DDO |
88 | |
89 | /* message transfer: */ | |
90 | int OSSL_CMP_CTX_set1_serverPath(OSSL_CMP_CTX *ctx, const char *path); | |
4b1fe471 | 91 | int OSSL_CMP_CTX_set1_server(OSSL_CMP_CTX *ctx, const char *address); |
7960dbec | 92 | int OSSL_CMP_CTX_set_serverPort(OSSL_CMP_CTX *ctx, int port); |
afe554c2 DDO |
93 | int OSSL_CMP_CTX_set1_proxy(OSSL_CMP_CTX *ctx, const char *name); |
94 | int OSSL_CMP_CTX_set1_no_proxy(OSSL_CMP_CTX *ctx, const char *names); | |
29f178bd | 95 | int OSSL_CMP_CTX_set_http_cb(OSSL_CMP_CTX *ctx, HTTP_bio_cb_t cb); |
7960dbec DDO |
96 | int OSSL_CMP_CTX_set_http_cb_arg(OSSL_CMP_CTX *ctx, void *arg); |
97 | void *OSSL_CMP_CTX_get_http_cb_arg(const OSSL_CMP_CTX *ctx); | |
7e765f46 | 98 | typedef OSSL_CMP_MSG *(*OSSL_CMP_transfer_cb_t)(OSSL_CMP_CTX *ctx, |
29f178bd | 99 | const OSSL_CMP_MSG *req); |
7960dbec | 100 | int OSSL_CMP_CTX_set_transfer_cb(OSSL_CMP_CTX *ctx, |
7e765f46 | 101 | OSSL_CMP_transfer_cb_t cb); |
7960dbec DDO |
102 | int OSSL_CMP_CTX_set_transfer_cb_arg(OSSL_CMP_CTX *ctx, void *arg); |
103 | void *OSSL_CMP_CTX_get_transfer_cb_arg(const OSSL_CMP_CTX *ctx); | |
104 | ||
105 | /* server authentication: */ | |
106 | int OSSL_CMP_CTX_set1_srvCert(OSSL_CMP_CTX *ctx, X509 *cert); | |
107 | int OSSL_CMP_CTX_set1_expected_sender(OSSL_CMP_CTX *ctx, | |
108 | const X509_NAME *name); | |
6be83cc6 | 109 | #define OSSL_CMP_CTX_set0_trusted OSSL_CMP_CTX_set0_trustedStore |
7960dbec | 110 | int OSSL_CMP_CTX_set0_trustedStore(OSSL_CMP_CTX *ctx, X509_STORE *store); |
6be83cc6 | 111 | #define OSSL_CMP_CTX_get0_trusted OSSL_CMP_CTX_get0_trustedStore |
7960dbec | 112 | X509_STORE *OSSL_CMP_CTX_get0_trustedStore(const OSSL_CMP_CTX *ctx); |
0b86eefd DDO |
113 | int OSSL_CMP_CTX_set1_untrusted(OSSL_CMP_CTX *ctx, STACK_OF(X509) *certs); |
114 | STACK_OF(X509) *OSSL_CMP_CTX_get0_untrusted(const OSSL_CMP_CTX *ctx); | |
7960dbec DDO |
115 | |
116 | /* client authentication: */ | |
63f1883d | 117 | int OSSL_CMP_CTX_set1_cert(OSSL_CMP_CTX *ctx, X509 *cert); |
15076c26 DDO |
118 | int OSSL_CMP_CTX_build_cert_chain(OSSL_CMP_CTX *ctx, X509_STORE *own_trusted, |
119 | STACK_OF(X509) *candidates); | |
7960dbec DDO |
120 | int OSSL_CMP_CTX_set1_pkey(OSSL_CMP_CTX *ctx, EVP_PKEY *pkey); |
121 | int OSSL_CMP_CTX_set1_referenceValue(OSSL_CMP_CTX *ctx, | |
122 | const unsigned char *ref, int len); | |
f42d6b7a | 123 | int OSSL_CMP_CTX_set1_secretValue(OSSL_CMP_CTX *ctx, |
6f792f4d | 124 | const unsigned char *sec, int len); |
7960dbec DDO |
125 | |
126 | /* CMP message header and extra certificates: */ | |
127 | int OSSL_CMP_CTX_set1_recipient(OSSL_CMP_CTX *ctx, const X509_NAME *name); | |
128 | int OSSL_CMP_CTX_push0_geninfo_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav); | |
a2ede039 | 129 | int OSSL_CMP_CTX_reset_geninfo_ITAVs(OSSL_CMP_CTX *ctx); |
7960dbec DDO |
130 | int OSSL_CMP_CTX_set1_extraCertsOut(OSSL_CMP_CTX *ctx, |
131 | STACK_OF(X509) *extraCertsOut); | |
132 | ||
133 | /* certificate template: */ | |
134 | int OSSL_CMP_CTX_set0_newPkey(OSSL_CMP_CTX *ctx, int priv, EVP_PKEY *pkey); | |
135 | EVP_PKEY *OSSL_CMP_CTX_get0_newPkey(const OSSL_CMP_CTX *ctx, int priv); | |
136 | int OSSL_CMP_CTX_set1_issuer(OSSL_CMP_CTX *ctx, const X509_NAME *name); | |
1d32ec20 | 137 | int OSSL_CMP_CTX_set1_serialNumber(OSSL_CMP_CTX *ctx, const ASN1_INTEGER *sn); |
7960dbec DDO |
138 | int OSSL_CMP_CTX_set1_subjectName(OSSL_CMP_CTX *ctx, const X509_NAME *name); |
139 | int OSSL_CMP_CTX_push1_subjectAltName(OSSL_CMP_CTX *ctx, | |
140 | const GENERAL_NAME *name); | |
141 | int OSSL_CMP_CTX_set0_reqExtensions(OSSL_CMP_CTX *ctx, X509_EXTENSIONS *exts); | |
142 | int OSSL_CMP_CTX_reqExtensions_have_SAN(OSSL_CMP_CTX *ctx); | |
143 | int OSSL_CMP_CTX_push0_policy(OSSL_CMP_CTX *ctx, POLICYINFO *pinfo); | |
144 | int OSSL_CMP_CTX_set1_oldCert(OSSL_CMP_CTX *ctx, X509 *cert); | |
145 | int OSSL_CMP_CTX_set1_p10CSR(OSSL_CMP_CTX *ctx, const X509_REQ *csr); | |
146 | ||
147 | /* misc body contents: */ | |
148 | int OSSL_CMP_CTX_push0_genm_ITAV(OSSL_CMP_CTX *ctx, OSSL_CMP_ITAV *itav); | |
149 | ||
150 | /* certificate confirmation: */ | |
7e765f46 | 151 | typedef int (*OSSL_CMP_certConf_cb_t)(OSSL_CMP_CTX *ctx, X509 *cert, |
652fba9e | 152 | int fail_info, const char **txt); |
a0745e2b DDO |
153 | int OSSL_CMP_certConf_cb(OSSL_CMP_CTX *ctx, X509 *cert, int fail_info, |
154 | const char **text); | |
7e765f46 | 155 | int OSSL_CMP_CTX_set_certConf_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_certConf_cb_t cb); |
7960dbec DDO |
156 | int OSSL_CMP_CTX_set_certConf_cb_arg(OSSL_CMP_CTX *ctx, void *arg); |
157 | void *OSSL_CMP_CTX_get_certConf_cb_arg(const OSSL_CMP_CTX *ctx); | |
158 | ||
159 | /* result fetching: */ | |
160 | int OSSL_CMP_CTX_get_status(const OSSL_CMP_CTX *ctx); | |
161 | OSSL_CMP_PKIFREETEXT *OSSL_CMP_CTX_get0_statusString(const OSSL_CMP_CTX *ctx); | |
162 | int OSSL_CMP_CTX_get_failInfoCode(const OSSL_CMP_CTX *ctx); | |
163 | ||
b6fbef11 | 164 | X509 *OSSL_CMP_CTX_get0_validatedSrvCert(const OSSL_CMP_CTX *ctx); |
7960dbec | 165 | X509 *OSSL_CMP_CTX_get0_newCert(const OSSL_CMP_CTX *ctx); |
39082af2 | 166 | STACK_OF(X509) *OSSL_CMP_CTX_get1_newChain(const OSSL_CMP_CTX *ctx); |
7960dbec DDO |
167 | STACK_OF(X509) *OSSL_CMP_CTX_get1_caPubs(const OSSL_CMP_CTX *ctx); |
168 | STACK_OF(X509) *OSSL_CMP_CTX_get1_extraCertsIn(const OSSL_CMP_CTX *ctx); | |
169 | ||
7e765f46 | 170 | /* for testing and debugging purposes: */ |
7960dbec DDO |
171 | int OSSL_CMP_CTX_set1_transactionID(OSSL_CMP_CTX *ctx, |
172 | const ASN1_OCTET_STRING *id); | |
173 | int OSSL_CMP_CTX_set1_senderNonce(OSSL_CMP_CTX *ctx, | |
174 | const ASN1_OCTET_STRING *nonce); | |
175 | ||
176 | =head1 DESCRIPTION | |
177 | ||
178 | This is the context API for using CMP (Certificate Management Protocol) with | |
