Botan 2.13.0 Crypto and TLS for C++11

- Main Page
- Namespaces
- Classes
- Files

- Class List
- Class Index
- Class Hierarchy
- Class Members

Public Member Functions | Static Public Member Functions | Protected Member Functions | List of all members
Botan::X509_Certificate Class Reference

`#include <x509cert.h>`

Inheritance diagram for Botan::X509_Certificate:

## Public Member Functions
bool | allowed_extended_usage (const std::string &usage) const
bool | allowed_extended_usage (const OID &usage) const
bool | allowed_usage (Key_Constraints usage) const
bool | allowed_usage (Usage_Type usage) const
const std::vector< uint8_t > & | authority_key_id () const
std::vector< uint8_t > | BER_encode () const
std::vector< std::string > | ca_issuers () const
const std::vector< OID > & | certificate_policy_oids () const
bool | check_signature (const Public_Key &key) const
bool | check_signature (const Public_Key *key) const
Key_Constraints | constraints () const
std::string | crl_distribution_point () const
void | decode_from (class BER_Decoder &from) override
void | encode_into (class DER_Encoder &to) const override
std::string | end_time () const
std::vector< std::string > | ex_constraints () const
const std::vector< OID > & | extended_key_usage () const
std::string | fingerprint (const std::string &hash_name="SHA-1") const
bool | has_constraints (Key_Constraints constraints) const
bool | has_ex_constraint (const std::string &ex_constraint) const
bool | has_ex_constraint (const OID &ex_constraint) const
std::string | hash_used_for_signature () const
bool | is_CA_cert () const
bool | is_critical (const std::string &ex_name) const
bool | is_self_signed () const
bool | is_serial_negative () const
const AlternativeName & | issuer_alt_name () const
const X509_DN & | issuer_dn () const
std::vector< std::string > | issuer_info (const std::string &name) const
std::unique_ptr< Public_Key > | load_subject_public_key () const
bool | matches_dns_name (const std::string &name) const
const NameConstraints & | name_constraints () const
const X509_Time & | not_after () const
const X509_Time & | not_before () const
std::string | ocsp_responder () const
bool | operator< (const X509_Certificate &other) const
X509_Certificate & | operator= (const X509_Certificate &other)=default
bool | operator== (const X509_Certificate &other) const
uint32_t | path_limit () const
std::string | PEM_encode () const
std::vector< std::string > | policies () const
const std::vector< uint8_t > & | raw_issuer_dn () const
std::vector< uint8_t > | raw_issuer_dn_sha256 () const
const std::vector< uint8_t > & | raw_subject_dn () const
std::vector< uint8_t > | raw_subject_dn_sha256 () const
const std::vector< uint8_t > & | serial_number () const
const std::vector< uint8_t > & | signature () const
const AlgorithmIdentifier & | signature_algorithm () const
const std::vector< uint8_t > & | signed_body () const
std::string | start_time () const
const AlternativeName & | subject_alt_name () const
const X509_DN & | subject_dn () const
std::vector< std::string > | subject_info (const std::string &name) const
const std::vector< uint8_t > & | subject_key_id () const
Public_Key * | subject_public_key () const
const AlgorithmIdentifier & | subject_public_key_algo () const
const std::vector< uint8_t > & | subject_public_key_bits () const
const std::vector< uint8_t > & | subject_public_key_bitstring () const
const std::vector< uint8_t > & | subject_public_key_bitstring_sha1 () const
const std::vector< uint8_t > & | subject_public_key_info () const
std::vector< uint8_t > | tbs_data () const
std::string | to_string () const
const std::vector< uint8_t > & | v2_issuer_key_id () const
const std::vector< uint8_t > & | v2_subject_key_id () const
const Extensions & | v3_extensions () const
Certificate_Status_Code | verify_signature (const Public_Key &key) const
| X509_Certificate (DataSource &source)
| X509_Certificate (const std::vector< uint8_t > &in)
| X509_Certificate (const uint8_t data[], size_t length)
| X509_Certificate ()=default
| X509_Certificate (const X509_Certificate &other)=default
uint32_t | x509_version () const

## Static Public Member Functions
static std::unique_ptr< PK_Signer > | choose_sig_format (AlgorithmIdentifier &sig_algo, const Private_Key &key, RandomNumberGenerator &rng, const std::string &hash_fn, const std::string &padding_algo)
static std::vector< uint8_t > | make_signed (class PK_Signer *signer, RandomNumberGenerator &rng, const AlgorithmIdentifier &alg_id, const secure_vector< uint8_t > &tbs)

## Protected Member Functions
void | load_data (DataSource &src)

## Detailed Description

This class represents an X.509 Certificate

Definition at line 40 of file x509cert.h.

## Constructor & Destructor Documentation

Botan::X509_Certificate::X509_Certificate | ( | DataSource & | source | ) |
| explicit

Create a certificate from a data source providing the DER or PEM encoded certificate.

Parameters

  source | the data source

Definition at line 78 of file x509cert.cpp.

References Botan::X509_Object::load_data().

79 {
80 load_data(src);
81 }
Botan::X509_Object::load_data
void load_data(DataSource &src)
Definition: x509_obj.cpp:52

Botan::X509_Certificate::X509_Certificate | ( | const std::vector< uint8_t > & | in | ) |
| explicit

Create a certificate from a buffer

Parameters

  in | the buffer containing the DER-encoded certificate

Definition at line 83 of file x509cert.cpp.

References Botan::X509_Object::load_data().

84 {
85 DataSource_Memory src(vec.data(), vec.size());
86 load_data(src);
87 }
Botan::X509_Object::load_data
void load_data(DataSource &src)
Definition: x509_obj.cpp:52

Botan::X509_Certificate::X509_Certificate | ( | const uint8_t | data[],
|  | size_t | length
| ) |  |

Create a certificate from a buffer

Parameters

  data | the buffer containing the DER-encoded certificate
  length | length of data in bytes

Definition at line 89 of file x509cert.cpp.

References Botan::X509_Object::load_data().

90 {
91 DataSource_Memory src(data, len);
92 load_data(src);
93 }
Botan::X509_Object::load_data
void load_data(DataSource &src)
Definition: x509_obj.cpp:52

Botan::X509_Certificate::X509_Certificate | ( |  | ) |
| default

Create an uninitialized certificate object. Any attempts to access this object will throw an exception.

Botan::X509_Certificate::X509_Certificate | ( | const X509_Certificate & | other | ) |
| default

## Member Function Documentation

bool Botan::X509_Certificate::allowed_extended_usage | ( | const std::string & | usage | ) | const

Returns true if the specified

Parameters

  usage | is set in the extended key usage extension or if no extended key usage constraints are set at all. To check if a certain extended key constraint is set in the certificate use

See also
  X509_Certificate::has_ex_constraint.

Definition at line 501 of file x509cert.cpp.

References Botan::OID::from_string().

Referenced by allowed_usage().

502 {
503 return allowed_extended_usage(OID::from_string(usage));
504 }
Botan::X509_Certificate::allowed_extended_usage
bool allowed_extended_usage(const std::string &usage) const
Definition: x509cert.cpp:501
Botan::OID::from_string
static OID from_string(const std::string &str)
Definition: asn1_oid.cpp:62

bool Botan::X509_Certificate::allowed_extended_usage | ( | const OID & | usage | ) | const

Returns true if the specified usage is set in the extended key usage extension, or if no extended key usage constraints are set at all. To check if a certain extended key constraint is set in the certificate use

See also
  X509_Certificate::has_ex_constraint.

Definition at line 506 of file x509cert.cpp.

References extended_key_usage().

507 {
508 const std::vector<OID>& ex = extended_key_usage();
509 if(ex.empty())
510 return true;
511
512 if(std::find(ex.begin(), ex.end(), usage) != ex.end())
513 return true;
514
515 return false;
516 }
Botan::X509_Certificate::extended_key_usage
const std::vector< OID > & extended_key_usage() const
Definition: x509cert.cpp:474

bool Botan::X509_Certificate::allowed_usage | ( | Key_Constraints | usage | ) | const

Returns true if the specified

Parameters

  usage | is set in the key usage extension or if no key usage constraints are set at all. To check if a certain key constraint is set in the certificate use

See also
  X509_Certificate::has_constraints.

Definition at line 494 of file x509cert.cpp.

References constraints(), and Botan::NO_CONSTRAINTS.

Referenced by allowed_usage().

495 {
496 if(constraints() == NO_CONSTRAINTS)
497 return true;
498 return ((constraints() & usage) == usage);
499 }
Botan::X509_Certificate::constraints
Key_Constraints constraints() const
Definition: x509cert.cpp:469
Botan::NO_CONSTRAINTS
Definition: key_constraint.h:22

bool Botan::X509_Certificate::allowed_usage | ( | Usage_Type | usage | ) | const

Returns true if the required key and extended key constraints are set in the certificate for the specified

Parameters

  usage | or if no key constraints are set in both the key usage and extended key usage extension.

Definition at line 518 of file x509cert.cpp.

