Botan::PKCS12 Class Reference

#include <pkcs12.h>

Public Member Functions
void	add_certificate (X509_Certificate cert)
void	add_key (std::shared_ptr< Private_Key > key)
	Add a private key. PKCS#12 supports multiple keys per file.
std::vector< X509_Certificate >	ca_certificates () const
const std::vector< X509_Certificate > &	certificates () const
void	clear_friendly_name ()
	Clear the friendly-name attribute.
void	clear_local_key_id ()
	Clear the localKeyId attribute.
std::optional< X509_Certificate >	end_entity_certificate () const
std::vector< uint8_t >	export_to (const PKCS12_Export_Options &options, RandomNumberGenerator &rng) const
const std::optional< std::string > &	friendly_name () const
const std::optional< std::vector< uint8_t > > &	local_key_id () const
	PKCS12 ()=default
	Construct an empty bundle.
	PKCS12 (std::span< const uint8_t > data, std::string_view password)
const std::vector< std::shared_ptr< Private_Key > > &	private_keys () const
void	set_friendly_name (std::string name)
	Set (or replace) the friendly-name attribute.
void	set_local_key_id (std::vector< uint8_t > id)
	Set (or replace) the localKeyId attribute.
const std::vector< OID > &	unknown_bag_types () const

Detailed Description

PKCS#12/PFX bundle: parsed contents, mutable container, and exporter.

PKCS#12 is a file format for storing cryptographic objects (private keys and X.509 certificates) together, typically protected by a password.

The class can be used both to inspect an existing PFX and to build a new one. Construction from bytes parses an existing file; the default constructor produces an empty bundle that the caller populates with mutators (add_key, add_certificate, ...) before calling export_to to serialize.

// Parse
Botan::PKCS12 p12(pfx_bytes, "password");
if(!p12.private_keys().empty()) {
   const auto& key = p12.private_keys().front();
   // ...
}
if(auto ee = p12.end_entity_certificate()) {
   // ...
}
 
// Build
Botan::PKCS12 out;
out.set_friendly_name("My Bundle");
out.add_key(my_key);
out.add_certificate(my_cert);
for(const auto& ca : ca_chain) {
   out.add_certificate(ca);
}
const auto blob = out.export_to(
   Botan::PKCS12_Export_Options::modern("password"), rng);

Definition at line 146 of file pkcs12.h.

Constructor & Destructor Documentation

PKCS12() [1/2]

Botan::PKCS12::PKCS12 ( )

default

Construct an empty bundle.

References PKCS12().

Referenced by PKCS12().

PKCS12() [2/2]

Botan::PKCS12::PKCS12	(	std::span< const uint8_t >	data,
		std::string_view	password )

Parse a PKCS#12/PFX file.

Parameters

data	the PFX file contents
password	the password to decrypt the file

Exceptions

Decoding_Error	if parsing fails
Invalid_Authentication_Tag	if MAC verification fails

Definition at line 449 of file pkcs12.cpp.

                                                                   {
   std::vector<ParsedCert> cert_entries;
   std::vector<ParsedKey> key_entries;
 
   BER_Decoder pfx(data);
   BER_Decoder pfx_seq = pfx.start_sequence();
 
   size_t version = 0;
   pfx_seq.decode(version);
   if(version != 3) {
      throw Decoding_Error(fmt("Unsupported PKCS#12 version: {}", version));
   }
 
   OID auth_safe_type;
   std::vector<uint8_t> auth_safe_content;
 
   BER_Decoder auth_safe_info = pfx_seq.start_sequence();
   auth_safe_info.decode(auth_safe_type);
 
   const OID pkcs7_data_oid = OID::from_string("PKCS7.Data");
   if(auth_safe_type != pkcs7_data_oid) {
      throw Decoding_Error("PKCS#12 authSafe must be of type Data");
   }
 