179 | OpenSSL. | |
180 | ||
1a7cd250 DDO |
181 | OSSL_CMP_CTX_new() allocates an B<OSSL_CMP_CTX> structure associated with |
182 | the library context I<libctx> and property query string I<propq>, | |
183 | both of which may be NULL to select the defaults. | |
184 | It initializes the remaining fields to their default values - for instance, | |
185 | the logging verbosity is set to OSSL_CMP_LOG_INFO, | |
186 | the message timeout is set to 120 seconds, | |
187 | and the proof-of-possession method is set to OSSL_CRMF_POPO_SIGNATURE. | |
7960dbec DDO |
188 | |
189 | OSSL_CMP_CTX_free() deallocates an OSSL_CMP_CTX structure. | |
190 | ||
aad086e2 | 191 | OSSL_CMP_CTX_reinit() prepares the given I<ctx> for a further transaction by |
7960dbec | 192 | clearing the internal CMP transaction (aka session) status, PKIStatusInfo, |
39082af2 | 193 | and any previous results (newCert, newChain, caPubs, and extraCertsIn) |
7960dbec | 194 | from the last executed transaction. |
1c04866c | 195 | It also clears any ITAVs that were added by OSSL_CMP_CTX_push0_genm_ITAV(). |
a024ab98 | 196 | All other field values (i.e., CMP options) are retained for potential reuse. |
7960dbec | 197 | |
2da163cb DDO |
198 | OSSL_CMP_CTX_get0_libctx() returns the I<libctx> argument that was used |
199 | when constructing I<ctx> with OSSL_CMP_CTX_new(), which may be NULL. | |
200 | ||
201 | OSSL_CMP_CTX_get0_propq() returns the I<propq> argument that was used | |
202 | when constructing I<ctx> with OSSL_CMP_CTX_new(), which may be NULL. | |
203 | ||
7960dbec | 204 | OSSL_CMP_CTX_set_option() sets the given value for the given option |
7e765f46 | 205 | (e.g., OSSL_CMP_OPT_IMPLICIT_CONFIRM) in the given OSSL_CMP_CTX structure. |
7960dbec DDO |
206 | |
207 | The following options can be set: | |
208 | ||
209 | =over 4 | |
210 | ||
211 | =item B<OSSL_CMP_OPT_LOG_VERBOSITY> | |
212 | ||
213 | The level of severity needed for actually outputting log messages | |
214 | due to errors, warnings, general info, debugging, etc. | |
215 | Default is OSSL_CMP_LOG_INFO. See also L<OSSL_CMP_log_open(3)>. | |
216 | ||
19f97fe6 DDO |
217 | =item B<OSSL_CMP_OPT_KEEP_ALIVE> |
218 | ||
219 | If the given value is 0 then HTTP connections are not kept open | |
220 | after receiving a response, which is the default behavior for HTTP 1.0. | |
221 | If the value is 1 or 2 then persistent connections are requested. | |
222 | If the value is 2 then persistent connections are required, | |
223 | i.e., in case the server does not grant them an error occurs. | |
224 | The default value is 1: prefer to keep the connection open. | |
225 | ||
7e765f46 | 226 | =item B<OSSL_CMP_OPT_MSG_TIMEOUT> |
7960dbec | 227 | |
5acd4007 DDO |
228 | Number of seconds a CMP request-response message round trip |
229 | is allowed to take before a timeout error is returned. | |
230 | A value <= 0 means no limitation (waiting indefinitely). | |
231 | Default is to use the B<OSSL_CMP_OPT_TOTAL_TIMEOUT> setting. | |
7960dbec | 232 | |
7e765f46 | 233 | =item B<OSSL_CMP_OPT_TOTAL_TIMEOUT> |
7960dbec | 234 | |
5acd4007 DDO |
235 | Maximum total number of seconds a transaction may take, |
236 | including polling etc. | |
237 | A value <= 0 means no limitation (waiting indefinitely). | |
238 | Default is 0. | |
7960dbec | 239 | |
7e765f46 | 240 | =item B<OSSL_CMP_OPT_VALIDITY_DAYS> |
7960dbec DDO |
241 | |
242 | Number of days new certificates are asked to be valid for. | |
243 | ||
244 | =item B<OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT> | |
245 | ||
246 | Do not take default Subject Alternative Names | |
247 | from the reference certificate. | |
248 | ||
249 | =item B<OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL> | |
250 | ||
251 | Demand that the given Subject Alternative Names are flagged as critical. | |
252 | ||
253 | =item B<OSSL_CMP_OPT_POLICIES_CRITICAL> | |
254 | ||
255 | Demand that the given policies are flagged as critical. | |
256 | ||
7e765f46 | 257 | =item B<OSSL_CMP_OPT_POPO_METHOD> |
7960dbec DDO |
258 | |
259 | Select the proof of possession method to use. Possible values are: | |
260 | ||
261 | OSSL_CRMF_POPO_NONE - ProofOfPossession field omitted | |
262 | OSSL_CRMF_POPO_RAVERIFIED - assert that the RA has already | |
263 | verified the PoPo | |
264 | OSSL_CRMF_POPO_SIGNATURE - sign a value with private key, | |
265 | which is the default. | |
266 | OSSL_CRMF_POPO_KEYENC - decrypt the encrypted certificate | |
267 | ("indirect method") | |
268 | ||
269 | Note that a signature-based POPO can only be produced if a private key | |
92cae9b4 | 270 | is provided as the newPkey or client's pkey component of the CMP context. |
7960dbec DDO |
271 | |
272 | =item B<OSSL_CMP_OPT_DIGEST_ALGNID> | |
273 | ||
d3d0784e DDO |
274 | The NID of the digest algorithm to be used in RFC 4210's MSG_SIG_ALG |
275 | for signature-based message protection and Proof-of-Possession (POPO). | |
7960dbec DDO |
276 | Default is SHA256. |
277 | ||
d3d0784e DDO |
278 | =item B<OSSL_CMP_OPT_OWF_ALGNID> |
279 | The NID of the digest algorithm to be used as one-way function (OWF) | |
89ed128d DDO |
280 | for MAC-based message protection with password-based MAC (PBM). |
281 | See RFC 4210 section 5.1.3.1 for details. | |
7960dbec DDO |
282 | Default is SHA256. |
283 | ||
d3d0784e | 284 | =item B<OSSL_CMP_OPT_MAC_ALGNID> |
89ed128d | 285 | The NID of the MAC algorithm to be used for message protection with PBM. |
7960dbec DDO |
286 | Default is HMAC-SHA1 as per RFC 4210. |
287 | ||
288 | =item B<OSSL_CMP_OPT_REVOCATION_REASON> | |
289 | ||
290 | The reason code to be included in a Revocation Request (RR); | |
291 | values: 0..10 (RFC 5210, 5.3.1) or -1 for none, which is the default. | |
292 | ||