References allowed_extended_usage(), allowed_usage(), Botan::CERTIFICATE_AUTHORITY, Botan::DATA_ENCIPHERMENT, Botan::DIGITAL_SIGNATURE, Botan::ENCRYPTION, is_CA_cert(), Botan::KEY_AGREEMENT, Botan::KEY_ENCIPHERMENT, Botan::NON_REPUDIATION, Botan::OCSP_RESPONDER, Botan::TLS_CLIENT_AUTH, Botan::TLS_SERVER_AUTH, and Botan::UNSPECIFIED.

519 {
520 // These follow suggestions in RFC 5280 4.2.1.12
521
522 switch(usage)
523 {
524 case Usage_Type::UNSPECIFIED:
525 return true;
526
527 case Usage_Type::TLS_SERVER_AUTH:
528 return (allowed_usage(KEY_AGREEMENT) || allowed_usage(KEY_ENCIPHERMENT) || allowed_usage(DIGITAL_SIGNATURE)) && allowed_extended_usage("PKIX.ServerAuth");
529
530 case Usage_Type::TLS_CLIENT_AUTH:
531 return (allowed_usage(DIGITAL_SIGNATURE) || allowed_usage(KEY_AGREEMENT)) && allowed_extended_usage("PKIX.ClientAuth");
532
533 case Usage_Type::OCSP_RESPONDER:
534 return (allowed_usage(DIGITAL_SIGNATURE) || allowed_usage(NON_REPUDIATION)) && allowed_extended_usage("PKIX.OCSPSigning");
535
536 case Usage_Type::CERTIFICATE_AUTHORITY:
537 return is_CA_cert();
538
539 case Usage_Type::ENCRYPTION:
540 return (allowed_usage(KEY_ENCIPHERMENT) || allowed_usage(DATA_ENCIPHERMENT));
541 }
542
543 return false;
544 }
Botan::DATA_ENCIPHERMENT
Definition: key_constraint.h:26
Botan::NON_REPUDIATION
Definition: key_constraint.h:24
Botan::X509_Certificate::is_CA_cert
bool is_CA_cert() const
Definition: x509cert.cpp:453
Botan::KEY_ENCIPHERMENT
Definition: key_constraint.h:25
Botan::KEY_AGREEMENT
Definition: key_constraint.h:27
Botan::X509_Certificate::allowed_usage
bool allowed_usage(Key_Constraints usage) const
Definition: x509cert.cpp:494
Botan::Usage_Type::CERTIFICATE_AUTHORITY
Botan::DIGITAL_SIGNATURE
Definition: key_constraint.h:23
Botan::Usage_Type::TLS_CLIENT_AUTH
Botan::Usage_Type::ENCRYPTION
Botan::Usage_Type::TLS_SERVER_AUTH
Botan::Usage_Type::OCSP_RESPONDER
Botan::Usage_Type::UNSPECIFIED
Botan::X509_Certificate::allowed_extended_usage
bool allowed_extended_usage(const std::string &usage) const
Definition: x509cert.cpp:501

const std::vector< uint8_t > & Botan::X509_Certificate::authority_key_id | ( |  | ) | const

Get the DER encoded AuthorityKeyIdentifier of this certificate.

Returns
  DER encoded AuthorityKeyIdentifier

Definition at line 412 of file x509cert.cpp.

Referenced by Botan::PKIX::build_certificate_path(), Botan::Certificate_Store_In_Memory::find_crl_for(), Botan::X509_CRL::is_revoked(), issuer_info(), and to_string().

413 {
414 return data().m_authority_key_id;
415 }

std::vector< uint8_t > Botan::ASN1_Object::BER_encode | ( |  | ) | const
| inherited

Return the encoding of this object. This is a convenience method when just one object needs to be serialized. Use DER_Encoder for complicated encodings.

Definition at line 16 of file asn1_obj.cpp.

References Botan::ASN1_Object::encode_into().

Referenced by Botan::PSSR::config_for_x509(), Botan::Certificate_Store_In_SQL::find_all_certs(), Botan::Certificate_Store_In_SQL::find_cert(), fingerprint(), Botan::Certificate_Store_In_SQL::insert_cert(), Botan::X509_Object::PEM_encode(), and Botan::Certificate_Store_In_SQL::revoke_cert().

17 {
18 std::vector<uint8_t> output;
19 DER_Encoder der(output);
20 this->encode_into(der);
21 return output;
22 }
Botan::ASN1_Object::encode_into
virtual void encode_into(DER_Encoder &to) const =0

std::vector< std::string > Botan::X509_Certificate::ca_issuers | ( |  | ) | const

Return the listed addresses of ca issuers, or empty if not set

Definition at line 580 of file x509cert.cpp.

Referenced by to_string().

581 {
582 return data().m_ca_issuers;
583 }

const std::vector< OID > & Botan::X509_Certificate::certificate_policy_oids | ( |  | ) | const

Definition at line 479 of file x509cert.cpp.

Referenced by policies(), and to_string().

480 {
481 return data().m_cert_policies;
482 }

bool Botan::X509_Object::check_signature | ( | const Public_Key & | key | ) | const
| inherited

Check the signature on this data

Parameters

  key | the public key purportedly used to sign this data

Returns
  true if the signature is valid, otherwise false

Definition at line 178 of file x509_obj.cpp.

References Botan::VERIFIED, and Botan::X509_Object::verify_signature().

Referenced by Botan::X509_Object::check_signature().

179 {
180 const Certificate_Status_Code code = verify_signature(pub_key);
181 return (code == Certificate_Status_Code::VERIFIED);
182 }
Botan::X509_Object::verify_signature
Certificate_Status_Code verify_signature(const Public_Key &key) const
Definition: x509_obj.cpp:184
Botan::Certificate_Status_Code
Certificate_Status_Code
Definition: cert_status.h:19
Botan::Certificate_Status_Code::VERIFIED

bool Botan::X509_Object::check_signature | ( | const Public_Key * | key | ) | const
| inherited

Check the signature on this data

Parameters

  key | the public key purportedly used to sign this data the object will be deleted after use (this should have been a std::unique_ptr<Public_Key>)

Returns
  true if the signature is valid, otherwise false

Definition at line 170 of file x509_obj.cpp.

References Botan::X509_Object::check_signature(), and Botan::X509_Object::PEM_label().

171 {
172 if(!pub_key)
173 throw Invalid_Argument("No key provided for " + PEM_label() + " signature check");
174 std::unique_ptr<const Public_Key> key(pub_key);
175 return check_signature(*key);
176 }
Botan::X509_Object::PEM_label
virtual std::string PEM_label() const =0
Botan::X509_Object::check_signature
bool check_signature(const Public_Key &key) const
Definition: x509_obj.cpp:178

std::unique_ptr< PK_Signer > Botan::X509_Object::choose_sig_format | ( | AlgorithmIdentifier & | sig_algo,
|  | const Private_Key & | key,
|  | RandomNumberGenerator & | rng,
|  | const std::string & | hash_fn,
|  | const std::string & | padding_algo
| ) |  |
| static inherited

Definition at line 376 of file x509_obj.cpp.

References Botan::Public_Key::default_x509_signature_format().

Referenced by Botan::choose_sig_format(), and Botan::PKCS10_Request::create().

381 {
382 const Signature_Format format = key.default_x509_signature_format();
383
384 const std::string emsa = choose_sig_algo(sig_algo, key, hash_fn, padding_algo);
385
386 return std::unique_ptr<PK_Signer>(new PK_Signer(key, rng, emsa, format));
387 }
Botan::Signature_Format
Signature_Format
Definition: pk_keys.h:24

Key_Constraints Botan::X509_Certificate::constraints | ( |  | ) | const

Get the key constraints as defined in the KeyUsage extension of this certificate.

Returns
  key constraints

Definition at line 469 of file x509cert.cpp.

Referenced by allowed_usage(), has_constraints(), and to_string().

470 {
471 return data().m_key_constraints;
472 }

std::string Botan::X509_Certificate::crl_distribution_point | ( |  | ) | const

Return the CRL distribution point, or empty if not set

Definition at line 585 of file x509cert.cpp.

Referenced by to_string().

586 {
587 // just returns the first (arbitrarily)
588 if(data().m_crl_distribution_points.size() > 0)
589 return data().m_crl_distribution_points[0];
590 return "";
591 }

void Botan::X509_Object::decode_from | ( | class BER_Decoder & | from | ) |
| override virtual inherited

Decode a BER encoded X509_Object See ASN1_Object::decode_from()

Implements Botan::ASN1_Object.

Definition at line 106 of file x509_obj.cpp.

References Botan::BIT_STRING, Botan::BER_Decoder::decode(), Botan::BER_Decoder::end_cons(), Botan::BER_Decoder::raw_bytes(), Botan::SEQUENCE, and Botan::BER_Decoder::start_cons().

Referenced by Botan::X509_Object::load_data().

