This appendix contains some example output of the XML convertion
functions:
\begin{itemize}
-\item \printfunc{gnutls_x509_certificate_to_xml}{gnutls\_x509\_certificate\_to\_xml}
+\item \printfunc{gnutls_x509_crt_to_xml}{gnutls\_x509\_crt\_to\_xml}
\item \printfunc{gnutls_openpgp_key_to_xml}{gnutls\_openpgp\_key\_to\_xml}
\end{itemize}
assist in parsing them. \gnutls{} includes functions which extract
parameters from given X.509 certificates. Some of them are:
\begin{itemize}
-\item \printfunc{gnutls_x509_certificate_init}{gnutls\_x509\_certificate\_init}
-\item \printfunc{gnutls_x509_certificate_import}{gnutls\_x509\_certificate\_import}
-\item \printfunc{gnutls_x509_certificate_get_dn}{gnutls\_x509\_certificate\_get\_dn}
-\item \printfunc{gnutls_x509_certificate_get_serial}{gnutls\_x509\_certificate\_get\_serial}
-\item \printfunc{gnutls_x509_certificate_get_subject_alt_name}{gnutls\_x509\_certificate\_get\_subject\_alt\_name}
+\item \printfunc{gnutls_x509_crt_init}{gnutls\_x509\_crt\_init}
+\item \printfunc{gnutls_x509_crt_import}{gnutls\_x509\_crt\_import}
+\item \printfunc{gnutls_x509_crt_get_dn}{gnutls\_x509\_crt\_get\_dn}
+\item \printfunc{gnutls_x509_crt_get_serial}{gnutls\_x509\_crt\_get\_serial}
+\item \printfunc{gnutls_x509_crt_get_subject_alt_name}{gnutls\_x509\_crt\_get\_subject\_alt\_name}
\end{itemize}
The API for handling X.509 certificates is described at section \ref{sec:x509api}
\par
Verifying certificate\index{Verifying certificate paths} paths is important
in X.509 authentication. For this purpose you should use functions like
-\printfunc{gnutls_x509_verify_certificate}{gnutls\_x509\_verify\_certificate}.
+\printfunc{gnutls_x509_crt_verify}{gnutls\_x509\_crt\_verify}.
A more generic one is also provided and can be used with all
of the certificate authentication methods, but is limited to a session. See the
\printfunc{gnutls_certificate_verify_peers}{gnutls\_certificate\_verify\_peers}
time_t expiration_time, activation_time;
const gnutls_datum *cert_list;
int cert_list_size = 0;
- gnutls_x509_certificate cert;
+ gnutls_x509_crt cert;
cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
/* no error checking
*/
- gnutls_x509_certificate_init( &cert);
+ gnutls_x509_crt_init( &cert);
- gnutls_x509_certificate_import( cert, &cert_list[0]);
+ gnutls_x509_crt_import( cert, &cert_list[0]);
printf(" - Certificate info:\n");
- expiration_time = gnutls_x509_certificate_get_expiration_time( cert);
- activation_time = gnutls_x509_certificate_get_activation_time( cert);
+ expiration_time = gnutls_x509_crt_get_expiration_time( cert);
+ activation_time = gnutls_x509_crt_get_activation_time( cert);
printf(" - Certificate is valid since: %s", ctime(&activation_time));
printf(" - Certificate expires: %s", ctime(&expiration_time));
/* Print the serial number of the certificate.
*/
- if (gnutls_x509_certificate_get_serial(cert, serial, &serial_size) >= 0)
+ if (gnutls_x509_crt_get_serial(cert, serial, &serial_size) >= 0)
{
print = printable;
for (i = 0; i < serial_size; i++) {
/* Extract some of the public key algorithm's parameters
*/
algo =
- gnutls_x509_certificate_get_pk_algorithm(cert, &bits);
+ gnutls_x509_crt_get_pk_algorithm(cert, &bits);
printf("Certificate public key: ");
* certificate.