7e765f46 | 293 | =item B<OSSL_CMP_OPT_IMPLICIT_CONFIRM> |
7960dbec DDO |
294 | |
295 | Request server to enable implicit confirm mode, where the client | |
296 | does not need to send confirmation upon receiving the | |
297 | certificate. If the server does not enable implicit confirmation | |
298 | in the return message, then confirmation is sent anyway. | |
299 | ||
7e765f46 | 300 | =item B<OSSL_CMP_OPT_DISABLE_CONFIRM> |
7960dbec DDO |
301 | |
302 | Do not confirm enrolled certificates, to cope with broken servers | |
303 | not supporting implicit confirmation correctly. | |
304 | B<WARNING:> This setting leads to unspecified behavior and it is meant | |
305 | exclusively to allow interoperability with server implementations violating | |
306 | RFC 4210. | |
307 | ||
308 | =item B<OSSL_CMP_OPT_UNPROTECTED_SEND> | |
309 | ||
260878f7 | 310 | Send request or response messages without CMP-level protection. |
7960dbec DDO |
311 | |
312 | =item B<OSSL_CMP_OPT_UNPROTECTED_ERRORS> | |
313 | ||
314 | Accept unprotected error responses which are either explicitly | |
315 | unprotected or where protection verification failed. Applies to regular | |
316 | error messages as well as certificate responses (IP/CP/KUP) and | |
317 | revocation responses (RP) with rejection. | |
318 | B<WARNING:> This setting leads to unspecified behavior and it is meant | |
319 | exclusively to allow interoperability with server implementations violating | |
320 | RFC 4210. | |
321 | ||
322 | =item B<OSSL_CMP_OPT_IGNORE_KEYUSAGE> | |
323 | ||
aad086e2 | 324 | Ignore key usage restrictions in the signer's certificate when |
7960dbec DDO |
325 | validating signature-based protection in received CMP messages. |
326 | Else, 'digitalSignature' must be allowed by CMP signer certificates. | |
327 | ||
328 | =item B<OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR> | |
329 | ||
330 | Allow retrieving a trust anchor from extraCerts and using that | |
331 | to validate the certificate chain of an IP message. | |
332 | ||
333 | =back | |
334 | ||
335 | OSSL_CMP_CTX_get_option() reads the current value of the given option | |
7e765f46 | 336 | (e.g., OSSL_CMP_OPT_IMPLICIT_CONFIRM) from the given OSSL_CMP_CTX structure. |
7960dbec | 337 | |
aad086e2 | 338 | OSSL_CMP_CTX_set_log_cb() sets in I<ctx> the callback function I<cb> |
7960dbec | 339 | for handling error queue entries and logging messages. |
aad086e2 | 340 | When I<cb> is NULL errors are printed to STDERR (if available, else ignored) |
7960dbec DDO |
341 | any log messages are ignored. |
342 | Alternatively, L<OSSL_CMP_log_open(3)> may be used to direct logging to STDOUT. | |
343 | ||
344 | OSSL_CMP_CTX_set_log_verbosity() is a macro setting the | |
345 | OSSL_CMP_OPT_LOG_VERBOSITY context option to the given level. | |
346 | ||
aad086e2 DDO |
347 | OSSL_CMP_CTX_print_errors() outputs any entries in the OpenSSL error queue. It |
348 | is similar to L<ERR_print_errors_cb(3)> but uses the CMP log callback function | |
f5f4fbaa | 349 | if set in the I<ctx> for uniformity with CMP logging if given. Otherwise it uses |
aad086e2 | 350 | L<ERR_print_errors(3)> to print to STDERR (unless OPENSSL_NO_STDIO is defined). |
7960dbec | 351 | |
4b1fe471 DDO |
352 | OSSL_CMP_CTX_set1_serverPath() sets the HTTP path of the CMP server on the host, |
353 | also known as "CMP alias". | |
aad086e2 | 354 | The default is C</>. |
7960dbec | 355 | |
aad086e2 DDO |
356 | OSSL_CMP_CTX_set1_server() sets the given server I<address> |
357 | (which may be a hostname or IP address or NULL) in the given I<ctx>. | |
7960dbec DDO |
358 | |
359 | OSSL_CMP_CTX_set_serverPort() sets the port of the CMP server to connect to. | |
aad086e2 | 360 | If not used or the I<port> argument is 0 |
4b1fe471 DDO |
361 | the default port applies, which is 80 for HTTP and 443 for HTTPS. |
362 | ||
363 | OSSL_CMP_CTX_set1_proxy() sets the HTTP proxy to be used for connecting to | |
364 | the given CMP server unless overruled by any "no_proxy" settings (see below). | |
365 | If TLS is not used this defaults to the value of | |
aad086e2 DDO |
366 | the environment variable C<http_proxy> if set, else C<HTTP_PROXY>. |
367 | Otherwise defaults to the value of C<https_proxy> if set, else C<HTTPS_PROXY>. | |
4b1fe471 | 368 | An empty proxy string specifies not to use a proxy. |
aad086e2 | 369 | Else the format is C<[http[s]://]address[:port][/path]>, |
4b1fe471 | 370 | where any path given is ignored. |
aad086e2 | 371 | The default port number is 80, or 443 in case C<https:> is given. |
7960dbec | 372 | |
afe554c2 DDO |
373 | OSSL_CMP_CTX_set1_no_proxy() sets the list of server hostnames not to use |
374 | an HTTP proxy for. The names may be separated by commas and/or whitespace. | |
aad086e2 | 375 | Defaults to the environment variable C<no_proxy> if set, else C<NO_PROXY>. |
7960dbec | 376 | |
29f178bd | 377 | OSSL_CMP_CTX_set_http_cb() sets the optional BIO connect/disconnect callback |
7960dbec DDO |
378 | function, which has the prototype |
379 | ||
29f178bd | 380 | typedef BIO *(*HTTP_bio_cb_t) (BIO *bio, void *ctx, int connect, int detail); |
7960dbec | 381 | |
aad086e2 DDO |
382 | The callback may modify the I<bio> provided by L<OSSL_CMP_MSG_http_perform(3)>, |
383 | whereby it may make use of a custom defined argument I<ctx> | |
29f178bd | 384 | stored in the OSSL_CMP_CTX by means of OSSL_CMP_CTX_set_http_cb_arg(). |
e98c7350 | 385 | During connection establishment, just after calling BIO_do_connect_retry(), |
aad086e2 | 386 | the function is invoked with the I<connect> argument being 1 and the I<detail> |
29f178bd | 387 | argument being 1 if HTTPS is requested, i.e., SSL/TLS should be enabled. On |
aad086e2 | 388 | disconnect I<connect> is 0 and I<detail> is 1 in case no error occurred, else 0. |