107 {
108 from.start_cons(SEQUENCE)
109 .start_cons(SEQUENCE)
110 .raw_bytes(m_tbs_bits)
111 .end_cons()
112 .decode(m_sig_algo)
113 .decode(m_sig, BIT_STRING)
114 .end_cons();
115
116 force_decode();
117 }
Botan::SEQUENCE
Definition: asn1_obj.h:40
Botan::BIT_STRING
Definition: asn1_obj.h:35

void Botan::X509_Object::encode_into | ( | class DER_Encoder & | to | ) | const
| override virtual inherited

DER encode an X509_Object See ASN1_Object::encode_into()

Implements Botan::ASN1_Object.

Definition at line 92 of file x509_obj.cpp.

References Botan::BIT_STRING, Botan::DER_Encoder::encode(), Botan::DER_Encoder::end_cons(), Botan::DER_Encoder::raw_bytes(), Botan::SEQUENCE, Botan::X509_Object::signature(), Botan::X509_Object::signature_algorithm(), Botan::X509_Object::signed_body(), and Botan::DER_Encoder::start_cons().

93 {
94 to.start_cons(SEQUENCE)
95 .start_cons(SEQUENCE)
96 .raw_bytes(signed_body())
97 .end_cons()
98 .encode(signature_algorithm())
99 .encode(signature(), BIT_STRING)
100 .end_cons();
101 }
Botan::X509_Object::signed_body
const std::vector< uint8_t > & signed_body() const
Definition: x509_obj.h:43
Botan::X509_Object::signature_algorithm
const AlgorithmIdentifier & signature_algorithm() const
Definition: x509_obj.h:48
Botan::X509_Object::signature
const std::vector< uint8_t > & signature() const
Definition: x509_obj.h:38
Botan::SEQUENCE
Definition: asn1_obj.h:40
Botan::BIT_STRING
Definition: asn1_obj.h:35

std::string Botan::X509_Certificate::end_time | ( |  | ) | const
| inline

Get the notAfter of the certificate as a string

Returns
  notAfter of the certificate

Definition at line 167 of file x509cert.h.

168 {
169 return not_after().to_string();
170 }
Botan::X509_Certificate::not_after
const X509_Time & not_after() const
Definition: x509cert.cpp:369
Botan::X509_Time::to_string
std::string to_string() const
Return an internal string representation of the time.
Definition: asn1_time.cpp:53

std::vector< std::string > Botan::X509_Certificate::ex_constraints | ( |  | ) | const

Get the key constraints as defined in the ExtendedKeyUsage extension of this certificate.

Returns
  key constraints

Definition at line 711 of file x509cert.cpp.

References extended_key_usage().

Referenced by to_string().

712 {
713 return lookup_oids(extended_key_usage());
714 }
Botan::X509_Certificate::extended_key_usage
const std::vector< OID > & extended_key_usage() const
Definition: x509cert.cpp:474

const std::vector< OID > & Botan::X509_Certificate::extended_key_usage | ( |  | ) | const

Get the key usage as defined in the ExtendedKeyUsage extension of this certificate, or else an empty vector.

Returns
  key usage

Definition at line 474 of file x509cert.cpp.

Referenced by allowed_extended_usage(), ex_constraints(), has_ex_constraint(), and to_string().

475 {
476 return data().m_extended_key_usage;
477 }

std::string Botan::X509_Certificate::fingerprint | ( | const std::string & | hash_name = `"SHA-1"` | ) | const

Returns
  a fingerprint of the certificate

Parameters

  hash_name | hash function used to calculate the fingerprint

Definition at line 724 of file x509cert.cpp.

References Botan::ASN1_Object::BER_encode(), and Botan::create_hex_fingerprint().

Referenced by Botan::Certificate_Store_In_SQL::affirm_cert(), Botan::Certificate_Store_In_SQL::find_key(), Botan::Certificate_Store_In_SQL::insert_cert(), Botan::Certificate_Store_In_SQL::insert_key(), Botan::Certificate_Store_In_SQL::remove_cert(), and Botan::Certificate_Store_In_SQL::revoke_cert().

725 {
726 return create_hex_fingerprint(this->BER_encode(), hash_name);
727 }
Botan::ASN1_Object::BER_encode
std::vector< uint8_t > BER_encode() const
Definition: asn1_obj.cpp:16
Botan::create_hex_fingerprint
std::string create_hex_fingerprint(const uint8_t bits[], size_t bits_len, const std::string &hash_name)
Definition: pk_keys.cpp:17

bool Botan::X509_Certificate::has_constraints | ( | Key_Constraints | constraints | ) | const

Returns true if the specified

Parameters

  constraints | are included in the key usage extension.

Definition at line 546 of file x509cert.cpp.

References constraints(), and Botan::NO_CONSTRAINTS.

547 {
548 if(this->constraints() == NO_CONSTRAINTS)
549 {
550 return false;
551 }
552
553 return ((this->constraints() & constraints) != 0);
554 }
Botan::X509_Certificate::constraints
Key_Constraints constraints() const
Definition: x509cert.cpp:469
Botan::NO_CONSTRAINTS
Definition: key_constraint.h:22

bool Botan::X509_Certificate::has_ex_constraint | ( | const std::string & | ex_constraint | ) | const

Returns true if and only if

Parameters

  ex_constraint | (referring to an extended key constraint, eg "PKIX.ServerAuth") is included in the extended key extension.

Definition at line 556 of file x509cert.cpp.

References Botan::OID::from_string().

557 {
558 return has_ex_constraint(OID::from_string(ex_constraint));
559 }
Botan::X509_Certificate::has_ex_constraint
bool has_ex_constraint(const std::string &ex_constraint) const
Definition: x509cert.cpp:556
Botan::OID::from_string
static OID from_string(const std::string &str)
Definition: asn1_oid.cpp:62

bool Botan::X509_Certificate::has_ex_constraint | ( | const OID & | ex_constraint | ) | const

Returns true if and only if OID

Parameters

  ex_constraint | is included in the extended key extension.

Definition at line 561 of file x509cert.cpp.

References extended_key_usage().

562 {
563 const std::vector<OID>& ex = extended_key_usage();
564 return (std::find(ex.begin(), ex.end(), usage) != ex.end());
565 }
Botan::X509_Certificate::extended_key_usage
const std::vector< OID > & extended_key_usage() const
Definition: x509cert.cpp:474

std::string Botan::X509_Object::hash_used_for_signature | ( |  | ) | const
| inherited

Returns
  hash algorithm that was used to generate signature

Definition at line 138 of file x509_obj.cpp.

References Botan::AlgorithmIdentifier::get_oid(), Botan::parse_algorithm_name(), Botan::X509_Object::signature_algorithm(), Botan::split_on(), Botan::OID::to_formatted_string(), and Botan::OID::to_string().

139 {
140 const OID& oid = m_sig_algo.get_oid();
141 const std::vector<std::string> sig_info = split_on(oid.to_formatted_string(), '/');
142
143 if(sig_info.size() == 1 && sig_info[0] == "Ed25519")
144 return "SHA-512";
145 else if(sig_info.size() != 2)
146 throw Internal_Error("Invalid name format found for " + oid.to_string());
147
148 if(sig_info[1] == "EMSA4")
149 {
150 const OID hash_oid = decode_pss_params(signature_algorithm().get_parameters()).hash_algo.get_oid();
151 return hash_oid.to_formatted_string();
152 }
153 else
154 {
155 const std::vector<std::string> pad_and_hash =
156 parse_algorithm_name(sig_info[1]);
157
158 if(pad_and_hash.size() != 2)
159 {
160 throw Internal_Error("Invalid name format " + sig_info[1]);
161 }
162
163 return pad_and_hash[1];
164 }
165 }
Botan::split_on
std::vector< std::string > split_on(const std::string &str, char delim)
Definition: parsing.cpp:148
Botan::X509_Object::signature_algorithm
const AlgorithmIdentifier & signature_algorithm() const
Definition: x509_obj.h:48
Botan::parse_algorithm_name
std::vector< std::string > parse_algorithm_name(const std::string &namex)
Definition: parsing.cpp:95
Botan::AlgorithmIdentifier::get_oid
const OID & get_oid() const
Definition: alg_id.h:37
Botan::OCSP::Response_Status_Code::Internal_Error

bool Botan::X509_Certificate::is_CA_cert | ( |  | ) | const

Check whether this certificate is a CA certificate.

Returns
  true if this certificate is a CA certificate

Definition at line 453 of file x509cert.cpp.

Referenced by allowed_usage(), Botan::Cert_Extension::Name_Constraints::validate(), and Botan::X509_CA::X509_CA().

454 {
455 if(data().m_version < 3 && data().m_self_signed)
456 return true;
457
458 return data().m_is_ca_certificate;
459 }

bool Botan::X509_Certificate::is_critical | ( | const std::string & | ex_name | ) | const

Check whenever a given X509 Extension is marked critical in this certificate.

Definition at line 570 of file x509cert.cpp.

References Botan::Extensions::critical_extension_set(), Botan::OID::from_string(), and v3_extensions().

Referenced by Botan::Cert_Extension::Name_Constraints::validate().