   BER_Decoder auth_safe_content_wrapper = auth_safe_info.start_context_specific(0);
   auth_safe_content_wrapper.decode(auth_safe_content, ASN1_Type::OctetString);
   auth_safe_content_wrapper.verify_end();
   auth_safe_info.verify_end();
 
   // Tracks whether MAC verification succeeded with OpenSSL's non-conforming
   // empty-password encoding; if so, the same convention is used for any
   // subsequent EncryptedData / PKCS8ShroudedKeyBag decryption.
   bool openssl_empty_pwd_compat = false;
 
   if(pfx_seq.more_items()) {
      BER_Decoder mac_data = pfx_seq.start_sequence();
 
      BER_Decoder digest_info = mac_data.start_sequence();
      AlgorithmIdentifier digest_algo;
      std::vector<uint8_t> mac_value;
      digest_info.decode(digest_algo);
      digest_info.decode(mac_value, ASN1_Type::OctetString);
      digest_info.verify_end();
 
      std::vector<uint8_t> mac_salt;
      size_t iterations = 1;
      mac_data.decode(mac_salt, ASN1_Type::OctetString);
      if(mac_data.more_items()) {
         mac_data.decode(iterations);
      }
      mac_data.verify_end();
      if(iterations == 0 || iterations > PKCS12_MAX_ITERATIONS) {
         throw Decoding_Error(fmt("PKCS#12 MAC has invalid iteration count: {}", iterations));
      }
 
      const std::string hash_name = resolve_mac_hash(digest_algo.oid());
      // Try RFC 7292 password encoding first. If MAC verification fails and
      // the password is empty, retry with OpenSSL's non-conforming empty
      // encoding (some OpenSSL releases pass an empty byte string to the KDF
      // instead of the RFC {0x00,0x00} form when the password is empty).
      // Propagate the chosen convention to any subsequent PBE decryption.
      try {
         verify_mac(auth_safe_content, mac_value, mac_salt, iterations, hash_name, password, false);
      } catch(const Invalid_Authentication_Tag&) {
         if(!password.empty()) {
            throw;
         }
         verify_mac(auth_safe_content, mac_value, mac_salt, iterations, hash_name, password, true);
         openssl_empty_pwd_compat = true;
      }
   }
 
   parse_authenticated_safe(
      auth_safe_content, password, cert_entries, key_entries, m_unknown_bag_types, openssl_empty_pwd_compat);
 
   // Move all parsed keys into storage.
   m_private_keys.reserve(key_entries.size());
   for(auto& ke : key_entries) {
      m_private_keys.push_back(std::move(ke.key));
   }
 
   // Capture bundle-level attributes from the first key (if any), or from
   // the end-entity certificate (if found below).
   if(!key_entries.empty()) {
      if(!key_entries.front().friendly_name.empty()) {
         m_friendly_name = key_entries.front().friendly_name;
      }
      if(!key_entries.front().local_key_id.empty()) {
         m_local_key_id = key_entries.front().local_key_id;
      }
   }
 
   // Reorder certificates so the end-entity (cert matching the first key)
   // comes first; rest follow in original order. Match prefers localKeyId,
   // falls back to subjectPublicKeyInfo comparison.
   std::optional<size_t> end_entity_idx;
   if(!cert_entries.empty() && !m_private_keys.empty()) {
      const auto& first_key = m_private_keys.front();
      const auto& first_key_id = key_entries.empty() ? std::vector<uint8_t>{} : key_entries.front().local_key_id;
 
      if(!first_key_id.empty()) {
         for(size_t i = 0; i < cert_entries.size(); ++i) {
            if(cert_entries[i].local_key_id == first_key_id) {
               end_entity_idx = i;
               break;
            }
         }
      }
      if(!end_entity_idx) {
         const auto key_spki = first_key->subject_public_key();
         for(size_t i = 0; i < cert_entries.size(); ++i) {
            try {
               if(cert_entries[i].cert.subject_public_key_info() == key_spki) {
                  end_entity_idx = i;
                  break;
               }
            } catch(const Decoding_Error&) {
               // Certificate with unsupported key algorithm - skip
            }
         }
      }
   }
 