*/
printf(" - Certificate version: #%d\n",
- gnutls_x509_certificate_get_version( cert));
+ gnutls_x509_crt_get_version( cert));
printable_size = sizeof(printable);
- gnutls_x509_certificate_get_dn( cert, printable, &printable_size);
+ gnutls_x509_crt_get_dn( cert, printable, &printable_size);
printf(" - DN: %s\n", printable);
printable_size = sizeof(printable);
- gnutls_x509_certificate_get_issuer_dn( cert, printable, &printable_size);
+ gnutls_x509_crt_get_issuer_dn( cert, printable, &printable_size);
printf(" - Certificate Issuer's DN: %s\n", printable);
- gnutls_x509_certificate_deinit( cert);
+ gnutls_x509_crt_deinit( cert);
}
}
if ( gnutls_certificate_type_get(session) == GNUTLS_CRT_X509) {
const gnutls_datum* cert_list;
int cert_list_size;
- gnutls_x509_certificate cert;
+ gnutls_x509_crt cert;
- if ( gnutls_x509_certificate_init( &cert) < 0) {
+ if ( gnutls_x509_crt_init( &cert) < 0) {
printf("error in initialization\n");
return;
}
/* Here we only check the first certificate in the given
* chain.
*/
- if ( gnutls_x509_certificate_import( cert, &cert_list[0], GNUTLS_X509_FMT_DER) < 0) {
+ if ( gnutls_x509_crt_import( cert, &cert_list[0], GNUTLS_X509_FMT_DER) < 0) {
printf("error parsing certificate\n");
return;
}
/* Beware here we do not check for errors.
*/
- if ( gnutls_x509_certificate_get_expiration( cert) < time(0)) {
+ if ( gnutls_x509_crt_get_expiration( cert) < time(0)) {
printf("The certificate has expired\n");
return;
}
- if ( gnutls_x509_certificate_get_activation_time( cert) > time(0)) {
+ if ( gnutls_x509_crt_get_activation_time( cert) > time(0)) {
printf("The certificate is not yet activated\n");
return;
}
- if ( !gnutls_x509_certificate_check_hostname( cert, hostname)) {
+ if ( !gnutls_x509_crt_check_hostname( cert, hostname)) {
printf("The certificate does not match hostname\n");
return;
}
- gnutls_x509_certificate_deinit( cert);
+ gnutls_x509_crt_deinit( cert);
}
\section{\gnutls{} X.509 certificate handling\index{Function reference!for X.509 certificates}}
\label{sec:x509api}
-The prototypes for the following functions lie
-in ``gnutls/x509.h''.
+The following functions are to be used for X.509 certificate handling.
+Their prototypes lie in ``gnutls/x509.h''.
\input{x509-api}
title = "Transport Layer Security (TLS) Extensions",
month = "July",
year = {2002},
- note = "Internet draft, work in progress. Available from http://www.normos.org/ietf/draft/draft-ietf-tls-extensions-05.txt",
- url = "http://www.normos.org/ietf/draft/draft-ietf-tls-extensions-05.txt"
+ note = "Internet draft, work in progress. Available from http://www.normos.org/ietf/draft/draft-ietf-tls-extensions-06.txt",
+ url = "http://www.normos.org/ietf/draft/draft-ietf-tls-extensions-06.txt"
}
@Misc{TLSSRP,
<?xml version="1.0" encoding="UTF-8"?>