571 {
572 return v3_extensions().critical_extension_set(OID::from_string(ex_name));
573 }
Botan::Extensions::critical_extension_set
bool critical_extension_set(const OID &oid) const
Definition: x509_ext.cpp:182
Botan::X509_Certificate::v3_extensions
const Extensions & v3_extensions() const
Definition: x509cert.cpp:489
Botan::OID::from_string
static OID from_string(const std::string &str)
Definition: asn1_oid.cpp:62

bool Botan::X509_Certificate::is_self_signed | ( |  | ) | const

Check whether this certificate is self signed. If the DN issuer and subject agree,

Returns
  true if this certificate is self signed

Definition at line 359 of file x509cert.cpp.

360 {
361 return data().m_self_signed;
362 }

bool Botan::X509_Certificate::is_serial_negative | ( |  | ) | const

Get the serial number's sign

Returns
  1 iff the serial is negative.

Definition at line 427 of file x509cert.cpp.

428 {
429 return data().m_serial_negative;
430 }

const AlternativeName & Botan::X509_Certificate::issuer_alt_name | ( |  | ) | const

Return the issuer alternative names (DNS, IP, ...)

Definition at line 598 of file x509cert.cpp.

Referenced by issuer_info().

599 {
600 return data().m_issuer_alt_name;
601 }

const X509_DN & Botan::X509_Certificate::issuer_dn | ( |  | ) | const

Get the certificate's issuer distinguished name (DN).

Returns
  issuer DN of this certificate

Definition at line 433 of file x509cert.cpp.

Referenced by Botan::PKIX::build_certificate_path(), Botan::Certificate_Store_In_SQL::find_crl_for(), Botan::Certificate_Store_In_Memory::find_crl_for(), Botan::X509_CRL::is_revoked(), issuer_info(), Botan::OCSP::Request::Request(), and to_string().

434 {
435 return data().m_issuer_dn;
436 }

std::vector< std::string > Botan::X509_Certificate::issuer_info | ( | const std::string & | name | ) | const

Get a value for a specific subject_info parameter name.

Parameters

  name | the name of the parameter to look up. Possible names are "X509.Certificate.v2.key_id" or "X509v3.AuthorityKeyIdentifier".

Returns
  value(s) of the specified parameter

Definition at line 642 of file x509cert.cpp.

References authority_key_id(), Botan::AlternativeName::get_attribute(), Botan::X509_DN::get_attribute(), Botan::hex_encode(), issuer_alt_name(), issuer_dn(), raw_issuer_dn(), and v2_issuer_key_id().

643 {
644 if(issuer_dn().has_field(req))
645 return issuer_dn().get_attribute(req);
646
647 if(issuer_alt_name().has_field(req))
648 return issuer_alt_name().get_attribute(req);
649
650 // These will be removed later:
651 if(req == "X509.Certificate.v2.key_id")
652 return {hex_encode(this->v2_issuer_key_id())};
653 if(req == "X509v3.AuthorityKeyIdentifier")
654 return {hex_encode(this->authority_key_id())};
655 if(req == "X509.Certificate.dn_bits")
656 return {hex_encode(this->raw_issuer_dn())};
657
658 return data().m_issuer_ds.get(req);
659 }
Botan::hex_encode
void hex_encode(char output[], const uint8_t input[], size_t input_length, bool uppercase)
Definition: hex.cpp:14
Botan::X509_Certificate::authority_key_id
const std::vector< uint8_t > & authority_key_id() const
Definition: x509cert.cpp:412
Botan::X509_Certificate::v2_issuer_key_id
const std::vector< uint8_t > & v2_issuer_key_id() const
Definition: x509cert.cpp:379
Botan::X509_Certificate::issuer_dn
const X509_DN & issuer_dn() const
Definition: x509cert.cpp:433
Botan::X509_Certificate::issuer_alt_name
const AlternativeName & issuer_alt_name() const
Definition: x509cert.cpp:598
Botan::X509_DN::get_attribute
std::vector< std::string > get_attribute(const std::string &attr) const
Definition: x509_dn.cpp:109
Botan::X509_Certificate::raw_issuer_dn
const std::vector< uint8_t > & raw_issuer_dn() const
Definition: x509cert.cpp:443
Botan::AlternativeName::get_attribute
std::vector< std::string > get_attribute(const std::string &attr) const
Definition: asn1_alt_name.cpp:99

void Botan::X509_Object::load_data | ( | DataSource & | src | ) |
| protected inherited

Decodes from src as either DER or PEM data, then calls force_decode()

Definition at line 52 of file x509_obj.cpp.

References Botan::X509_Object::alternate_PEM_labels(), Botan::PEM_Code::decode(), Botan::X509_Object::decode_from(), Botan::PEM_Code::matches(), Botan::ASN1::maybe_BER(), and Botan::X509_Object::PEM_label().

Referenced by Botan::PKCS10_Request::PKCS10_Request(), X509_Certificate(), and Botan::X509_CRL::X509_CRL().

53 {
54 try {
55 if(ASN1::maybe_BER(in) && !PEM_Code::matches(in))
56 {
57 BER_Decoder dec(in);
58 decode_from(dec);
59 }
60 else
61 {
62 std::string got_label;
63 DataSource_Memory ber(PEM_Code::decode(in, got_label));
64
65 if(got_label != PEM_label())
66 {
67 bool is_alternate = false;
68 for(std::string alt_label : alternate_PEM_labels())
69 {
70 if(got_label == alt_label)
71 {
72 is_alternate = true;
73 break;
74 }
75 }
76
77 if(!is_alternate)
78 throw Decoding_Error("Unexpected PEM label for " + PEM_label() + " of " + got_label);
79 }
80
81 BER_Decoder dec(ber);
82 decode_from(dec);
83 }
84 }
85 catch(Decoding_Error& e)
86 {
87 throw Decoding_Error(PEM_label() + " decoding", e);
88 }
89 }
Botan::X509_Object::PEM_label
virtual std::string PEM_label() const =0
Botan::ASN1::maybe_BER
bool maybe_BER(DataSource &source)
Definition: asn1_obj.cpp:222
Botan::X509_Object::alternate_PEM_labels
virtual std::vector< std::string > alternate_PEM_labels() const
Definition: x509_obj.h:114
Botan::X509_Object::decode_from
void decode_from(class BER_Decoder &from) override
Definition: x509_obj.cpp:106
Botan::PEM_Code::matches
bool matches(DataSource &source, const std::string &extra, size_t search_range)
Definition: pem.cpp:142
Botan::PEM_Code::decode
secure_vector< uint8_t > decode(DataSource &source, std::string &label)
Definition: pem.cpp:68

std::unique_ptr< Public_Key > Botan::X509_Certificate::load_subject_public_key | ( |  | ) | const

Create a public key object associated with the public key bits in this certificate. If the public key bits was valid for X.509 encoding purposes but invalid algorithmically (for example, RSA with an even modulus) that will be detected at this point, and an exception will be thrown.

Returns
  subject public key of this certificate

Definition at line 664 of file x509cert.cpp.

References Botan::X509::load_key(), and subject_public_key_info().

665 {
666 try
667 {
668 return std::unique_ptr<Public_Key>(X509::load_key(subject_public_key_info()));
669 }
670 catch(std::exception& e)
671 {
672 throw Decoding_Error("X509_Certificate::load_subject_public_key", e);
673 }
674 }
Botan::X509_Certificate::subject_public_key_info
const std::vector< uint8_t > & subject_public_key_info() const
Definition: x509cert.cpp:394
Botan::X509::load_key
Public_Key * load_key(DataSource &source)
Definition: x509_key.cpp:37

std::vector< uint8_t > Botan::X509_Object::make_signed | ( | class PK_Signer * | signer,
|  | RandomNumberGenerator & | rng,
|  | const AlgorithmIdentifier & | alg_id,
|  | const secure_vector< uint8_t > & | tbs
| ) |  |
| static inherited

Create a signed X509 object.

Parameters

  signer | the signer used to sign the object
  rng | the random number generator to use
  alg_id | the algorithm identifier of the signature scheme
  tbs | the tbs bits to be signed

Returns
  signed X509 object

Definition at line 268 of file x509_obj.cpp.

References Botan::BIT_STRING, Botan::DER_Encoder::encode(), Botan::DER_Encoder::end_cons(), Botan::DER_Encoder::raw_bytes(), Botan::SEQUENCE, Botan::PK_Signer::sign_message(), Botan::X509_Object::signature(), and Botan::DER_Encoder::start_cons().

Referenced by Botan::PKCS10_Request::create(), and Botan::X509_CA::make_cert().

272 {
273 const std::vector<uint8_t> signature = signer->sign_message(tbs_bits, rng);
274
275 std::vector<uint8_t> output;
276 DER_Encoder(output)
277 .start_cons(SEQUENCE)
278 .raw_bytes(tbs_bits)
279 .encode(algo)
280 .encode(signature, BIT_STRING)
281 .end_cons();
282
283 return output;
284 }
Botan::X509_Object::signature
const std::vector< uint8_t > & signature() const
Definition: x509_obj.h:38
Botan::SEQUENCE
Definition: asn1_obj.h:40
Botan::BIT_STRING
Definition: asn1_obj.h:35

bool Botan::X509_Certificate::matches_dns_name | ( | const std::string & | name | ) | const

Check if a certain DNS name matches up with the information in the cert

Parameters

  name | DNS name to match

Definition at line 729 of file x509cert.cpp.