   m_certificates.reserve(cert_entries.size());
   if(end_entity_idx) {
      m_certificates.push_back(std::move(cert_entries[*end_entity_idx].cert));
      if(!m_friendly_name && !cert_entries[*end_entity_idx].friendly_name.empty()) {
         m_friendly_name = cert_entries[*end_entity_idx].friendly_name;
      }
      if(!m_local_key_id && !cert_entries[*end_entity_idx].local_key_id.empty()) {
         m_local_key_id = cert_entries[*end_entity_idx].local_key_id;
      }
      for(size_t i = 0; i < cert_entries.size(); ++i) {
         if(i != *end_entity_idx) {
            // Still surface any friendly name found on non-end-entity certs
            // when the bundle doesn't have one yet (some producers attach the
            // attribute to the CA bag instead of the end-entity bag).
            if(!m_friendly_name && !cert_entries[i].friendly_name.empty()) {
               m_friendly_name = cert_entries[i].friendly_name;
            }
            m_certificates.push_back(std::move(cert_entries[i].cert));
         }
      }
   } else {
      for(auto& ce : cert_entries) {
         if(!m_friendly_name && !ce.friendly_name.empty()) {
            m_friendly_name = ce.friendly_name;
         }
         m_certificates.push_back(std::move(ce.cert));
      }
   }
 
   pfx_seq.verify_end();
   pfx_seq.end_cons();
   pfx.verify_end("PKCS#12: trailing data after PFX");
}

References Botan::BER_Decoder::decode(), Botan::BER_Decoder::end_cons(), Botan::fmt(), friendly_name(), Botan::OID::from_string(), local_key_id(), Botan::BER_Decoder::more_items(), Botan::OctetString, Botan::AlgorithmIdentifier::oid(), Botan::PKCS12_MAX_ITERATIONS, Botan::BER_Decoder::start_context_specific(), Botan::BER_Decoder::start_sequence(), and Botan::BER_Decoder::verify_end().

Member Function Documentation

add_certificate()

void Botan::PKCS12::add_certificate

(

X509_Certificate

cert

)

Add a certificate. End-entity vs CA is determined at export time by matching against stored keys.

Definition at line 662 of file pkcs12.cpp.

                                                  {
   m_certificates.push_back(std::move(cert));
}

add_key()

void Botan::PKCS12::add_key

(

std::shared_ptr< Private_Key >

key

)

Add a private key. PKCS#12 supports multiple keys per file.

Definition at line 655 of file pkcs12.cpp.

                                                   {
   if(!key) {
      throw Invalid_Argument("PKCS12::add_key: key must not be null");
   }
   m_private_keys.push_back(std::move(key));
}

ca_certificates()

std::vector< X509_Certificate > Botan::PKCS12::ca_certificates

(

)

const

Convenience helper: every certificate except the one returned by end_entity_certificate. Returned in storage order.

Definition at line 606 of file pkcs12.cpp.

                                                          {
   if(m_certificates.size() < 2) {
      return {};
   }
   const auto ee = end_entity_certificate();
   std::vector<X509_Certificate> result;
   result.reserve(m_certificates.size() - 1);
   if(ee) {
      // Skip the first certificate matching the end-entity (only one, in case
      // the bundle contains multiple certs signed for the same key, e.g. an
      // old leaf still kept alongside a renewed one).
      const auto ee_spki = ee->subject_public_key_info();
      bool skipped = false;
      for(const auto& c : m_certificates) {
         if(!skipped && c.subject_public_key_info() == ee_spki) {
            skipped = true;
            continue;
         }
         result.push_back(c);
      }
   } else {
      // No end-entity (e.g. key-less bundle): treat the first stored cert as
      // the "primary" and surface the rest as CA / chain certs. This matches
      // the storage order used by parsing.
      for(size_t i = 1; i < m_certificates.size(); ++i) {
         result.push_back(m_certificates[i]);
      }
   }
   return result;
}

References end_entity_certificate().

certificates()

const std::vector< X509_Certificate > & Botan::PKCS12::certificates ( ) const

inline

Certificates stored in the bundle, in the order they appear in the PFX or in insertion order. The end-entity certificate (if any) is not separated from CA/intermediate certificates at storage level; use end_entity_certificate to obtain it.

