summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--doc/tex/cert_auth.tex19
-rw-r--r--doc/tex/certificate.tex8
-rw-r--r--doc/tex/ex-x509-info.tex26
-rw-r--r--includes/gnutls/x509.h2
-rw-r--r--lib/x509/x509.c7
-rw-r--r--lib/x509/x509_write.c45
-rw-r--r--src/certtool.c6
7 files changed, 88 insertions, 25 deletions
diff --git a/doc/tex/cert_auth.tex b/doc/tex/cert_auth.tex
index 8e71417c7f..f950321a1f 100644
--- a/doc/tex/cert_auth.tex
+++ b/doc/tex/cert_auth.tex
@@ -37,14 +37,19 @@ in a certificate credentials structure. This should be done by using
\printfunc{gnutls_certificate_set_x509_key_file}{gnutls\_certificate\_set\_x509\_key\_file}
or
\printfunc{gnutls_certificate_set_openpgp_key_file}{gnutls\_certificate\_set\_openpgp\_key\_file}
-depending on the certificate type. As an alternative, a callback may be used
-so the server or the client set the certificate at the handshake time.
-That callback can be set using
-\printfunc{gnutls_certificate_server_set_retrieve_function}{gnutls\_certificate\_server\_set\_retrieve\_function}
-or
-\printfunc{gnutls_certificate_client_set_retrieve_function}{gnutls\_certificate\_client\_set\_retrieve\_function}
-in case of a client.
+depending on the certificate type.
+In the X.509 case, the functions will also accept and use a certificate list
+that leads to a trusted authority. The certificate list must be ordered in such
+way that every certificate certifies the one before it. The trusted authority's
+certificate need not to be included, since the peer should possess it already.
\par
+As an alternative, a callback may be used
+so the server or the client specify the certificate and the key at the handshake time.
+That callback can be set using the functions:
+\begin{itemize}
+\item \printfunc{gnutls_certificate_server_set_retrieve_function}{gnutls\_certificate\_server\_set\_retrieve\_function}
+\item \printfunc{gnutls_certificate_client_set_retrieve_function}{gnutls\_certificate\_client\_set\_retrieve\_function}
+\end{itemize}
Certificate verification is possible by loading the trusted authorities
into the credentials structure by using
\printfunc{gnutls_certificate_set_x509_trust_file}{gnutls\_certificate\_set\_x509\_trust\_file}
diff --git a/doc/tex/certificate.tex b/doc/tex/certificate.tex
index b4608b9c3a..75740ae3fd 100644
--- a/doc/tex/certificate.tex
+++ b/doc/tex/certificate.tex
@@ -28,7 +28,8 @@ on page \pageref{sec:x509api}. Some examples are listed below.
\subsection{X.509 certificates}
An X.509 certificate usually contains information about the certificate
holder, the signer, a unique serial number, expiration dates and several other
-fields\cite{RFC3280}. Some functions of \gnutls{}' API for certificate parsing are:
+fields\cite{RFC3280}. Several functions exist to generate and handle X.509
+certificates, all listed in \emph{gnutls/x509.h}. Some of them are:
\begin{itemize}
\item \printfunc{gnutls_x509_crt_init}{gnutls\_x509\_crt\_init}
\item \printfunc{gnutls_x509_crt_import}{gnutls\_x509\_crt\_import}
@@ -38,9 +39,8 @@ fields\cite{RFC3280}. Some functions of \gnutls{}' API for certificate parsing a
\end{itemize}
\par
-An example program that reads the peer's certificate,
-and prints some information about the peer's certificate in a TLS session,
-is listed below.
+To demonstrate the X.509 parsing capabilities an example program is listed below.
+That program reads the peer's certificate, and prints information about it.
\input{ex-x509-info}
diff --git a/doc/tex/ex-x509-info.tex b/doc/tex/ex-x509-info.tex
index d7712861a7..b6740081a5 100644
--- a/doc/tex/ex-x509-info.tex
+++ b/doc/tex/ex-x509-info.tex
@@ -35,31 +35,37 @@ static void print_x509_certificate_info(gnutls_session session)
int cert_list_size = 0;
gnutls_x509_crt cert;
+ /* This function only works for X.509 certificates.
+ */
+ if (gnutls_certificate_type_get(session) != GNUTLS_CRT_X509)
+ return;
+
cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
- if (cert_list_size > 0
- && gnutls_certificate_type_get(session) == GNUTLS_CRT_X509) {
+ printf("Peer provided %d certificates.\n", cert_list_size);
+
+ if (cert_list_size > 0) {
- /* no error checking
+ /* we only print information about the first certificate.
*/
gnutls_x509_crt_init( &cert);
gnutls_x509_crt_import( cert, &cert_list[0]);
- printf(" - Certificate info:\n");
+ printf("Certificate info:\n");
expiration_time = gnutls_x509_crt_get_expiration_time( cert);
activation_time = gnutls_x509_crt_get_activation_time( cert);
- printf(" - Certificate is valid since: %s", ctime(&activation_time));
- printf(" - Certificate expires: %s", ctime(&expiration_time));
+ printf("\tCertificate is valid since: %s", ctime(&activation_time));
+ printf("\tCertificate expires: %s", ctime(&expiration_time));
/* Print the serial number of the certificate.