References Botan::host_wildcard_match(), and subject_info().

Referenced by botan_x509_cert_hostname_match().

730 {
731 if(name.empty())
732 return false;
733
734 std::vector<std::string> issued_names = subject_info("DNS");
735
736 // Fall back to CN only if no DNS names are set (RFC 6125 sec 6.4.4)
737 if(issued_names.empty())
738 issued_names = subject_info("Name");
739
740 for(size_t i = 0; i != issued_names.size(); ++i)
741 {
742 if(host_wildcard_match(issued_names[i], name))
743 return true;
744 }
745
746 return false;
747 }
Botan::host_wildcard_match
bool host_wildcard_match(const std::string &issued_, const std::string &host_)
Definition: parsing.cpp:343
name
std::string name
Definition: commoncrypto_hash.cpp:23
Botan::X509_Certificate::subject_info
std::vector< std::string > subject_info(const std::string &name) const
Definition: x509cert.cpp:607

const NameConstraints & Botan::X509_Certificate::name_constraints | ( |  | ) | const

Get the name constraints as defined in the NameConstraints extension of this certificate.

Returns
  name constraints

Definition at line 484 of file x509cert.cpp.

Referenced by to_string().

485 {
486 return data().m_name_constraints;
487 }

const X509_Time & Botan::X509_Certificate::not_after | ( |  | ) | const

Get the notAfter of the certificate as X509_Time

Returns
  notAfter of the certificate

Definition at line 369 of file x509cert.cpp.

Referenced by botan_x509_cert_not_after(), subject_info(), and to_string().

370 {
371 return data().m_not_after;
372 }

const X509_Time & Botan::X509_Certificate::not_before | ( |  | ) | const

Get the notBefore of the certificate as X509_Time

Returns
  notBefore of the certificate

Definition at line 364 of file x509cert.cpp.

Referenced by botan_x509_cert_not_before(), subject_info(), and to_string().

365 {
366 return data().m_not_before;
367 }

std::string Botan::X509_Certificate::ocsp_responder | ( |  | ) | const

Return the listed address of an OCSP responder, or empty if not set

Definition at line 575 of file x509cert.cpp.

Referenced by to_string().

576 {
577 return data().m_ocsp_responder;
578 }

bool Botan::X509_Certificate::operator< | ( | const X509_Certificate & | other | ) | const

Impose an arbitrary (but consistent) ordering, eg to allow sorting a container of certificate objects.

Returns
  true if this is less than other by some unspecified criteria

Definition at line 759 of file x509cert.cpp.

References Botan::X509_Object::signature(), and Botan::X509_Object::signed_body().

760 {
761 /* If signature values are not equal, sort by lexicographic ordering of that */
762 if(this->signature() != other.signature())
763 {
764 return (this->signature() < other.signature());
765 }
766
767 // Then compare the signed contents
768 return this->signed_body() < other.signed_body();
769 }
Botan::X509_Object::signed_body
const std::vector< uint8_t > & signed_body() const
Definition: x509_obj.h:43
Botan::X509_Object::signature
const std::vector< uint8_t > & signature() const
Definition: x509_obj.h:38

X509_Certificate& Botan::X509_Certificate::operator= | ( | const X509_Certificate & | other | ) |
| default

bool Botan::X509_Certificate::operator== | ( | const X509_Certificate & | other | ) | const

Check to certificates for equality.

Returns
  true both certificates are (binary) equal

Definition at line 752 of file x509cert.cpp.

References Botan::X509_Object::signature(), Botan::X509_Object::signature_algorithm(), and Botan::X509_Object::signed_body().

753 {
754 return (this->signature() == other.signature() &&
755 this->signature_algorithm() == other.signature_algorithm() &&
756 this->signed_body() == other.signed_body());
757 }
Botan::X509_Object::signed_body
const std::vector< uint8_t > & signed_body() const
Definition: x509_obj.h:43
Botan::X509_Object::signature_algorithm
const AlgorithmIdentifier & signature_algorithm() const
Definition: x509_obj.h:48
Botan::X509_Object::signature
const std::vector< uint8_t > & signature() const
Definition: x509_obj.h:38

uint32_t Botan::X509_Certificate::path_limit | ( |  | ) | const

Get the path limit as defined in the BasicConstraints extension of this certificate.

Returns
  path limit

Definition at line 461 of file x509cert.cpp.

462 {
463 if(data().m_version < 3 && data().m_self_signed)
464 return 32; // in theory infinite, but this is more than enough
465
466 return static_cast<uint32_t>(data().m_path_len_constraint);
467 }

std::string Botan::X509_Object::PEM_encode | ( |  | ) | const
| inherited

Returns
  PEM encoding of this

Definition at line 122 of file x509_obj.cpp.

References Botan::ASN1_Object::BER_encode(), Botan::PEM_Code::encode(), and Botan::X509_Object::PEM_label().

123 {
124 return PEM_Code::encode(BER_encode(), PEM_label());
125 }
Botan::X509_Object::PEM_label
virtual std::string PEM_label() const =0
Botan::PEM_Code::encode
std::string encode(const uint8_t der[], size_t length, const std::string &label, size_t width)
Definition: pem.cpp:43
Botan::ASN1_Object::BER_encode
std::vector< uint8_t > BER_encode() const
Definition: asn1_obj.cpp:16

std::vector< std::string > Botan::X509_Certificate::policies | ( |  | ) | const

Get the policies as defined in the CertificatePolicies extension of this certificate.

Returns
  certificate policies

Definition at line 719 of file x509cert.cpp.

References certificate_policy_oids().

Referenced by to_string().

720 {
721 return lookup_oids(certificate_policy_oids());
722 }
Botan::X509_Certificate::certificate_policy_oids
const std::vector< OID > & certificate_policy_oids() const
Definition: x509cert.cpp:479

const std::vector< uint8_t > & Botan::X509_Certificate::raw_issuer_dn | ( |  | ) | const

Raw issuer DN bits

Definition at line 443 of file x509cert.cpp.

Referenced by Botan::OCSP::CertID::is_id_for(), issuer_info(), and raw_issuer_dn_sha256().

444 {
445 return data().m_issuer_dn_bits;
446 }

std::vector< uint8_t > Botan::X509_Certificate::raw_issuer_dn_sha256 | ( |  | ) | const

SHA-256 of Raw issuer DN

Definition at line 676 of file x509cert.cpp.

References Botan::HashFunction::create_or_throw(), hash, and raw_issuer_dn().

677 {
678 std::unique_ptr<HashFunction> hash(HashFunction::create_or_throw("SHA-256"));
679 hash->update(raw_issuer_dn());
680 return hash->final_stdvec();
681 }
Botan::HashFunction::create_or_throw
static std::unique_ptr< HashFunction > create_or_throw(const std::string &algo_spec, const std::string &provider="")
Definition: hash.cpp:344
Botan::X509_Certificate::raw_issuer_dn
const std::vector< uint8_t > & raw_issuer_dn() const
Definition: x509cert.cpp:443
hash
MechanismType hash
Definition: p11_mechanism.cpp:64

const std::vector< uint8_t > & Botan::X509_Certificate::raw_subject_dn | ( |  | ) | const

Raw subject DN

Definition at line 448 of file x509cert.cpp.

Referenced by Botan::OCSP::CertID::CertID(), raw_subject_dn_sha256(), and subject_info().

449 {
450 return data().m_subject_dn_bits;
451 }

std::vector< uint8_t > Botan::X509_Certificate::raw_subject_dn_sha256 | ( |  | ) | const

SHA-256 of Raw subject DN

Definition at line 683 of file x509cert.cpp.

References Botan::HashFunction::create(), hash, and raw_subject_dn().

684 {
685 std::unique_ptr<HashFunction> hash(HashFunction::create("SHA-256"));
686 hash->update(raw_subject_dn());
687 return hash->final_stdvec();
688 }
Botan::X509_Certificate::raw_subject_dn
const std::vector< uint8_t > & raw_subject_dn() const
Definition: x509cert.cpp:448
Botan::HashFunction::create
static std::unique_ptr< HashFunction > create(const std::string &algo_spec, const std::string &provider="")
Definition: hash.cpp:106
hash
MechanismType hash
Definition: p11_mechanism.cpp:64

const std::vector< uint8_t > & Botan::X509_Certificate::serial_number | ( |  | ) | const

Get the serial number of this certificate.

Returns
  certificates serial number

Definition at line 422 of file x509cert.cpp.

Referenced by Botan::CRL_Entry::CRL_Entry(), Botan::OCSP::CertID::is_id_for(), Botan::X509_CRL::is_revoked(), subject_info(), and to_string().

423 {
424 return data().m_serial;
425 }

const std::vector<uint8_t>& Botan::X509_Object::signature | ( |  | ) | const
| inline inherited

Returns
  signature on tbs_data()

Definition at line 38 of file x509_obj.h.