Definition at line 175 of file pkcs12.h.

{ return m_certificates; }

clear_friendly_name()

void Botan::PKCS12::clear_friendly_name

(

)

Clear the friendly-name attribute.

Definition at line 670 of file pkcs12.cpp.

                                 {
   m_friendly_name.reset();
}

clear_local_key_id()

void Botan::PKCS12::clear_local_key_id

(

)

Clear the localKeyId attribute.

Definition at line 678 of file pkcs12.cpp.

                                {
   m_local_key_id.reset();
}

end_entity_certificate()

std::optional< X509_Certificate > Botan::PKCS12::end_entity_certificate

(

)

const

Returns

the first certificate whose subjectPublicKeyInfo matches one of the stored private keys, or nullopt if none match (e.g. a certificate-only or key-only bundle).

Definition at line 637 of file pkcs12.cpp.

                                                                   {
   if(m_certificates.empty() || m_private_keys.empty()) {
      return std::nullopt;
   }
   const auto& first_key = m_private_keys.front();
   const auto key_spki = first_key->subject_public_key();
   for(const auto& c : m_certificates) {
      try {
         if(c.subject_public_key_info() == key_spki) {
            return c;
         }
      } catch(const Decoding_Error&) {
         // Skip certificates with unsupported algorithms
      }
   }
   return std::nullopt;
}

Referenced by ca_certificates().

export_to()

std::vector< uint8_t > Botan::PKCS12::export_to	(	const PKCS12_Export_Options &	options,
		RandomNumberGenerator &	rng ) const

Serialize the bundle as a PKCS#12/PFX file.

Parameters

options	export options (password, algorithms, ...).
Random Number Generators	RNG used to generate salts, IVs and (if requested) the localKeyId when none is set explicitly.

Exceptions

Invalid_Argument	if options is internally inconsistent (e.g. an unsupported algorithm is requested).
Invalid_Argument	if a stored private key does not match any stored certificate (this implementation requires the end-entity cert to be present when a key is exported).

Definition at line 682 of file pkcs12.cpp.

                                                                                                           {
   if(m_private_keys.empty() && m_certificates.empty()) {
      throw Invalid_Argument("PKCS#12::export_to requires at least a key or certificate");
   }
 
   validate_options(options);
 
   // Determine end-entity certificate(s). With a single key we pair it
   // against a cert matching its SPKI; that pair gets the
   // friendly_name/localKeyId from options or the bundle.
   std::optional<size_t> end_entity_idx;
   if(!m_private_keys.empty() && !m_certificates.empty()) {
      const auto& first_key = m_private_keys.front();
      const auto key_spki = first_key->subject_public_key();
      for(size_t i = 0; i < m_certificates.size(); ++i) {
         try {
            if(m_certificates[i].subject_public_key_info() == key_spki) {
               end_entity_idx = i;
               break;
            }
         } catch(const Decoding_Error&) {
            // skip
         }
      }
      if(!end_entity_idx) {
         throw Invalid_Argument("PKCS#12::export_to: private key does not match any certificate");
      }
   }
 
   const OID cert_bag_oid = OID::from_string("PKCS12.CertBag");
   const OID shrouded_key_oid = OID::from_string("PKCS12.PKCS8ShroudedKeyBag");
   const OID x509_cert_oid = OID::from_string("PKCS9.X509Certificate");
   const OID friendly_name_oid = OID::from_string("PKCS9.FriendlyName");
   const OID local_key_id_oid = OID::from_string("PKCS9.LocalKeyId");
   const OID pkcs7_data_oid = OID::from_string("PKCS7.Data");
   const OID pkcs7_enc_data_oid = OID::from_string("PKCS7.EncryptedData");
 