29f178bd DDO |
389 | For instance, on connect the function may prepend a TLS BIO to implement HTTPS; |
390 | after disconnect it may do some diagnostic output and/or specific cleanup. | |
391 | The function should return NULL to indicate failure. | |
392 | After disconnect the modified BIO will be deallocated using BIO_free_all(). | |
7960dbec DDO |
393 | |
394 | OSSL_CMP_CTX_set_http_cb_arg() sets an argument, respectively a pointer to | |
395 | a structure containing arguments, | |
396 | optionally to be used by the http connect/disconnect callback function. | |
aad086e2 DDO |
397 | I<arg> is not consumed, and it must therefore explicitly be freed when not |
398 | needed any more. I<arg> may be NULL to clear the entry. | |
7960dbec DDO |
399 | |
400 | OSSL_CMP_CTX_get_http_cb_arg() gets the argument, respectively the pointer to a | |
401 | structure containing arguments, previously set by | |
402 | OSSL_CMP_CTX_set_http_cb_arg() or NULL if unset. | |
403 | ||
404 | OSSL_CMP_CTX_set_transfer_cb() sets the message transfer callback function, | |
405 | which has the type | |
406 | ||
7e765f46 | 407 | typedef OSSL_CMP_MSG *(*OSSL_CMP_transfer_cb_t) (OSSL_CMP_CTX *ctx, |
29f178bd DDO |
408 | const OSSL_CMP_MSG *req); |
409 | ||
7960dbec DDO |
410 | Returns 1 on success, 0 on error. |
411 | ||
412 | Default is NULL, which implies the use of L<OSSL_CMP_MSG_http_perform(3)>. | |
aad086e2 | 413 | The callback should send the CMP request message it obtains via the I<req> |
7e765f46 | 414 | parameter and on success return the response, else it must return NULL. |
7960dbec DDO |
415 | The transfer callback may make use of a custom defined argument stored in |
416 | the ctx by means of OSSL_CMP_CTX_set_transfer_cb_arg(), which may be retrieved | |
417 | again through OSSL_CMP_CTX_get_transfer_cb_arg(). | |
7960dbec | 418 | |
7960dbec DDO |
419 | OSSL_CMP_CTX_set_transfer_cb_arg() sets an argument, respectively a pointer to a |
420 | structure containing arguments, optionally to be used by the transfer callback. | |
aad086e2 DDO |
421 | I<arg> is not consumed, and it must therefore explicitly be freed when not |
422 | needed any more. I<arg> may be NULL to clear the entry. | |
7960dbec DDO |
423 | |
424 | OSSL_CMP_CTX_get_transfer_cb_arg() gets the argument, respectively the pointer | |
425 | to a structure containing arguments, previously set by | |
426 | OSSL_CMP_CTX_set_transfer_cb_arg() or NULL if unset. | |
427 | ||
aad086e2 | 428 | OSSL_CMP_CTX_set1_srvCert() sets the expected server cert in I<ctx> and trusts |
0d17c2f4 | 429 | it directly (even if it is expired) when verifying signed response messages. |
260878f7 DDO |
430 | This pins the accepted CMP server |
431 | and results in ignoring whatever may be set using OSSL_CMP_CTX_set0_trusted(). | |
0d17c2f4 | 432 | Any previously set value is freed. |
aad086e2 | 433 | The I<cert> argument may be NULL to clear the entry. |
0d17c2f4 DDO |
434 | If set, the subject of the certificate is also used |
435 | as default value for the recipient of CMP requests | |
436 | and as default value for the expected sender of CMP responses. | |
437 | ||
438 | OSSL_CMP_CTX_set1_expected_sender() sets the Distinguished Name (DN) | |
260878f7 | 439 | expected in the sender field of incoming CMP messages. |
aad086e2 | 440 | Defaults to the subject of the pinned server certificate, if any. |
0d17c2f4 DDO |
441 | This can be used to make sure that only a particular entity is accepted as |
442 | CMP message signer, and attackers are not able to use arbitrary certificates | |
443 | of a trusted PKI hierarchy to fraudulently pose as CMP server. | |
444 | Note that this gives slightly more freedom than OSSL_CMP_CTX_set1_srvCert(), | |
445 | which pins the server to the holder of a particular certificate, while the | |
446 | expected sender name will continue to match after updates of the server cert. | |
447 | ||
6be83cc6 DDO |
448 | OSSL_CMP_CTX_set0_trusted() is an alias of the original |
449 | OSSL_CMP_CTX_set0_trustedStore(). | |
450 | It sets in the CMP context I<ctx> the certificate store of type X509_STORE | |
260878f7 DDO |
451 | containing trusted certificates, typically of root CAs. |
452 | This is ignored when a certificate is pinned using OSSL_CMP_CTX_set1_srvCert(). | |
453 | The store may also hold CRLs and a certificate verification callback function | |
454 | used for signature-based peer authentication. | |
0d17c2f4 DDO |
455 | Any store entry already set before is freed. |
456 | When given a NULL parameter the entry is cleared. | |
457 | ||
6be83cc6 DDO |
458 | OSSL_CMP_CTX_get0_trusted() is an alias of the original |
459 | OSSL_CMP_CTX_get0_trustedStore(). | |
460 | It extracts from the CMP context I<ctx> the pointer to the currently set | |
260878f7 | 461 | certificate store containing trust anchors etc., or an empty store if unset. |
7960dbec | 462 | |
0b86eefd | 463 | OSSL_CMP_CTX_set1_untrusted() sets up a list of non-trusted certificates |
260878f7 DDO |
464 | of intermediate CAs that may be useful for path construction for the own CMP |
465 | signer certificate, for the own TLS certificate (if any), when verifying peer | |
466 | CMP protection certificates, and when verifying newly enrolled certificates. | |
7960dbec DDO |
467 | The reference counts of those certificates handled successfully are increased. |
468 | ||
2da163cb DDO |
469 | OSSL_CMP_CTX_get0_untrusted() returns a pointer to the |
470 | list of untrusted certs in I<ctx>, which may be empty if unset. | |
7960dbec | 471 | |
89ed128d DDO |
472 | OSSL_CMP_CTX_set1_cert() sets the CMP I<signer certificate>, |
473 | also called I<protection certificate>, | |
474 | related to the private key used for signature-based CMP message protection. | |