Referenced by Botan::X509_Object::encode_into(), Botan::X509_Object::make_signed(), operator<(), operator==(), and Botan::X509_Object::verify_signature().

38 { return m_sig; }

const AlgorithmIdentifier& Botan::X509_Object::signature_algorithm | ( |  | ) | const
| inline inherited

Returns
  signature algorithm that was used to generate signature

Definition at line 48 of file x509_obj.h.

Referenced by Botan::X509_Object::encode_into(), Botan::X509_Object::hash_used_for_signature(), operator==(), to_string(), Botan::X509_Object::verify_signature(), and Botan::X509_CA::X509_CA().

48 { return m_sig_algo; }

const std::vector<uint8_t>& Botan::X509_Object::signed_body | ( |  | ) | const
| inline inherited

Returns
  signed body

Definition at line 43 of file x509_obj.h.

Referenced by Botan::X509_Object::encode_into(), operator<(), and operator==().

43 { return m_tbs_bits; }

std::string Botan::X509_Certificate::start_time | ( |  | ) | const
| inline

Get the notBefore of the certificate as a string

Returns
  notBefore of the certificate

Definition at line 158 of file x509cert.h.

159 {
160 return not_before().to_string();
161 }
Botan::X509_Certificate::not_before
const X509_Time & not_before() const
Definition: x509cert.cpp:364
Botan::X509_Time::to_string
std::string to_string() const
Return an internal string representation of the time.
Definition: asn1_time.cpp:53

const AlternativeName & Botan::X509_Certificate::subject_alt_name | ( |  | ) | const

Return the subject alternative names (DNS, IP, ...)

Definition at line 593 of file x509cert.cpp.

Referenced by Botan::GeneralName::matches(), and subject_info().

594 {
595 return data().m_subject_alt_name;
596 }

const X509_DN & Botan::X509_Certificate::subject_dn | ( |  | ) | const

Get the certificate's subject distinguished name (DN).

Returns
  subject DN of this certificate

Definition at line 438 of file x509cert.cpp.

Referenced by Botan::Certificate_Store_Windows::all_subjects(), Botan::Certificate_Store::certificate_known(), Botan::Certificate_Store_In_SQL::insert_cert(), Botan::GeneralName::matches(), Botan::Certificate_Store_In_SQL::remove_cert(), Botan::OCSP::Request::Request(), Botan::X509_CA::sign_request(), subject_info(), and to_string().

439 {
440 return data().m_subject_dn;
441 }

std::vector< std::string > Botan::X509_Certificate::subject_info | ( | const std::string & | name | ) | const

Get a value for a specific subject_info parameter name.

Parameters

  name | the name of the parameter to look up. Possible names include "X509.Certificate.version", "X509.Certificate.serial", "X509.Certificate.start", "X509.Certificate.end", "X509.Certificate.v2.key_id", "X509.Certificate.public_key", "X509v3.BasicConstraints.path_constraint", "X509v3.BasicConstraints.is_ca", "X509v3.NameConstraints", "X509v3.ExtendedKeyUsage", "X509v3.CertificatePolicies", "X509v3.SubjectKeyIdentifier", "X509.Certificate.serial", "X520.CommonName", "X520.Organization", "X520.Country", "RFC822" (Email in SAN) or "PKCS9.EmailAddress" (Email in DN).

Returns
  value(s) of the specified parameter

Definition at line 607 of file x509cert.cpp.

References Botan::AlternativeName::get_attribute(), Botan::X509_DN::get_attribute(), Botan::hex_encode(), not_after(), not_before(), raw_subject_dn(), serial_number(), subject_alt_name(), subject_dn(), subject_key_id(), Botan::X509_Time::to_string(), Botan::ASN1::to_string(), v2_subject_key_id(), and x509_version().

Referenced by matches_dns_name().

608 {
609 if(req == "Email")
610 return this->subject_info("RFC822");
611
612 if(subject_dn().has_field(req))
613 return subject_dn().get_attribute(req);
614
615 if(subject_alt_name().has_field(req))
616 return subject_alt_name().get_attribute(req);
617
618 // These will be removed later:
619 if(req == "X509.Certificate.v2.key_id")
620 return {hex_encode(this->v2_subject_key_id())};
621 if(req == "X509v3.SubjectKeyIdentifier")
622 return {hex_encode(this->subject_key_id())};
623 if(req == "X509.Certificate.dn_bits")
624 return {hex_encode(this->raw_subject_dn())};
625 if(req == "X509.Certificate.start")
626 return {not_before().to_string()};
627 if(req == "X509.Certificate.end")
628 return {not_after().to_string()};
629
630 if(req == "X509.Certificate.version")
631 return {std::to_string(x509_version())};
632 if(req == "X509.Certificate.serial")
633 return {hex_encode(serial_number())};
634
635 return data().m_subject_ds.get(req);
636 }
Botan::X509_Certificate::subject_alt_name
const AlternativeName & subject_alt_name() const
Definition: x509cert.cpp:593
Botan::X509_Certificate::subject_key_id
const std::vector< uint8_t > & subject_key_id() const
Definition: x509cert.cpp:417
Botan::hex_encode
void hex_encode(char output[], const uint8_t input[], size_t input_length, bool uppercase)
Definition: hex.cpp:14
Botan::X509_Certificate::serial_number
const std::vector< uint8_t > & serial_number() const
Definition: x509cert.cpp:422
Botan::X509_Certificate::v2_subject_key_id
const std::vector< uint8_t > & v2_subject_key_id() const
Definition: x509cert.cpp:384
Botan::X509_Certificate::not_before
const X509_Time & not_before() const
Definition: x509cert.cpp:364
Botan::ASN1::to_string
std::string to_string(const BER_Object &obj)
Definition: asn1_obj.cpp:213
Botan::X509_Certificate::raw_subject_dn
const std::vector< uint8_t > & raw_subject_dn() const
Definition: x509cert.cpp:448
Botan::X509_Certificate::not_after
const X509_Time & not_after() const
Definition: x509cert.cpp:369
Botan::X509_Certificate::x509_version
uint32_t x509_version() const
Definition: x509cert.cpp:354
Botan::X509_DN::get_attribute
std::vector< std::string > get_attribute(const std::string &attr) const
Definition: x509_dn.cpp:109
Botan::X509_Time::to_string
std::string to_string() const
Return an internal string representation of the time.
Definition: asn1_time.cpp:53
Botan::X509_Certificate::subject_info
std::vector< std::string > subject_info(const std::string &name) const
Definition: x509cert.cpp:607
Botan::X509_Certificate::subject_dn
const X509_DN & subject_dn() const
Definition: x509cert.cpp:438
Botan::AlternativeName::get_attribute
std::vector< std::string > get_attribute(const std::string &attr) const
Definition: asn1_alt_name.cpp:99

const std::vector< uint8_t > & Botan::X509_Certificate::subject_key_id | ( |  | ) | const

Get the DER encoded SubjectKeyIdentifier of this certificate.

Returns
  DER encoded SubjectKeyIdentifier

Definition at line 417 of file x509cert.cpp.

Referenced by Botan::Certificate_Store::certificate_known(), Botan::Certificate_Store_In_SQL::insert_cert(), Botan::Certificate_Store_In_SQL::remove_cert(), subject_info(), and to_string().

418 {
419 return data().m_subject_key_id;
420 }

Public_Key* Botan::X509_Certificate::subject_public_key | ( |  | ) | const
| inline

Return a newly allocated copy of the public key associated with the subject of this certificate. This object is owned by the caller.

Returns
  public key

Definition at line 50 of file x509cert.h.

Referenced by to_string(), Botan::TLS::Certificate_Verify::verify(), and Botan::OCSP::Response::verify_signature().

51 {
52 return load_subject_public_key().release();
53 }
Botan::X509_Certificate::load_subject_public_key
std::unique_ptr< Public_Key > load_subject_public_key() const
Definition: x509cert.cpp:664

const AlgorithmIdentifier & Botan::X509_Certificate::subject_public_key_algo | ( |  | ) | const

Return the algorithm identifier of the public key

Definition at line 374 of file x509cert.cpp.

Referenced by to_string().

375 {
376 return data().m_subject_public_key_algid;
377 }

const std::vector< uint8_t > & Botan::X509_Certificate::subject_public_key_bits | ( |  | ) | const

Get the public key associated with this certificate. This includes the outer AlgorithmIdentifier

Returns
  subject public key of this certificate

Definition at line 389 of file x509cert.cpp.

390 {
391 return data().m_subject_public_key_bits;
392 }

const std::vector< uint8_t > & Botan::X509_Certificate::subject_public_key_bitstring | ( |  | ) | const

Get the bit string of the public key associated with this certificate

Returns
  public key bits

Definition at line 399 of file x509cert.cpp.

Referenced by Botan::OCSP::CertID::CertID(), and Botan::OCSP::CertID::is_id_for().