   // Pick the friendly-name and local-key-id used by attribute encoding.
   // Options take precedence over the bundle-level fields.
   const std::optional<std::string>& friendly_name =
      options.friendly_name().has_value() ? options.friendly_name() : m_friendly_name;
 
   std::vector<uint8_t> local_key_id;
   if(m_local_key_id) {
      local_key_id = *m_local_key_id;
   } else if(end_entity_idx) {
      local_key_id = m_certificates[*end_entity_idx].subject_public_key_bitstring_sha1();
   } else if(!m_private_keys.empty()) {
      // Key-only bundle: derive from SHA-1 of the public key bits (matching the
      // convention used by X509_Certificate::subject_public_key_bitstring_sha1).
      auto sha1 = HashFunction::create_or_throw("SHA-1");
      const auto pub_bits = m_private_keys.front()->public_key_bits();
      sha1->update(pub_bits);
      local_key_id = unlock(sha1->final());
   }
 
   auto write_attributes = [&](DER_Encoder& enc) {
      const bool has_fn = friendly_name.has_value() && !friendly_name->empty();
      const bool has_id = !local_key_id.empty();
      if(!has_fn && !has_id) {
         return;
      }
      enc.start_set();
      if(has_fn) {
         enc.start_sequence();
         enc.encode(friendly_name_oid);
         enc.start_set();
         encode_bmpstring(enc, *friendly_name);
         enc.end_cons();
         enc.end_cons();
      }
      if(has_id) {
         enc.start_sequence();
         enc.encode(local_key_id_oid);
         enc.start_set();
         enc.encode(local_key_id, ASN1_Type::OctetString);
         enc.end_cons();
         enc.end_cons();
      }
      enc.end_cons();
   };
 
   // CertBags
   std::vector<uint8_t> cert_safe_contents;
   if(!m_certificates.empty()) {
      DER_Encoder cert_bags(cert_safe_contents);
      cert_bags.start_sequence();
 
      auto add_cert_bag = [&](const X509_Certificate& c, bool add_attrs) {
         cert_bags.start_sequence();
         cert_bags.encode(cert_bag_oid);
 
         cert_bags.start_context_specific(0);
         cert_bags.start_sequence();
         cert_bags.encode(x509_cert_oid);
         cert_bags.start_context_specific(0);
         cert_bags.encode(c.BER_encode(), ASN1_Type::OctetString);
         cert_bags.end_cons();
         cert_bags.end_cons();
         cert_bags.end_cons();
 
         if(add_attrs) {
            write_attributes(cert_bags);
         }
 
         cert_bags.end_cons();
      };
 
      // End-entity first (so the file is read in the typical order), then
      // the rest in their stored order.
      if(end_entity_idx) {
         add_cert_bag(m_certificates[*end_entity_idx], true);
         for(size_t i = 0; i < m_certificates.size(); ++i) {
            if(i != *end_entity_idx) {
               add_cert_bag(m_certificates[i], false);
            }
         }
      } else {
         for(const auto& c : m_certificates) {
            add_cert_bag(c, false);
         }
      }
 
      cert_bags.end_cons();
   }
 
   // Key SafeBag(s)
   std::vector<uint8_t> key_safe_contents;
   if(!m_private_keys.empty()) {
      DER_Encoder key_bags(key_safe_contents);
      key_bags.start_sequence();
 
      for(size_t i = 0; i < m_private_keys.size(); ++i) {
         const Private_Key& key = *m_private_keys[i];
 
         key_bags.start_sequence();
         key_bags.encode(shrouded_key_oid);
 
         secure_vector<uint8_t> pkcs8_key = PKCS8::BER_encode(key);
         auto [enc_algo, enc_key] =
            pkcs12_pbe_encrypt(pkcs8_key, options.password(), options.key_encryption_algo(), options.iterations(), rng);
 
         key_bags.start_context_specific(0);
         key_bags.start_sequence();
         key_bags.encode(enc_algo);
         key_bags.encode(enc_key, ASN1_Type::OctetString);
         key_bags.end_cons();
         key_bags.end_cons();
 