aad086e2 DDO |
475 | Therefore the public key of this I<cert> must correspond to |
476 | the private key set before or thereafter via OSSL_CMP_CTX_set1_pkey(). | |
62dcd2aa | 477 | When using signature-based protection of CMP request messages |
aad086e2 | 478 | this CMP signer certificate will be included first in the extraCerts field. |
d718521f | 479 | It serves as fallback reference certificate, see OSSL_CMP_CTX_set1_oldCert(). |
aad086e2 | 480 | The subject of this I<cert> will be used as the sender field of outgoing |
cd7ec0bc DDO |
481 | messages, while the subject of any cert set via OSSL_CMP_CTX_set1_oldCert(), |
482 | the subject of any PKCS#10 CSR set via OSSL_CMP_CTX_set1_p10CSR(), | |
aad086e2 | 483 | and any value set via OSSL_CMP_CTX_set1_subjectName() are used as fallback. |
d718521f | 484 | |
aad086e2 | 485 | The I<cert> argument may be NULL to clear the entry. |
62dcd2aa | 486 | |
15076c26 | 487 | OSSL_CMP_CTX_build_cert_chain() builds a certificate chain for the CMP signer |
aad086e2 | 488 | certificate previously set in the I<ctx>. It adds the optional I<candidates>, |
15076c26 | 489 | a list of intermediate CA certs that may already constitute the targeted chain, |
aad086e2 | 490 | to the untrusted certs that may already exist in the I<ctx>. |
f42d6b7a | 491 | Then the function uses this augmented set of certs for chain construction. |
15076c26 DDO |
492 | If I<own_trusted> is NULL it builds the chain as far down as possible and |
493 | ignores any verification errors. Else the CMP signer certificate must be | |
494 | verifiable where the chain reaches a trust anchor contained in I<own_trusted>. | |
aad086e2 | 495 | On success the function stores the resulting chain in I<ctx> |
15076c26 DDO |
496 | for inclusion in the extraCerts field of signature-protected messages. |
497 | Calling this function is optional; by default a chain construction | |
498 | is performed on demand that is equivalent to calling this function | |
aad086e2 | 499 | with the I<candidates> and I<own_trusted> arguments being NULL. |
15076c26 | 500 | |
92cae9b4 | 501 | OSSL_CMP_CTX_set1_pkey() sets the client's private key corresponding to the |
aad086e2 | 502 | CMP signer certificate set via OSSL_CMP_CTX_set1_cert(). |
62dcd2aa DDO |
503 | This key is used create signature-based protection (protectionAlg = MSG_SIG_ALG) |
504 | of outgoing messages | |
89ed128d | 505 | unless a symmetric secret has been set via OSSL_CMP_CTX_set1_secretValue(). |
aad086e2 | 506 | The I<pkey> argument may be NULL to clear the entry. |
62dcd2aa | 507 | |
89ed128d DDO |
508 | OSSL_CMP_CTX_set1_secretValue() sets in I<ctx> the byte string I<sec> of length |
509 | I<len> to use as pre-shared secret, or clears it if the I<sec> argument is NULL. | |
510 | If present, this secret is used to create MAC-based authentication and integrity | |
511 | protection (rather than applying signature-based protection) | |
512 | of outgoing messages and to verify authenticity and integrity of incoming | |
513 | messages that have MAC-based protection (protectionAlg = C<MSG_MAC_ALG>). | |
62dcd2aa | 514 | |
aad086e2 DDO |
515 | OSSL_CMP_CTX_set1_referenceValue() sets the given referenceValue I<ref> with |
516 | length I<len> in the given I<ctx> or clears it if the I<ref> argument is NULL. | |
8b22c283 | 517 | According to RFC 4210 section 5.1.1, if no value for the sender field in |
aad086e2 DDO |
518 | CMP message headers can be determined (i.e., no CMP signer certificate |
519 | and no subject DN is set via OSSL_CMP_CTX_set1_subjectName() | |
520 | then the sender field will contain the NULL-DN | |
62dcd2aa DDO |
521 | and the senderKID field of the CMP message header must be set. |
522 | When signature-based protection is used the senderKID will be set to | |
aad086e2 | 523 | the subjectKeyIdentifier of the CMP signer certificate as far as present. |
89ed128d | 524 | If not present or when MAC-based protection is used |
aad086e2 | 525 | the I<ref> value is taken as the fallback value for the senderKID. |
7960dbec DDO |
526 | |
527 | OSSL_CMP_CTX_set1_recipient() sets the recipient name that will be used in the | |
0d17c2f4 DDO |
528 | PKIHeader of CMP request messages, i.e. the X509 name of the (CA) server. |
529 | ||
530 | The recipient field in the header of a CMP message is mandatory. | |
531 | If not given explicitly the recipient is determined in the following order: | |
532 | the subject of the CMP server certificate set using OSSL_CMP_CTX_set1_srvCert(), | |
533 | the value set using OSSL_CMP_CTX_set1_issuer(), | |
534 | the issuer of the certificate set using OSSL_CMP_CTX_set1_oldCert(), | |
aad086e2 | 535 | the issuer of the CMP signer certificate, |
0d17c2f4 | 536 | as far as any of those is present, else the NULL-DN as last resort. |
7960dbec | 537 | |
aad086e2 | 538 | OSSL_CMP_CTX_push0_geninfo_ITAV() adds I<itav> to the stack in the I<ctx> to be |
7960dbec | 539 | added to the GeneralInfo field of the CMP PKIMessage header of a request |
cfca56df | 540 | message sent with this context. |
7960dbec | 541 | |
a2ede039 DDO |
542 | OSSL_CMP_CTX_reset_geninfo_ITAVs() |
543 | clears any ITAVs that were added by OSSL_CMP_CTX_push0_geninfo_ITAV(). | |
544 | ||
7960dbec DDO |
545 | OSSL_CMP_CTX_set1_extraCertsOut() sets the stack of extraCerts that will be |
546 | sent to remote. | |
547 | ||
548 | OSSL_CMP_CTX_set0_newPkey() can be used to explicitly set the given EVP_PKEY | |
549 | structure as the private or public key to be certified in the CMP context. | |
aad086e2 | 550 | The I<priv> parameter must be 0 if and only if the given key is a public key. |
7960dbec DDO |
551 | |
552 | OSSL_CMP_CTX_get0_newPkey() gives the key to use for certificate enrollment | |