400 {
401 return data().m_subject_public_key_bitstring;
402 }

const std::vector< uint8_t > & Botan::X509_Certificate::subject_public_key_bitstring_sha1 | ( |  | ) | const

Get the SHA-1 bit string of the public key associated with this certificate. This is used for OCSP among other protocols. This function will throw if SHA-1 is not available.

Returns
  hash of subject public key of this certificate

Definition at line 404 of file x509cert.cpp.

405 {
406 if(data().m_subject_public_key_bitstring_sha1.empty())
407 throw Encoding_Error("X509_Certificate::subject_public_key_bitstring_sha1 called but SHA-1 disabled in build");
408
409 return data().m_subject_public_key_bitstring_sha1;
410 }

const std::vector< uint8_t > & Botan::X509_Certificate::subject_public_key_info | ( |  | ) | const

Get the SubjectPublicKeyInfo associated with this certificate.

Returns
  subject public key info of this certificate

Definition at line 394 of file x509cert.cpp.

Referenced by load_subject_public_key().

395 {
396 return data().m_subject_public_key_bits_seq;
397 }

std::vector< uint8_t > Botan::X509_Object::tbs_data | ( |  | ) | const
| inherited

The underlying data that is to be or was signed

Returns
  data that is or was signed

Definition at line 130 of file x509_obj.cpp.

References Botan::ASN1::put_in_sequence().

Referenced by Botan::X509_Object::verify_signature().

131 {
132 return ASN1::put_in_sequence(m_tbs_bits);
133 }
Botan::ASN1::put_in_sequence
std::vector< uint8_t > put_in_sequence(const std::vector< uint8_t > &contents)
Definition: asn1_obj.cpp:195

std::string Botan::X509_Certificate::to_string | ( |  | ) | const

Returns
  a free-form string describing the certificate

Definition at line 779 of file x509cert.cpp.

References authority_key_id(), ca_issuers(), certificate_policy_oids(), constraints(), crl_distribution_point(), Botan::CRL_SIGN, Botan::DATA_ENCIPHERMENT, Botan::DECIPHER_ONLY, Botan::DIGITAL_SIGNATURE, Botan::ENCIPHER_ONLY, ex_constraints(), Botan::NameConstraints::excluded(), extended_key_usage(), Botan::AlgorithmIdentifier::get_oid(), Botan::hex_encode(), issuer_dn(), Botan::KEY_AGREEMENT, Botan::KEY_CERT_SIGN, Botan::KEY_ENCIPHERMENT, name_constraints(), Botan::NO_CONSTRAINTS, Botan::NON_REPUDIATION, not_after(), not_before(), ocsp_responder(), Botan::X509::PEM_encode(), Botan::NameConstraints::permitted(), policies(), Botan::X509_Time::readable_string(), serial_number(), Botan::X509_Object::signature_algorithm(), subject_dn(), subject_key_id(), subject_public_key(), subject_public_key_algo(), Botan::OID::to_formatted_string(), Botan::OID::to_string(), and x509_version().

780 {
781 std::ostringstream out;
782
783 out << "Version: " << this->x509_version() << "\n";
784 out << "Subject: " << subject_dn() << "\n";
785 out << "Issuer: " << issuer_dn() << "\n";
786 out << "Issued: " << this->not_before().readable_string() << "\n";
787 out << "Expires: " << this->not_after().readable_string() << "\n";
788
789 out << "Constraints:\n";
790 Key_Constraints constraints = this->constraints();
791 if(constraints == NO_CONSTRAINTS)
792 out << " None\n";
793 else
794 {
795 if(constraints & DIGITAL_SIGNATURE)
796 out << " Digital Signature\n";
797 if(constraints & NON_REPUDIATION)
798 out << " Non-Repudiation\n";
799 if(constraints & KEY_ENCIPHERMENT)
800 out << " Key Encipherment\n";
801 if(constraints & DATA_ENCIPHERMENT)
802 out << " Data Encipherment\n";
803 if(constraints & KEY_AGREEMENT)
804 out << " Key Agreement\n";
805 if(constraints & KEY_CERT_SIGN)
806 out << " Cert Sign\n";
807 if(constraints & CRL_SIGN)
808 out << " CRL Sign\n";
809 if(constraints & ENCIPHER_ONLY)
810 out << " Encipher Only\n";
811 if(constraints & DECIPHER_ONLY)
812 out << " Decipher Only\n";
813 }
814
815 const std::vector<OID>& policies = this->certificate_policy_oids();
816 if(!policies.empty())
817 {
818 out << "Policies: " << "\n";
819 for(auto oid : policies)
820 out << " " << oid.to_string() << "\n";
821 }
822
823 const std::vector<OID>& ex_constraints = this->extended_key_usage();
824 if(!ex_constraints.empty())
825 {
826 out << "Extended Constraints:\n";
827 for(auto&& oid : ex_constraints)
828 {
829 out << " " << oid.to_formatted_string() << "\n";
830 }
831 }
832
833 const NameConstraints& name_constraints = this->name_constraints();
834
835 if(!name_constraints.permitted().empty() || !name_constraints.excluded().empty())
836 {
837 out << "Name Constraints:\n";
838
839 if(!name_constraints.permitted().empty())
840 {
841 out << " Permit";
842 for(auto st: name_constraints.permitted())
843 {
844 out << " " << st.base();
845 }
846 out << "\n";
847 }
848
849 if(!name_constraints.excluded().empty())
850 {
851 out << " Exclude";
852 for(auto st: name_constraints.excluded())
853 {
854 out << " " << st.base();
855 }
856 out << "\n";
857 }
858 }
859
860 if(!ocsp_responder().empty())
861 out << "OCSP responder " << ocsp_responder() << "\n";
862
863 const std::vector<std::string> ca_issuers = this->ca_issuers();
864 if(!ca_issuers.empty())
865 {
866 out << "CA Issuers:\n";
867 for(size_t i = 0; i != ca_issuers.size(); i++)
868 out << " URI: " << ca_issuers[i] << "\n";
869 }
870
871 if(!crl_distribution_point().empty())
872 out << "CRL " << crl_distribution_point() << "\n";
873
874 out << "Signature algorithm: " << this->signature_algorithm().get_oid().to_formatted_string() << "\n";
875
876 out << "Serial number: " << hex_encode(this->serial_number()) << "\n";
877
878 if(this->authority_key_id().size())
879 out << "Authority keyid: " << hex_encode(this->authority_key_id()) << "\n";
880
881 if(this->subject_key_id().size())
882 out << "Subject keyid: " << hex_encode(this->subject_key_id()) << "\n";
883
884 try
885 {
886 std::unique_ptr<Public_Key> pubkey(this->subject_public_key());
887 out << "Public Key [" << pubkey->algo_name() << "-" << pubkey->key_length() << "]\n\n";
888 out << X509::PEM_encode(*pubkey);
889 }
890 catch(Decoding_Error&)
891 {
892 const AlgorithmIdentifier& alg_id = this->subject_public_key_algo();
893 out << "Failed to decode key with oid " << alg_id.get_oid().to_string() << "\n";
894 }
895
896 return out.str();
897 }
Botan::X509_Certificate::subject_key_id
const std::vector< uint8_t > & subject_key_id() const
Definition: x509cert.cpp:417
Botan::hex_encode
void hex_encode(char output[], const uint8_t input[], size_t input_length, bool uppercase)
Definition: hex.cpp:14
Botan::X509_Certificate::serial_number
const std::vector< uint8_t > & serial_number() const
Definition: x509cert.cpp:422
Botan::DATA_ENCIPHERMENT
Definition: key_constraint.h:26
Botan::ENCIPHER_ONLY
Definition: key_constraint.h:30
Botan::X509_Certificate::ca_issuers
std::vector< std::string > ca_issuers() const
Definition: x509cert.cpp:580
Botan::NON_REPUDIATION
Definition: key_constraint.h:24
Botan::X509_Certificate::subject_public_key_algo
const AlgorithmIdentifier & subject_public_key_algo() const
Definition: x509cert.cpp:374
Botan::X509::PEM_encode
std::string PEM_encode(const Public_Key &key)
Definition: x509_key.cpp:28
Botan::X509_Certificate::not_before
const X509_Time & not_before() const
Definition: x509cert.cpp:364
Botan::X509_Certificate::authority_key_id
const std::vector< uint8_t > & authority_key_id() const
Definition: x509cert.cpp:412
Botan::KEY_ENCIPHERMENT
Definition: key_constraint.h:25
Botan::X509_Certificate::ocsp_responder
std::string ocsp_responder() const
Definition: x509cert.cpp:575
Botan::X509_Certificate::constraints
Key_Constraints constraints() const
Definition: x509cert.cpp:469
Botan::KEY_AGREEMENT
Definition: key_constraint.h:27
Botan::OID::to_formatted_string
std::string to_formatted_string() const
Definition: asn1_oid.cpp:110
Botan::X509_Certificate::crl_distribution_point
std::string crl_distribution_point() const
Definition: x509cert.cpp:585
Botan::X509_Object::signature_algorithm
const AlgorithmIdentifier & signature_algorithm() const
Definition: x509_obj.h:48
Botan::NO_CONSTRAINTS
Definition: key_constraint.h:22
Botan::DIGITAL_SIGNATURE
Definition: key_constraint.h:23
Botan::X509_Certificate::certificate_policy_oids
const std::vector< OID > & certificate_policy_oids() const
Definition: x509cert.cpp:479
Botan::X509_Certificate::subject_public_key
Public_Key * subject_public_key() const
Definition: x509cert.h:50
Botan::CRL_SIGN
Definition: key_constraint.h:29
Botan::X509_Certificate::extended_key_usage
const std::vector< OID > & extended_key_usage() const
Definition: x509cert.cpp:474
Botan::X509_Certificate::issuer_dn
const X509_DN & issuer_dn() const
Definition: x509cert.cpp:433
Botan::X509_Certificate::not_after
const X509_Time & not_after() const
Definition: x509cert.cpp:369
Botan::AlgorithmIdentifier::get_oid
const OID & get_oid() const
Definition: alg_id.h:37
Botan::X509_Certificate::x509_version
uint32_t x509_version() const
Definition: x509cert.cpp:354
Botan::X509_Certificate::policies
std::vector< std::string > policies() const
Definition: x509cert.cpp:719
Botan::X509_Certificate::name_constraints
const NameConstraints & name_constraints() const
Definition: x509cert.cpp:484
Botan::DECIPHER_ONLY
Definition: key_constraint.h:31
Botan::X509_Certificate::ex_constraints
std::vector< std::string > ex_constraints() const
Definition: x509cert.cpp:711
Botan::X509_Time::readable_string
std::string readable_string() const
Returns a human friendly string replesentation of no particular formatting.
Definition: asn1_time.cpp:93
Botan::X509_Certificate::subject_dn
const X509_DN & subject_dn() const
Definition: x509cert.cpp:438
Botan::Key_Constraints
Key_Constraints
Definition: key_constraint.h:21
Botan::KEY_CERT_SIGN
Definition: key_constraint.h:28