-<gnutls:x509:certificate version="1.0">
+<gnutls:x509:certificate version="1.1">
<certificate type="SEQUENCE">
<tbsCertificate type="SEQUENCE">
<version type="INTEGER" encoding="HEX">02</version>
<serialNumber type="INTEGER" encoding="HEX">01</serialNumber>
<signature type="SEQUENCE">
- <algorithm type="OBJECT ID">1 2 840 113549 1 1 4</algorithm>
+ <algorithm type="OBJECT ID">1.2.840.113549.1.1.4</algorithm>
<parameters type="ANY">
<md5WithRSAEncryption encoding="HEX">0500</md5WithRSAEncryption>
</parameters>
<rdnSequence type="SEQUENCE OF">
<unnamed1 type="SET OF">
<unnamed1 type="SEQUENCE">
- <type type="OBJECT ID">2 5 4 6</type>
+ <type type="OBJECT ID">2.5.4.6</type>
<value type="ANY">
<X520countryName>GR</X520countryName>
</value>
</unnamed1>
<unnamed2 type="SET OF">
<unnamed1 type="SEQUENCE">
- <type type="OBJECT ID">2 5 4 8</type>
+ <type type="OBJECT ID">2.5.4.8</type>
<value type="ANY">
<X520StateOrProvinceName>Attiki</X520StateOrProvinceName>
</value>
</unnamed2>
<unnamed3 type="SET OF">
<unnamed1 type="SEQUENCE">
- <type type="OBJECT ID">2 5 4 7</type>
+ <type type="OBJECT ID">2.5.4.7</type>
<value type="ANY">
<X520LocalityName>Athina</X520LocalityName>
</value>
</unnamed3>
<unnamed4 type="SET OF">
<unnamed1 type="SEQUENCE">
- <type type="OBJECT ID">2 5 4 10</type>
+ <type type="OBJECT ID">2.5.4.10</type>
<value type="ANY">
<X520OrganizationName>GNUTLS</X520OrganizationName>
</value>
</unnamed4>
<unnamed5 type="SET OF">
<unnamed1 type="SEQUENCE">
- <type type="OBJECT ID">2 5 4 11</type>
+ <type type="OBJECT ID">2.5.4.11</type>
<value type="ANY">
<X520OrganizationalUnitName>GNUTLS dev.</X520OrganizationalUnitName>
</value>
</unnamed5>
<unnamed6 type="SET OF">
<unnamed1 type="SEQUENCE">
- <type type="OBJECT ID">2 5 4 3</type>
+ <type type="OBJECT ID">2.5.4.3</type>
<value type="ANY">
<X520CommonName>GNUTLS TEST CA</X520CommonName>
</value>
</unnamed6>
<unnamed7 type="SET OF">
<unnamed1 type="SEQUENCE">
- <type type="OBJECT ID">1 2 840 113549 1 9 1</type>
+ <type type="OBJECT ID">1.2.840.113549.1.9.1</type>
<value type="ANY">
<Pkcs9email>gnutls-dev@gnupg.org</Pkcs9email>
</value>
<rdnSequence type="SEQUENCE OF">
<unnamed1 type="SET OF">
<unnamed1 type="SEQUENCE">
- <type type="OBJECT ID">2 5 4 6</type>
+ <type type="OBJECT ID">2.5.4.6</type>
<value type="ANY">
<X520countryName>GR</X520countryName>
</value>
</unnamed1>
<unnamed2 type="SET OF">
<unnamed1 type="SEQUENCE">
- <type type="OBJECT ID">2 5 4 8</type>
+ <type type="OBJECT ID">2.5.4.8</type>
<value type="ANY">
<X520StateOrProvinceName>Attiki</X520StateOrProvinceName>
</value>
</unnamed2>
<unnamed3 type="SET OF">
<unnamed1 type="SEQUENCE">
- <type type="OBJECT ID">2 5 4 7</type>
+ <type type="OBJECT ID">2.5.4.7</type>
<value type="ANY">
<X520LocalityName>Athina</X520LocalityName>
</value>
</unnamed3>