         // Only the first key carries the bundle-level attributes (preserves
         // the historical single-key behavior).
         if(i == 0) {
            write_attributes(key_bags);
         }
 
         key_bags.end_cons();
      }
      key_bags.end_cons();
   }
 
   // AuthenticatedSafe
   std::vector<uint8_t> auth_safe_content;
   DER_Encoder auth_safe(auth_safe_content);
   auth_safe.start_sequence();
 
   if(!cert_safe_contents.empty()) {
      if(!options.cert_encryption_algo().empty()) {
         auto [enc_algo, enc_data] = pkcs12_pbe_encrypt(
            cert_safe_contents, options.password(), options.cert_encryption_algo(), options.iterations(), rng);
 
         auth_safe.start_sequence();
         auth_safe.encode(pkcs7_enc_data_oid);
         auth_safe.start_context_specific(0);
         auth_safe.start_sequence();
         auth_safe.encode(size_t(0));
         auth_safe.start_sequence();
         auth_safe.encode(pkcs7_data_oid);
         auth_safe.encode(enc_algo);
         auth_safe.add_object(ASN1_Type(0), ASN1_Class::ContextSpecific, enc_data);
         auth_safe.end_cons();
         auth_safe.end_cons();
         auth_safe.end_cons();
         auth_safe.end_cons();
      } else {
         auth_safe.start_sequence();
         auth_safe.encode(pkcs7_data_oid);
         auth_safe.start_context_specific(0);
         auth_safe.encode(cert_safe_contents, ASN1_Type::OctetString);
         auth_safe.end_cons();
         auth_safe.end_cons();
      }
   }
 
   if(!key_safe_contents.empty()) {
      auth_safe.start_sequence();
      auth_safe.encode(pkcs7_data_oid);
      auth_safe.start_context_specific(0);
      auth_safe.encode(key_safe_contents, ASN1_Type::OctetString);
      auth_safe.end_cons();
      auth_safe.end_cons();
   }
 
   auth_safe.end_cons();
 
   // PFX
   std::vector<uint8_t> pfx_data;
   DER_Encoder pfx(pfx_data);
   pfx.start_sequence();
   pfx.encode(size_t(3));
 
   pfx.start_sequence();
   pfx.encode(pkcs7_data_oid);
   pfx.start_context_specific(0);
   pfx.encode(auth_safe_content, ASN1_Type::OctetString);
   pfx.end_cons();
   pfx.end_cons();
 
   if(options.include_mac()) {
      const std::string& mac_hash = options.mac_digest();
 
      auto hmac = MessageAuthenticationCode::create_or_throw(fmt("HMAC({})", mac_hash));
 
      std::vector<uint8_t> mac_salt(hmac->output_length());
      rng.randomize(mac_salt.data(), mac_salt.size());
      const size_t mac_key_len = hmac->output_length();
      secure_vector<uint8_t> mac_key(mac_key_len);
      const PKCS12_KDF kdf(HashFunction::create_or_throw(mac_hash), 3, options.iterations());
      kdf.derive_key(mac_key.data(),
                     mac_key_len,
                     options.password().data(),
                     options.password().size(),
                     mac_salt.data(),
                     mac_salt.size());
 
      hmac->set_key(mac_key);
      hmac->update(auth_safe_content);
      const secure_vector<uint8_t> mac_value = hmac->final();
 