553 | dependent on fields of the CMP context structure: | |
554 | the newPkey (which may be a private or public key) if present, | |
92cae9b4 | 555 | else the public key in the p10CSR if present, else the client's private key. |
aad086e2 | 556 | If the I<priv> parameter is not 0 and the selected key does not have a |
7960dbec DDO |
557 | private component then NULL is returned. |
558 | ||
559 | OSSL_CMP_CTX_set1_issuer() sets the name of the intended issuer that | |
560 | will be set in the CertTemplate, i.e., the X509 name of the CA server. | |
561 | ||
1d32ec20 RR |
562 | OSSL_CMP_CTX_set1_serialNumber() sets the serial number optionally used to |
563 | select the certificate to be revoked in Revocation Requests (RR). | |
564 | ||
7960dbec DDO |
565 | OSSL_CMP_CTX_set1_subjectName() sets the subject DN that will be used in |
566 | the CertTemplate structure when requesting a new cert. For Key Update Requests | |
aad086e2 DDO |
567 | (KUR), it defaults to the subject DN of the reference certificate, |
568 | see OSSL_CMP_CTX_set1_oldCert(). This default is used for Initialization | |
7960dbec | 569 | Requests (IR) and Certification Requests (CR) only if no SANs are set. |
aad086e2 DDO |
570 | The I<subjectName> is also used as fallback for the sender field |
571 | of outgoing CMP messages if no reference certificate is available. | |
7960dbec DDO |
572 | |
573 | OSSL_CMP_CTX_push1_subjectAltName() adds the given X509 name to the list of | |
574 | alternate names on the certificate template request. This cannot be used if | |
575 | any Subject Alternative Name extension is set via | |
576 | OSSL_CMP_CTX_set0_reqExtensions(). | |
c8c92345 | 577 | By default, unless B<OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT> has been set, |
aad086e2 DDO |
578 | the Subject Alternative Names are copied from the reference certificate, |
579 | see OSSL_CMP_CTX_set1_oldCert(). | |
580 | If set and the subject DN is not set with OSSL_CMP_CTX_set1_subjectName() then | |
7960dbec | 581 | the certificate template of an IR and CR will not be filled with the default |
aad086e2 | 582 | subject DN from the reference certificate. |
7960dbec DDO |
583 | If a subject DN is desired it needs to be set explicitly with |
584 | OSSL_CMP_CTX_set1_subjectName(). | |
585 | ||
586 | OSSL_CMP_CTX_set0_reqExtensions() sets the X.509v3 extensions to be used in | |
587 | IR/CR/KUR. | |
588 | ||
589 | OSSL_CMP_CTX_reqExtensions_have_SAN() returns 1 if the context contains | |
590 | a Subject Alternative Name extension, else 0 or -1 on error. | |
591 | ||
592 | OSSL_CMP_CTX_push0_policy() adds the certificate policy info object | |
593 | to the X509_EXTENSIONS of the requested certificate template. | |
594 | ||
595 | OSSL_CMP_CTX_set1_oldCert() sets the old certificate to be updated in | |
596 | Key Update Requests (KUR) or to be revoked in Revocation Requests (RR). | |
1d32ec20 RR |
597 | For RR, this is ignored if an issuer name and a serial number are provided using |
598 | OSSL_CMP_CTX_set1_issuer() and OSSL_CMP_CTX_set1_serialNumber(), respectively. | |
599 | For IR/CR/KUR this sets the I<reference certificate>, | |
600 | which otherwise defaults to the CMP signer certificate. | |
601 | The I<reference certificate> determined this way, if any, is used for providing | |
602 | default public key, subject DN, Subject Alternative Names, and issuer DN entries | |
603 | in the requested certificate template of IR/CR/KUR messages. | |
604 | ||
aad086e2 DDO |
605 | The subject of the reference certificate is used as the sender field value |
606 | in CMP message headers. | |
16931355 | 607 | Its issuer is used as default recipient in CMP message headers. |
7960dbec | 608 | |
c8c92345 | 609 | OSSL_CMP_CTX_set1_p10CSR() sets the PKCS#10 CSR to use in P10CR messages. |
1d32ec20 RR |
610 | If such a CSR is provided, its subject and public key fields are also |
611 | used as fallback values for the certificate template of IR/CR/KUR/RR messages, | |
612 | and any extensions included are added to the template of IR/CR/KUR messages. | |
7960dbec | 613 | |
aad086e2 | 614 | OSSL_CMP_CTX_push0_genm_ITAV() adds I<itav> to the stack in the I<ctx> which |
7960dbec | 615 | will be the body of a General Message sent with this context. |
7960dbec | 616 | |
a0745e2b DDO |
617 | OSSL_CMP_certConf_cb() is the default certificate confirmation callback function. |
618 | If the callback argument is not NULL it must point to a trust store. | |
619 | In this case the function checks that the newly enrolled certificate can be | |
aad086e2 | 620 | verified using this trust store and untrusted certificates from the I<ctx>, |
a0745e2b | 621 | which have been augmented by the list of extraCerts received. |
6b58f498 | 622 | During this verification, any certificate status checking is disabled. |
a0745e2b | 623 | If the callback argument is NULL the function tries building an approximate |
aad086e2 | 624 | chain as far as possible using the same untrusted certificates from the I<ctx>, |
a0745e2b DDO |
625 | and if this fails it takes the received extraCerts as fallback. |
626 | The resulting cert chain can be retrieved using OSSL_CMP_CTX_get1_newChain(). | |
627 | ||
7960dbec DDO |
628 | OSSL_CMP_CTX_set_certConf_cb() sets the callback used for evaluating the newly |
629 | enrolled certificate before the library sends, depending on its result, | |
630 | a positive or negative certConf message to the server. The callback has type | |
631 | ||
7e765f46 | 632 | typedef int (*OSSL_CMP_certConf_cb_t) (OSSL_CMP_CTX *ctx, X509 *cert, |
7960dbec DDO |
633 | int fail_info, const char **txt); |
634 | ||
aad086e2 DDO |
635 | and should inspect the certificate it obtains via the I<cert> parameter and may |
