Botan::Cert_Extension::NoRevocationAvailable Class Reference

#include <x509_ext.h>

Inheritance diagram for Botan::Cert_Extension::NoRevocationAvailable:

Public Member Functions
std::unique_ptr< Certificate_Extension >	copy () const override
	NoRevocationAvailable ()=default
OID	oid_of () const override
void	validate (const X509_Certificate &subject, const std::optional< X509_Certificate > &issuer, const std::vector< X509_Certificate > &cert_path, std::vector< std::set< Certificate_Status_Code > > &cert_status, size_t pos) const override

Static Public Member Functions
static OID	static_oid ()

Detailed Description

No Revocation Available Extension

RFC 9608 Section 2

The noRevAvail extension, defined in [X.509-2019-TC2], allows a CA to indicate that no revocation information will be made available for this certificate.

This extension MUST NOT be present in CA public key certificates.

Conforming CAs MUST include this extension in certificates for which no revocation information will be published. When present, conforming CAs MUST mark this extension as non-critical.

Definition at line 828 of file x509_ext.h.

Constructor & Destructor Documentation

NoRevocationAvailable()

Botan::Cert_Extension::NoRevocationAvailable::NoRevocationAvailable ( )

default

Member Function Documentation

copy()

std::unique_ptr< Certificate_Extension > Botan::Cert_Extension::NoRevocationAvailable::copy ( ) const

inlineoverridevirtual

Make a copy of this extension

Returns

copy of this

Implements Botan::Certificate_Extension.

Definition at line 832 of file x509_ext.h.

{ return std::make_unique<NoRevocationAvailable>(); }

oid_of()

OID Botan::Cert_Extension::NoRevocationAvailable::oid_of ( ) const

inlineoverridevirtual

Return object identifier for this extension

Returns

OID representing this extension

Implements Botan::Certificate_Extension.

Definition at line 836 of file x509_ext.h.

{ return static_oid(); }

References static_oid().

static_oid()

OID Botan::Cert_Extension::NoRevocationAvailable::static_oid ( )

inlinestatic

Definition at line 834 of file x509_ext.h.

{ return OID({2, 5, 29, 56}); }

Referenced by oid_of().

validate()

void Botan::Cert_Extension::NoRevocationAvailable::validate ( const X509_Certificate & subject, const std::optional< X509_Certificate > & issuer, const std::vector< X509_Certificate > & cert_path, std::vector< std::set< Certificate_Status_Code > > & cert_status, size_t pos ) const

overridevirtual

Callback visited during path validation.

An extension can implement this callback to inspect the path during path validation.

If an error occurs during validation of this extension, an appropriate status code shall be added to cert_status.

Parameters

subject	Subject certificate that contains this extension
issuer	Issuer certificate. nullopt for certificates with no available issuer (e.g. non self-signed trust anchors).
cert_path	Certificate path which is currently validated
cert_status	Certificate validation status codes for subject certificate
pos	Position of subject certificate in cert_path

Reimplemented from Botan::Certificate_Extension.

Definition at line 2549 of file x509_ext.cpp.

                                                       {
   // RFC 9608 Section 2:
   //    This extension MUST NOT be present in CA public key certificates.
   //
   // RFC 9608 Section 3:
   //    Certificates that include the noRevAvail extension MUST NOT include
   //    certificate extensions that point to CRL repositories or provide
   //    locations of OCSP responders.
   //
   // Additionally (and unusually) the requirements of RFC 9608 Section 3
   // are not just on issuing parties but also on verifiers:
   //
   //   If any of the above are violated in a certificate, then the relying
   //   party MUST consider the certificate invalid.
 
   const Extensions& exts = subject.v3_extensions();
 
   if(const auto* bc = exts.get_extension_object_as<Basic_Constraints>(); bc != nullptr && bc->is_ca()) {
      // RFC 9608 Section 3:
      //    The certificate MUST NOT also include the basic constraints
      //    certificate extension with the cA BOOLEAN set to TRUE
      cert_status.at(pos).insert(Certificate_Status_Code::NO_REV_AVAIL_INVALID_USE);
   }
 
   // RFC 9608 Section 3:
   //    The certificate MUST NOT also include the CRL Distribution Points
   //    certificate extension
   if(exts.extension_set(CRL_Distribution_Points::static_oid())) {
      cert_status.at(pos).insert(Certificate_Status_Code::NO_REV_AVAIL_INVALID_USE);
   }
 
   // RFC 9608 Section 3:
   //    The certificate MUST NOT also include the Freshest CRL certificate
   //    extension
   if(exts.extension_set(OID({2, 5, 29, 46}))) {
      cert_status.at(pos).insert(Certificate_Status_Code::NO_REV_AVAIL_INVALID_USE);
   }
 
   // RFC 9608 Section 3:
   //    The Authority Information Access certificate extension, if
   //    present, MUST NOT include an id-ad-ocsp accessMethod
   //
   // Walk the raw AccessDescription list rather than the URI-only typed
   // accessor so a non-URI OCSP accessLocation also triggers the rejection.
   if(const auto* aia = exts.get_extension_object_as<Authority_Information_Access>(); aia != nullptr) {
      const OID id_ad_ocsp = OID::from_string("PKIX.OCSP");
      const bool has_ocsp = !aia->ocsp_responder_uris().empty() ||
                            std::ranges::any_of(aia->access_descriptions(),
                                                [&](const auto& ad) { return ad.access_method() == id_ad_ocsp; });
      if(has_ocsp) {
         cert_status.at(pos).insert(Certificate_Status_Code::NO_REV_AVAIL_INVALID_USE);
      }
   }
}

References Botan::Extensions::extension_set(), Botan::Certificate_Extension::Extensions, Botan::OID::from_string(), Botan::Extensions::get_extension_object_as(), Botan::Cert_Extension::Basic_Constraints::is_ca(), Botan::NO_REV_AVAIL_INVALID_USE, Botan::Cert_Extension::CRL_Distribution_Points::static_oid(), and Botan::X509_Certificate::v3_extensions().

---

The documentation for this class was generated from the following files:

• src/lib/x509/x509_ext.h
• src/lib/x509/x509_ext.cpp