*/
size = sizeof(serial);
gnutls_x509_crt_get_serial(cert, serial, &size);
- printf(" - Certificate serial number: %s\n",
+ printf("\tCertificate serial number: %s\n",
bin2hex( serial, serial_size));
/* Extract some of the public key algorithm's parameters
@@ -82,16 +88,16 @@ static void print_x509_certificate_info(gnutls_session session)
/* Print the version of the X.509
* certificate.
*/
- printf(" - Certificate version: #%d\n",
+ printf("\tCertificate version: #%d\n",
gnutls_x509_crt_get_version( cert));
size = sizeof(dn);
gnutls_x509_crt_get_dn( cert, dn, &size);
- printf(" - DN: %s\n", dn);
+ printf("\tDN: %s\n", dn);
size = sizeof(dn);
gnutls_x509_crt_get_issuer_dn( cert, dn, &size);
- printf(" - Certificate Issuer's DN: %s\n", dn);
+ printf("\tIssuer's DN: %s\n", dn);
gnutls_x509_crt_deinit( cert);
diff --git a/includes/gnutls/x509.h b/includes/gnutls/x509.h
index 631e6e00a1..d482c8bf62 100644
--- a/includes/gnutls/x509.h
+++ b/includes/gnutls/x509.h
@@ -93,6 +93,8 @@ int gnutls_x509_crt_get_crl_dist_points(gnutls_x509_crt cert,
unsigned int *critical);
int gnutls_x509_crt_set_crl_dist_points(gnutls_x509_crt crt, gnutls_x509_subject_alt_name type,
const void* data_string, unsigned int reason_flags);
+int gnutls_x509_crt_cpy_crl_dist_points(gnutls_x509_crt dst,
+ gnutls_x509_crt src);
time_t gnutls_x509_crt_get_activation_time(gnutls_x509_crt cert);
time_t gnutls_x509_crt_get_expiration_time(gnutls_x509_crt cert);
diff --git a/lib/x509/x509.c b/lib/x509/x509.c
index 04fb415126..ccfbaf1580 100644
--- a/lib/x509/x509.c
+++ b/lib/x509/x509.c
@@ -785,7 +785,6 @@ int gnutls_x509_crt_get_subject_alt_name(gnutls_x509_crt cert,
asn1_delete_structure(&c2);
if (result < 0) {
- gnutls_assert();
return result;
}
@@ -980,9 +979,9 @@ int gnutls_x509_crt_get_extension_oid(gnutls_x509_crt cert, int indx,
return GNUTLS_E_INVALID_REQUEST;
}
- if ((result =
- _gnutls_x509_crt_get_extension_oid(cert, indx, oid, sizeof_oid)) < 0) {
- gnutls_assert();
+ result =
+ _gnutls_x509_crt_get_extension_oid(cert, indx, oid, sizeof_oid);
+ if (result < 0) {
return result;
}
diff --git a/lib/x509/x509_write.c b/lib/x509/x509_write.c
index b4c155b7bb..076d964408 100644
--- a/lib/x509/x509_write.c
+++ b/lib/x509/x509_write.c
@@ -543,6 +543,51 @@ unsigned int critical;
}
/**
+ * gnutls_x509_crt_cpy_crl_dist_points - This function will copy the CRL dist points
+ * @dst: should contain a gnutls_x509_crt structure
+ * @src: the certificate where the dist points will be copied from
+ *
+ * This function will copy the CRL distribution points certificate
+ * extension, from the source to the destination certificate.
+ * This may be useful to copy from a CA certificate to issued ones.
+ *
+ * Returns 0 on success.
+ *
+ **/
+int gnutls_x509_crt_cpy_crl_dist_points(gnutls_x509_crt dst,
+ gnutls_x509_crt src)
+{
+int result;
+gnutls_datum der_data;
+unsigned int critical;
+
+ if (dst==NULL || src == NULL) {
+ gnutls_assert();
+ return GNUTLS_E_INVALID_REQUEST;
+ }
+
+ /* Check if the extension already exists.
+ */
+ result = _gnutls_x509_crt_get_extension(src, "2.5.29.31", 0, &der_data, &critical);
+ if (result < 0) {
+ gnutls_assert();
+ return result;
+ }
+
+ result = _gnutls_x509_crt_set_extension( dst, "2.5.29.31", &der_data, critical);
+ _gnutls_free_datum( &der_data);
+
+ if (result < 0) {
+ gnutls_assert();
+ return result;
+ }
+
+ dst->use_extensions = 1;
+
+ return 0;
+}
+
+/**
* gnutls_x509_crt_set_subject_key_id - This function will set the certificate's subject key id
* @cert: should contain a gnutls_x509_crt structure
* @id: The key ID
diff --git a/src/certtool.c b/src/certtool.c
index c9ddb48396..40e51ae271 100644
--- a/src/certtool.c
+++ b/src/certtool.c
@@ -607,6 +607,12 @@ void generate_signed_certificate( void)
ca_crt = load_ca_cert();
crt = generate_certificate( &key);
+
+ /* Copy the CRL distribution points.
+ */
+ gnutls_x509_crt_cpy_crl_dist_points( crt, ca_crt);
+ /* it doesn't matter if we couldn't copy the CRL dist points.
+ */
print_certificate_info( crt, stderr, 0);
View Lorry Controller Status