const std::vector< uint8_t > & Botan::X509_Certificate::v2_issuer_key_id | ( |  | ) | const

Return the v2 issuer key ID. v2 key IDs are almost never used, instead see v3_subject_key_id.

Definition at line 379 of file x509cert.cpp.

Referenced by issuer_info().

380 {
381 return data().m_v2_issuer_key_id;
382 }

const std::vector< uint8_t > & Botan::X509_Certificate::v2_subject_key_id | ( |  | ) | const

Return the v2 subject key ID. v2 key IDs are almost never used, instead see v3_subject_key_id.

Definition at line 384 of file x509cert.cpp.

Referenced by subject_info().

385 {
386 return data().m_v2_subject_key_id;
387 }

const Extensions & Botan::X509_Certificate::v3_extensions | ( |  | ) | const

Get all extensions of this certificate.

Returns
  certificate extensions

Definition at line 489 of file x509cert.cpp.

Referenced by is_critical().

490 {
491 return data().m_v3_extensions;
492 }

Certificate_Status_Code Botan::X509_Object::verify_signature | ( | const Public_Key & | key | ) | const
| inherited

Check the signature on this data

Parameters

  key | the public key purportedly used to sign this data

Returns
  status of the signature - OK if verified or otherwise an indicator of the problem preventing verification.

Definition at line 184 of file x509_obj.cpp.

References Botan::Public_Key::algo_name(), Botan::Public_Key::default_x509_signature_format(), Botan::AlgorithmIdentifier::get_oid(), hash_algo, Botan::X509_Object::signature(), Botan::SIGNATURE_ALGO_BAD_PARAMS, Botan::SIGNATURE_ALGO_UNKNOWN, Botan::X509_Object::signature_algorithm(), Botan::SIGNATURE_ERROR, Botan::split_on(), Botan::X509_Object::tbs_data(), Botan::OID::to_formatted_string(), Botan::ASN1::to_string(), Botan::UNTRUSTED_HASH, Botan::VERIFIED, and Botan::PK_Verifier::verify_message().

Referenced by Botan::X509_Object::check_signature().

185 {
186 const std::vector<std::string> sig_info =
187 split_on(m_sig_algo.get_oid().to_formatted_string(), '/');
188
189 if(sig_info.size() < 1 || sig_info.size() > 2 || sig_info[0] != pub_key.algo_name())
190 return Certificate_Status_Code::SIGNATURE_ALGO_BAD_PARAMS;
191
192 std::string padding;
193 if(sig_info.size() == 2)
194 padding = sig_info[1];
195 else if(sig_info[0] == "Ed25519" || sig_info[0] == "XMSS")
196 padding = "Pure";
197 else
198 return Certificate_Status_Code::SIGNATURE_ALGO_BAD_PARAMS;
199
200 const Signature_Format format = pub_key.default_x509_signature_format();
201
202 if(padding == "EMSA4")
203 {
204 // "MUST contain RSASSA-PSS-params"
205 if(signature_algorithm().get_parameters().empty())
206 {
207 return Certificate_Status_Code::SIGNATURE_ALGO_BAD_PARAMS;
208 }
209
210 Pss_params pss_parameter = decode_pss_params(signature_algorithm().get_parameters());
211
212 // hash_algo must be SHA1, SHA2-224, SHA2-256, SHA2-384 or SHA2-512
213 const std::string hash_algo = pss_parameter.hash_algo.get_oid().to_formatted_string();
214 if(hash_algo != "SHA-160" &&
215 hash_algo != "SHA-224" &&
216 hash_algo != "SHA-256" &&
217 hash_algo != "SHA-384" &&
218 hash_algo != "SHA-512")
219 {
220 return Certificate_Status_Code::UNTRUSTED_HASH;
221 }
222
223 const std::string mgf_algo = pss_parameter.mask_gen_algo.get_oid().to_formatted_string();
224 if(mgf_algo != "MGF1")
225 {
226 return Certificate_Status_Code::SIGNATURE_ALGO_BAD_PARAMS;
227 }
228
229 // For MGF1, it is strongly RECOMMENDED that the underlying hash function be the same as the one identified by hashAlgorithm
230 // Must be SHA1, SHA2-224, SHA2-256, SHA2-384 or SHA2-512
231 if(pss_parameter.mask_gen_hash.get_oid() != pss_parameter.hash_algo.get_oid())
232 {
233 return Certificate_Status_Code::SIGNATURE_ALGO_BAD_PARAMS;
234 }
235
236 if(pss_parameter.trailer_field != 1)
237 {
238 return Certificate_Status_Code::SIGNATURE_ALGO_BAD_PARAMS;
239 }
240
241 padding += "(" + hash_algo + "," + mgf_algo + "," + std::to_string(pss_parameter.salt_len) + ")";
242 }
243
244 try
245 {
246 PK_Verifier verifier(pub_key, padding, format);
247 const bool valid = verifier.verify_message(tbs_data(), signature());
248
249 if(valid)
250 return Certificate_Status_Code::VERIFIED;
251 else
252 return Certificate_Status_Code::SIGNATURE_ERROR;
253 }
254 catch(Algorithm_Not_Found&)
255 {
256 return Certificate_Status_Code::SIGNATURE_ALGO_UNKNOWN;
257 }
258 catch(...)
259 {
260 // This shouldn't happen, fallback to generic signature error
261 return Certificate_Status_Code::SIGNATURE_ERROR;
262 }
263 }
Botan::split_on
std::vector< std::string > split_on(const std::string &str, char delim)
Definition: parsing.cpp:148
Botan::Signature_Format
Signature_Format
Definition: pk_keys.h:24
Botan::ASN1::to_string
std::string to_string(const BER_Object &obj)
Definition: asn1_obj.cpp:213
Botan::OID::to_formatted_string
std::string to_formatted_string() const
Definition: asn1_oid.cpp:110
Botan::X509_Object::signature_algorithm
const AlgorithmIdentifier & signature_algorithm() const
Definition: x509_obj.h:48
Botan::Certificate_Status_Code::SIGNATURE_ERROR
Botan::X509_Object::signature
const std::vector< uint8_t > & signature() const
Definition: x509_obj.h:38
Botan::Certificate_Status_Code::UNTRUSTED_HASH
Botan::AlgorithmIdentifier::get_oid
const OID & get_oid() const
Definition: alg_id.h:37
hash_algo
AlgorithmIdentifier hash_algo
Definition: x509_obj.cpp:22
Botan::Certificate_Status_Code::SIGNATURE_ALGO_BAD_PARAMS
Botan::X509_Object::tbs_data
std::vector< uint8_t > tbs_data() const
Definition: x509_obj.cpp:130
Botan::Certificate_Status_Code::SIGNATURE_ALGO_UNKNOWN
Botan::Certificate_Status_Code::VERIFIED

uint32_t Botan::X509_Certificate::x509_version | ( |  | ) | const

Get the X509 version of this certificate object.

Returns
  X509 version

Definition at line 354 of file x509cert.cpp.

Referenced by subject_info(), and to_string().

355 {
356 return static_cast<uint32_t>(data().m_version);
357 }

The documentation for this class was generated from the following files:

- src/lib/x509/x509cert.h
- src/lib/x509/x509cert.cpp