      pfx.start_sequence();
      pfx.start_sequence();
      const auto param_encoding =
         (mac_hash == "SHA-1") ? AlgorithmIdentifier::USE_NULL_PARAM : AlgorithmIdentifier::USE_EMPTY_PARAM;
      pfx.encode(AlgorithmIdentifier(OID::from_string(mac_hash), param_encoding));
      pfx.encode(mac_value, ASN1_Type::OctetString);
      pfx.end_cons();
      pfx.encode(mac_salt, ASN1_Type::OctetString);
      if(options.iterations() != 1) {
         pfx.encode(options.iterations());
      }
      pfx.end_cons();
   }
 
   pfx.end_cons();
 
   return pfx_data;
}

References Botan::DER_Encoder::add_object(), Botan::ASN1_Object::BER_encode(), Botan::PKCS8::BER_encode(), Botan::PKCS12_Export_Options::cert_encryption_algo(), Botan::ContextSpecific, Botan::HashFunction::create_or_throw(), Botan::MessageAuthenticationCode::create_or_throw(), Botan::PKCS12_KDF::derive_key(), Botan::DER_Encoder::encode(), Botan::DER_Encoder::end_cons(), Botan::fmt(), friendly_name(), Botan::PKCS12_Export_Options::friendly_name(), Botan::OID::from_string(), Botan::PKCS12_Export_Options::include_mac(), Botan::PKCS12_Export_Options::iterations(), Botan::PKCS12_Export_Options::key_encryption_algo(), local_key_id(), Botan::PKCS12_Export_Options::mac_digest(), Botan::OctetString, Botan::PKCS12_Export_Options::password(), Botan::pkcs12_pbe_encrypt(), Botan::RandomNumberGenerator::randomize(), Botan::DER_Encoder::start_context_specific(), Botan::DER_Encoder::start_sequence(), Botan::unlock(), Botan::AlgorithmIdentifier::USE_EMPTY_PARAM, and Botan::AlgorithmIdentifier::USE_NULL_PARAM.

friendly_name()

const std::optional< std::string > & Botan::PKCS12::friendly_name ( ) const

inline

Friendly-name attribute attached to the private key / end-entity certificate bag, if present.

Definition at line 194 of file pkcs12.h.

{ return m_friendly_name; }

Referenced by export_to(), and PKCS12().

local_key_id()

const std::optional< std::vector< uint8_t > > & Botan::PKCS12::local_key_id ( ) const

inline

localKeyId attribute attached to the private key / end-entity certificate bag, if present.

Definition at line 200 of file pkcs12.h.

{ return m_local_key_id; }

Referenced by export_to(), and PKCS12().

private_keys()

const std::vector< std::shared_ptr< Private_Key > > & Botan::PKCS12::private_keys ( ) const

inline

Private keys stored in the bundle, in the order they appear in the PFX (for a parsed file) or in insertion order (for a built one). PKCS#12 allows multiple keys per file; parsing currently surfaces all KeyBag / PKCS8ShroudedKeyBag entries.

Definition at line 167 of file pkcs12.h.

{ return m_private_keys; }

set_friendly_name()

void Botan::PKCS12::set_friendly_name

(

std::string

name

)

Set (or replace) the friendly-name attribute.

Definition at line 666 of file pkcs12.cpp.

                                             {
   m_friendly_name = std::move(name);
}

set_local_key_id()

void Botan::PKCS12::set_local_key_id

(

std::vector< uint8_t >

id

)

Set (or replace) the localKeyId attribute.

Definition at line 674 of file pkcs12.cpp.

                                                   {
   m_local_key_id = std::move(id);
}

unknown_bag_types()

const std::vector< OID > & Botan::PKCS12::unknown_bag_types ( ) const

inline

OIDs of bag types encountered during parsing but not handled by this implementation (e.g. SecretBag). Empty for normal files and for bundles constructed in-memory.

Definition at line 207 of file pkcs12.h.

{ return m_unknown_bag_types; }

---

The documentation for this class was generated from the following files:

• src/lib/pkcs12/pkcs12.h
• src/lib/pkcs12/pkcs12.cpp