636 | overrule the pre-decision given in the I<fail_info> and I<*txt> parameters. | |
7960dbec DDO |
637 | If it accepts the certificate it must return 0, indicating success. Else it must |
638 | return a bit field reflecting PKIFailureInfo with at least one failure bit and | |
aad086e2 | 639 | may set the I<*txt> output parameter to point to a string constant with more |
7960dbec | 640 | detail. The transfer callback may make use of a custom defined argument stored |
aad086e2 | 641 | in the I<ctx> by means of OSSL_CMP_CTX_set_certConf_cb_arg(), which may be |
7960dbec DDO |
642 | retrieved again through OSSL_CMP_CTX_get_certConf_cb_arg(). |
643 | Typically, the callback will check at least that the certificate can be verified | |
644 | using a set of trusted certificates. | |
645 | It also could compare the subject DN and other fields of the newly | |
646 | enrolled certificate with the certificate template of the request. | |
647 | ||
648 | OSSL_CMP_CTX_set_certConf_cb_arg() sets an argument, respectively a pointer to a | |
649 | structure containing arguments, optionally to be used by the certConf callback. | |
aad086e2 DDO |
650 | I<arg> is not consumed, and it must therefore explicitly be freed when not |
651 | needed any more. I<arg> may be NULL to clear the entry. | |
7960dbec DDO |
652 | |
653 | OSSL_CMP_CTX_get_certConf_cb_arg() gets the argument, respectively the pointer | |
654 | to a structure containing arguments, previously set by | |
655 | OSSL_CMP_CTX_set_certConf_cb_arg(), or NULL if unset. | |
656 | ||
19ddcc4c DDO |
657 | OSSL_CMP_CTX_get_status() returns for client contexts the PKIstatus from |
658 | the last received CertRepMessage or Revocation Response or error message: | |
a53d4f83 | 659 | =item B<OSSL_CMP_PKISTATUS_accepted> on successful receipt of a GENP message: |
19ddcc4c DDO |
660 | |
661 | =over 4 | |
662 | ||
663 | =item B<OSSL_CMP_PKISTATUS_request> | |
664 | ||
665 | if an IR/CR/KUR/RR/GENM request message could not be produced, | |
666 | ||
667 | =item B<OSSL_CMP_PKISTATUS_trans> | |
668 | ||
669 | on a transmission error or transaction error for this type of request, and | |
670 | ||
671 | =item B<OSSL_CMP_PKISTATUS_unspecified> | |
672 | ||
673 | if no such request was attempted or OSSL_CMP_CTX_reinit() has been called. | |
674 | ||
675 | =back | |
676 | ||
677 | For server contexts it returns | |
678 | B<OSSL_CMP_PKISTATUS_trans> if a transaction is open, | |
679 | otherwise B<OSSL_CMP_PKISTATUS_unspecified>. | |
7960dbec DDO |
680 | |
681 | OSSL_CMP_CTX_get0_statusString() returns the statusString from the last received | |
682 | CertRepMessage or Revocation Response or error message, or NULL if unset. | |
683 | ||
684 | OSSL_CMP_CTX_get_failInfoCode() returns the error code from the failInfo field | |
cba0e2af DDO |
685 | of the last received CertRepMessage or Revocation Response or error message, |
686 | or -1 if no such response was received or OSSL_CMP_CTX_reinit() has been called. | |
6e4618a0 RS |
687 | This is a bit field and the flags for it are specified in the header file |
688 | F<< <openssl/cmp.h> >>. | |
7960dbec DDO |
689 | The flags start with OSSL_CMP_CTX_FAILINFO, for example: |
690 | OSSL_CMP_CTX_FAILINFO_badAlg. Returns -1 if the failInfoCode field is unset. | |
691 | ||
b6fbef11 DDO |
692 | OSSL_CMP_CTX_get0_validatedSrvCert() returns |
693 | the successfully validated certificate, if any, that the CMP server used | |
694 | in the current transaction for signature-based response message protection, | |
695 | or NULL if the server used MAC-based protection. | |
696 | The value is relevant only at the end of a successful transaction. | |
697 | It may be used to check the authorization of the server based on its cert. | |
698 | ||
7960dbec DDO |
699 | OSSL_CMP_CTX_get0_newCert() returns the pointer to the newly obtained |
700 | certificate in case it is available, else NULL. | |
701 | ||
39082af2 DDO |
702 | OSSL_CMP_CTX_get1_newChain() returns a pointer to a duplicate of the stack of |
703 | X.509 certificates computed by OSSL_CMP_certConf_cb() (if this function has | |
704 | been called) on the last received certificate response message IP/CP/KUP. | |
705 | ||
bb30bce2 | 706 | OSSL_CMP_CTX_get1_caPubs() returns a pointer to a duplicate of the list of |
1cd77e2e DDO |
707 | X.509 certificates in the caPubs field of the last received certificate |
708 | response message (of type IP, CP, or KUP), | |
709 | or an empty stack if no caPubs have been received in the current transaction. | |
7960dbec | 710 | |
bb30bce2 DDO |
711 | OSSL_CMP_CTX_get1_extraCertsIn() returns a pointer to a duplicate of the list |
712 | of X.509 certificates contained in the extraCerts field of the last received | |
713 | response message (except for pollRep and PKIConf), or | |
714 | an empty stack if no extraCerts have been received in the current transaction. | |
7960dbec DDO |
715 | |
716 | OSSL_CMP_CTX_set1_transactionID() sets the given transaction ID in the given | |
717 | OSSL_CMP_CTX structure. | |
718 | ||
aad086e2 DDO |
719 | OSSL_CMP_CTX_set1_senderNonce() stores the last sent sender I<nonce> in |
720 | the I<ctx>. This will be used to validate the recipNonce in incoming messages. | |
7960dbec DDO |
721 | |
722 | =head1 NOTES | |
723 | ||
724 | CMP is defined in RFC 4210 (and CRMF in RFC 4211). | |
725 | ||
726 | =head1 RETURN VALUES | |
727 | ||
728 | OSSL_CMP_CTX_free() and OSSL_CMP_CTX_print_errors() do not return anything. | |
729 | ||
730 | OSSL_CMP_CTX_new(), | |
2da163cb | 731 | OSSL_CMP_CTX_get0_libctx(), OSSL_CMP_CTX_get0_propq(), |
7960dbec DDO |
732 | OSSL_CMP_CTX_get_http_cb_arg(), |
733 | OSSL_CMP_CTX_get_transfer_cb_arg(), | |
6be83cc6 | 734 | OSSL_CMP_CTX_get0_trusted(), |