<unnamed4 type="SET OF">
<unnamed1 type="SEQUENCE">
- <type type="OBJECT ID">2 5 4 10</type>
+ <type type="OBJECT ID">2.5.4.10</type>
<value type="ANY">
<X520OrganizationName>GNUTLS</X520OrganizationName>
</value>
</unnamed4>
<unnamed5 type="SET OF">
<unnamed1 type="SEQUENCE">
- <type type="OBJECT ID">2 5 4 11</type>
+ <type type="OBJECT ID">2.5.4.11</type>
<value type="ANY">
<X520OrganizationalUnitName>GNUTLS dev.</X520OrganizationalUnitName>
</value>
</unnamed5>
<unnamed6 type="SET OF">
<unnamed1 type="SEQUENCE">
- <type type="OBJECT ID">2 5 4 3</type>
+ <type type="OBJECT ID">2.5.4.3</type>
<value type="ANY">
<X520CommonName>localhost</X520CommonName>
</value>
</unnamed6>
<unnamed7 type="SET OF">
<unnamed1 type="SEQUENCE">
- <type type="OBJECT ID">1 2 840 113549 1 9 1</type>
+ <type type="OBJECT ID">1.2.840.113549.1.9.1</type>
<value type="ANY">
<Pkcs9email>root@localhost</Pkcs9email>
</value>
</subject>
<subjectPublicKeyInfo type="SEQUENCE">
<algorithm type="SEQUENCE">
- <algorithm type="OBJECT ID">1 2 840 113549 1 1 1</algorithm>
+ <algorithm type="OBJECT ID">1.2.840.113549.1.1.1</algorithm>
<parameters type="ANY">
<rsaEncryption encoding="HEX">0500</rsaEncryption>
</parameters>
</subjectPublicKeyInfo>
<extensions type="SEQUENCE OF">
<unnamed1 type="SEQUENCE">
- <extnID type="OBJECT ID">2 5 29 35</extnID>
+ <extnID type="OBJECT ID">2.5.29.35</extnID>
<critical type="BOOLEAN">FALSE</critical>
<extnValue type="SEQUENCE">
<keyIdentifier type="OCTET STRING" encoding="HEX">EFEE94ABC8CA577F5313DB76DC1A950093BAF3C9</keyIdentifier>
</extnValue>
</unnamed1>
<unnamed2 type="SEQUENCE">
- <extnID type="OBJECT ID">2 5 29 37</extnID>
+ <extnID type="OBJECT ID">2.5.29.37</extnID>
<critical type="BOOLEAN">FALSE</critical>
<extnValue type="SEQUENCE OF">
- <unnamed1 type="OBJECT ID">1 3 6 1 5 5 7 3 1</unnamed1>
- <unnamed2 type="OBJECT ID">1 3 6 1 5 5 7 3 2</unnamed2>
- <unnamed3 type="OBJECT ID">1 3 6 1 4 1 311 10 3 3</unnamed3>
- <unnamed4 type="OBJECT ID">2 16 840 1 113730 4 1</unnamed4>
+ <unnamed1 type="OBJECT ID">1.3.6.1.5.5.7.3.1</unnamed1>
+ <unnamed2 type="OBJECT ID">1.3.6.1.5.5.7.3.2</unnamed2>
+ <unnamed3 type="OBJECT ID">1.3.6.1.4.1.311.10.3.3</unnamed3>
+ <unnamed4 type="OBJECT ID">2.16.840.1.113730.4.1</unnamed4>
</extnValue>
</unnamed2>
<unnamed3 type="SEQUENCE">
- <extnID type="OBJECT ID">2 5 29 19</extnID>
+ <extnID type="OBJECT ID">2.5.29.19</extnID>
<critical type="BOOLEAN">TRUE</critical>
<extnValue type="SEQUENCE">
<cA type="BOOLEAN">FALSE</cA>
</extensions>
</tbsCertificate>
<signatureAlgorithm type="SEQUENCE">
- <algorithm type="OBJECT ID">1 2 840 113549 1 1 4</algorithm>
+ <algorithm type="OBJECT ID">1.2.840.113549.1.1.4</algorithm>
<parameters type="ANY">
<md5WithRSAEncryption encoding="HEX">0500</md5WithRSAEncryption>
</parameters>