Add X509V3_set_issuer_pkey, needed for AKID of self-issued not self-signed cert
Also clean up some related auxiliary functions and documentation Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13658)master
Dr. David von Oheimb
2 years ago
committed by
Dr. David von Oheimb
parent
ea9fd333d1
commit
41e597a01d
@ -1,46 +0,0 @@
|
||||
=pod
|
||||
|
||||
=head1 NAME
|
||||
|
||||
i2s_ASN1_UTF8STRING,
|
||||
s2i_ASN1_UTF8STRING
|
||||
- convert objects from/to ASN.1/string representation
|
||||
|
||||
=head1 SYNOPSIS
|
||||
|
||||
#include "crypto/x509v3.h"
|
||||
|
||||
char *i2s_ASN1_UTF8STRING(X509V3_EXT_METHOD *method,
|
||||
ASN1_UTF8STRING *utf8);
|
||||
ASN1_UTF8STRING *s2i_ASN1_UTF8STRING(X509V3_EXT_METHOD *method,
|
||||
X509V3_CTX *ctx, const char *str);
|
||||
|
||||
=head1 DESCRIPTION
|
||||
|
||||
These functions convert OpenSSL objects to and from their ASN.1/string
|
||||
representation. This function is used for B<X509v3> extensions.
|
||||
|
||||
=head1 NOTES
|
||||
|
||||
The letters B<i> and B<s> in i2s_ASN1_UTF8STRING() stand for
|
||||
"internal" (that is, an internal C structure) and string respectively.
|
||||
So B<i2s_ASN1_UTF8STRING>() converts from internal to string.
|
||||
|
||||
=head1 RETURN VALUES
|
||||
|
||||
B<s2i_ASN1_UTF8STRING>() return a valid
|
||||
B<ASN1_UTF8STRING> structure or NULL if an error occurs.
|
||||
|
||||
B<i2s_ASN1_UTF8STRING>() returns the pointer to a UTF-8 string
|
||||
or NULL if an error occurs.
|
||||
|
||||
=head1 COPYRIGHT
|
||||
|
||||
Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
|
||||
Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
this file except in compliance with the License. You can obtain a copy
|
||||
in the file LICENSE in the source distribution or at
|
||||
L<https://www.openssl.org/source/license.html>.
|
||||
|
||||
=cut
|
||||
@ -0,0 +1,60 @@
|
||||
=pod
|
||||
|
||||
=head1 NAME
|
||||
|
||||
X509V3_set_ctx,
|
||||
X509V3_set_issuer_pkey - X.509v3 extension generation utility functions
|
||||
|
||||
=head1 SYNOPSIS
|
||||
|
||||
#include <openssl/x509v3.h>
|
||||
|
||||
void X509V3_set_ctx(X509V3_CTX *ctx, X509 *issuer, X509 *subject,
|
||||
X509_REQ *req, X509_CRL *crl, int flags);
|
||||
int X509V3_set_issuer_pkey(X509V3_CTX *ctx, EVP_PKEY *pkey);
|
||||
|
||||
=head1 DESCRIPTION
|
||||
|
||||
X509V3_set_ctx() fills in the basic fields of I<ctx> of type B<X509V3_CTX>,
|
||||
providing details potentially needed by functions producing X509 v3 certificate
|
||||
extensions, e.g., to look up values for filling in authority key identifiers.
|
||||
Any of I<subj>, I<req>, or I<crl> may be provided, pointing to a certificate,
|
||||
certification request, or certificate revocation list, respectively.
|
||||
If I<subj> or I<crl> is provided, I<issuer> should point to its issuer,
|
||||
for instance to help generating an authority key identifier extension.
|
||||
Note that if I<subj> is provided, I<issuer> may be the same as I<subj>,
|
||||
which means that I<subj> is self-issued (or even self-signed).
|
||||
I<flags> may be 0 or contain B<CTX_TEST>, which means that just the syntax of
|
||||
extension definitions is to be checked without actually producing an extension,
|
||||
or B<X509V3_CTX_REPLACE>, which means that each X.509v3 extension added as
|
||||
defined in some configuration section shall replace any already existing
|
||||
extension with the same OID.
|
||||
|
||||
X509V3_set_issuer_pkey() explicitly sets the issuer private key of
|
||||
the certificate that has been provided in I<ctx>.
|
||||
This should be done for self-issued certificates (which may be self-signed
|
||||
or not) to provide fallback data for the authority key identifier extension.
|
||||
|
||||
=head1 RETURN VALUES
|
||||
|
||||
X509V3_set_ctx() and X509V3_set_issuer_pkey()
|
||||
return 1 on success and 0 on error.
|
||||
|
||||
=head1 SEE ALSO
|
||||
|
||||
L<X509_add_ext(3)>
|
||||
|
||||
=head1 HISTORY
|
||||
|
||||
X509V3_set_issuer_pkey() was added in OpenSSL 3.0.
|
||||
|
||||
=head1 COPYRIGHT
|
||||
|
||||
Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
|
||||
Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
this file except in compliance with the License. You can obtain a copy
|
||||
in the file LICENSE in the source distribution or at
|
||||
L<https://www.openssl.org/source/license.html>.
|
||||
|
||||
=cut
|
||||
@ -1,23 +0,0 @@
|
||||
/*
|
||||
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
#ifndef OSSL_CRYPTO_X509V3_H
|
||||
# define OSSL_CRYPTO_X509V3_H
|
||||
|
||||
#define EXT_UTF8STRING(nid) { nid, 0, ASN1_ITEM_ref(ASN1_UTF8STRING), \
|
||||
0,0,0,0, \
|
||||
(X509V3_EXT_I2S)i2s_ASN1_UTF8STRING, \
|
||||
(X509V3_EXT_S2I)s2i_ASN1_UTF8STRING, \
|
||||
0,0,0,0, \
|
||||
NULL}
|
||||
|
||||
char *i2s_ASN1_UTF8STRING(X509V3_EXT_METHOD *method, ASN1_UTF8STRING *utf8);
|
||||
ASN1_UTF8STRING *s2i_ASN1_UTF8STRING(X509V3_EXT_METHOD *method,
|
||||
X509V3_CTX *ctx, const char *str);
|
||||
|
||||
#endif
|
||||
Loading…
Reference in New Issue