0b86eefd | 735 | OSSL_CMP_CTX_get0_untrusted(), |
7960dbec DDO |
736 | OSSL_CMP_CTX_get0_newPkey(), |
737 | OSSL_CMP_CTX_get_certConf_cb_arg(), | |
738 | OSSL_CMP_CTX_get0_statusString(), | |
b6fbef11 | 739 | OSSL_CMP_CTX_get0_validatedSrvCert(), |
7960dbec | 740 | OSSL_CMP_CTX_get0_newCert(), |
39082af2 | 741 | OSSL_CMP_CTX_get0_newChain(), |
7960dbec DDO |
742 | OSSL_CMP_CTX_get1_caPubs(), and |
743 | OSSL_CMP_CTX_get1_extraCertsIn() | |
744 | return the intended pointer value as described above or NULL on error. | |
745 | ||
746 | OSSL_CMP_CTX_get_option(), | |
747 | OSSL_CMP_CTX_reqExtensions_have_SAN(), | |
748 | OSSL_CMP_CTX_get_status(), and | |
749 | OSSL_CMP_CTX_get_failInfoCode() | |
750 | return the intended value as described above or -1 on error. | |
751 | ||
aad086e2 DDO |
752 | OSSL_CMP_certConf_cb() returns I<fail_info> if it is not equal to 0, |
753 | else 0 on successful validation, | |
a0745e2b DDO |
754 | or else a bit field with the B<OSSL_CMP_PKIFAILUREINFO_incorrectData> bit set. |
755 | ||
a2ede039 DDO |
756 | All other functions, including OSSL_CMP_CTX_reinit() |
757 | and OSSL_CMP_CTX_reset_geninfo_ITAVs(), | |
1c04866c | 758 | return 1 on success, 0 on error. |
7960dbec DDO |
759 | |
760 | =head1 EXAMPLES | |
761 | ||
63f1883d | 762 | The following code omits error handling. |
7960dbec | 763 | |
63f1883d | 764 | Set up a CMP client context for sending requests and verifying responses: |
7960dbec | 765 | |
63f1883d DDO |
766 | cmp_ctx = OSSL_CMP_CTX_new(); |
767 | OSSL_CMP_CTX_set1_server(cmp_ctx, name_or_address); | |
768 | OSSL_CMP_CTX_set1_serverPort(cmp_ctx, port_string); | |
769 | OSSL_CMP_CTX_set1_serverPath(cmp_ctx, path_or_alias); | |
6be83cc6 | 770 | OSSL_CMP_CTX_set0_trusted(cmp_ctx, ts); |
7960dbec | 771 | |
89ed128d | 772 | Set up symmetric credentials for MAC-based message protection such as PBM: |
7960dbec | 773 | |
63f1883d DDO |
774 | OSSL_CMP_CTX_set1_referenceValue(cmp_ctx, ref, ref_len); |
775 | OSSL_CMP_CTX_set1_secretValue(cmp_ctx, sec, sec_len); | |
7960dbec | 776 | |
63f1883d | 777 | Set up the details for certificate requests: |
7960dbec | 778 | |
63f1883d DDO |
779 | OSSL_CMP_CTX_set1_subjectName(cmp_ctx, name); |
780 | OSSL_CMP_CTX_set0_newPkey(cmp_ctx, 1, initialKey); | |
7960dbec | 781 | |
63f1883d | 782 | Perform an Initialization Request transaction: |
7960dbec | 783 | |
63f1883d | 784 | initialCert = OSSL_CMP_exec_IR_ses(cmp_ctx); |
7960dbec | 785 | |
63f1883d | 786 | Reset the transaction state of the CMP context and the credentials: |
7960dbec | 787 | |
63f1883d DDO |
788 | OSSL_CMP_CTX_reinit(cmp_ctx); |
789 | OSSL_CMP_CTX_set1_referenceValue(cmp_ctx, NULL, 0); | |
790 | OSSL_CMP_CTX_set1_secretValue(cmp_ctx, NULL, 0); | |
7960dbec | 791 | |
63f1883d | 792 | Perform a Certification Request transaction, making use of the new credentials: |
7960dbec | 793 | |
63f1883d DDO |
794 | OSSL_CMP_CTX_set1_cert(cmp_ctx, initialCert); |
795 | OSSL_CMP_CTX_set1_pkey(cmp_ctx, initialKey); | |
796 | OSSL_CMP_CTX_set0_newPkey(cmp_ctx, 1, curentKey); | |
797 | currentCert = OSSL_CMP_exec_CR_ses(cmp_ctx); | |
798 | ||
799 | Perform a Key Update Request, signed using the cert (and key) to be updated: | |
800 | ||
801 | OSSL_CMP_CTX_reinit(cmp_ctx); | |
802 | OSSL_CMP_CTX_set1_cert(cmp_ctx, currentCert); | |
803 | OSSL_CMP_CTX_set1_pkey(cmp_ctx, currentKey); | |
804 | OSSL_CMP_CTX_set0_newPkey(cmp_ctx, 1, updatedKey); | |
805 | currentCert = OSSL_CMP_exec_KUR_ses(cmp_ctx); | |
806 | currentKey = updatedKey; | |
807 | ||
808 | Perform a General Message transaction including, as an example, | |
809 | the id-it-signKeyPairTypes OID and prints info on the General Response contents: | |
810 | ||
811 | OSSL_CMP_CTX_reinit(cmp_ctx); | |
7960dbec DDO |
812 | |
813 | ASN1_OBJECT *type = OBJ_txt2obj("1.3.6.1.5.5.7.4.2", 1); | |
1c04866c | 814 | OSSL_CMP_ITAV *itav = OSSL_CMP_ITAV_create(type, NULL); |
7960dbec DDO |
815 | OSSL_CMP_CTX_push0_genm_ITAV(cmp_ctx, itav); |
816 | ||
817 | STACK_OF(OSSL_CMP_ITAV) *itavs; | |
818 | itavs = OSSL_CMP_exec_GENM_ses(cmp_ctx); | |
819 | print_itavs(itavs); | |
820 | sk_OSSL_CMP_ITAV_pop_free(itavs, OSSL_CMP_ITAV_free); | |
821 | ||
822 | =head1 SEE ALSO | |
823 | ||
299e0f1e DDO |
824 | L<OSSL_CMP_exec_IR_ses(3)>, L<OSSL_CMP_exec_CR_ses(3)>, |
825 | L<OSSL_CMP_exec_KUR_ses(3)>, L<OSSL_CMP_exec_GENM_ses(3)>, | |
aad086e2 DDO |
826 | L<OSSL_CMP_exec_certreq(3)>, L<OSSL_CMP_MSG_http_perform(3)>, |
827 | L<ERR_print_errors_cb(3)> | |
7960dbec DDO |
828 | |
829 | =head1 HISTORY | |
830 | ||
831 | The OpenSSL CMP support was added in OpenSSL 3.0. | |
832 | ||
6be83cc6 DDO |
833 | OSSL_CMP_CTX_get0_trustedStore() was renamed to OSSL_CMP_CTX_get0_trusted() and |
834 | OSSL_CMP_CTX_set0_trustedStore() was renamed to OSSL_CMP_CTX_set0_trusted(), | |
835 | using macros, while keeping the old names for backward compatibility, | |
45ada6b9 | 836 | in OpenSSL 3.2. |
6be83cc6 | 837 | |
a2ede039 DDO |
838 | OSSL_CMP_CTX_reset_geninfo_ITAVs() was added in OpenSSL 3.0.8. |
839 | ||
2da163cb DDO |
840 | OSSL_CMP_CTX_get0_libctx(), OSSL_CMP_CTX_get0_propq(), and |
841 | OSSL_CMP_CTX_get0_validatedSrvCert() were added in OpenSSL 3.2. | |
b6fbef11 | 842 | |
1d32ec20 RR |
843 | OSSL_CMP_CTX_set1_serialNumber() was added in OpenSSL 3.2. |
844 | ||
7960dbec DDO |
845 | =head1 COPYRIGHT |
846 | ||
da1c088f | 847 | Copyright 2007-2023 The OpenSSL Project Authors. All Rights Reserved. |
7960dbec DDO |
848 | |
849 | Licensed under the Apache License 2.0 (the "License"). You may not use | |
850 | this file except in compliance with the License. You can obtain a copy | |
851 | in the file LICENSE in the source distribution or at | |
852 | L<https://www.openssl.org/source/license.html>. | |
853 | ||
854 | =cut |