Botan 3.6.1
Crypto and TLS for C&
|
#include <x509_ca.h>
Public Member Functions | |
const AlgorithmIdentifier & | algorithm_identifier () const |
const X509_Certificate & | ca_certificate () const |
const std::string & | hash_function () const |
X509_CRL | new_crl (RandomNumberGenerator &rng, std::chrono::system_clock::time_point issue_time, std::chrono::seconds next_update) const |
X509_CRL | new_crl (RandomNumberGenerator &rng, uint32_t next_update=604800) const |
X509_CA & | operator= (const X509_CA &)=delete |
X509_CA & | operator= (X509_CA &&)=default |
X509_Certificate | sign_request (const PKCS10_Request &req, RandomNumberGenerator &rng, const BigInt &serial_number, const X509_Time ¬_before, const X509_Time ¬_after) const |
X509_Certificate | sign_request (const PKCS10_Request &req, RandomNumberGenerator &rng, const X509_Time ¬_before, const X509_Time ¬_after) const |
PK_Signer & | signature_op () |
X509_CRL | update_crl (const X509_CRL &last_crl, const std::vector< CRL_Entry > &new_entries, RandomNumberGenerator &rng, std::chrono::system_clock::time_point issue_time, std::chrono::seconds next_update) const |
X509_CRL | update_crl (const X509_CRL &last_crl, const std::vector< CRL_Entry > &new_entries, RandomNumberGenerator &rng, uint32_t next_update=604800) const |
X509_CA (const X509_CA &)=delete | |
X509_CA (const X509_Certificate &ca_certificate, const Private_Key &key, const std::map< std::string, std::string > &opts, std::string_view hash_fn, RandomNumberGenerator &rng) | |
X509_CA (const X509_Certificate &ca_certificate, const Private_Key &key, std::string_view hash_fn, RandomNumberGenerator &rng) | |
X509_CA (const X509_Certificate &ca_certificate, const Private_Key &key, std::string_view hash_fn, std::string_view padding_method, RandomNumberGenerator &rng) | |
X509_CA (X509_CA &&)=default | |
~X509_CA () | |
Static Public Member Functions | |
static Extensions | choose_extensions (const PKCS10_Request &req, const X509_Certificate &ca_certificate, std::string_view hash_fn) |
static X509_Certificate | make_cert (PK_Signer &signer, RandomNumberGenerator &rng, const AlgorithmIdentifier &sig_algo, const std::vector< uint8_t > &pub_key, const X509_Time ¬_before, const X509_Time ¬_after, const X509_DN &issuer_dn, const X509_DN &subject_dn, const Extensions &extensions) |
static X509_Certificate | make_cert (PK_Signer &signer, RandomNumberGenerator &rng, const BigInt &serial_number, const AlgorithmIdentifier &sig_algo, const std::vector< uint8_t > &pub_key, const X509_Time ¬_before, const X509_Time ¬_after, const X509_DN &issuer_dn, const X509_DN &subject_dn, const Extensions &extensions) |
Botan::X509_CA::X509_CA | ( | const X509_Certificate & | ca_certificate, |
const Private_Key & | key, | ||
std::string_view | hash_fn, | ||
std::string_view | padding_method, | ||
RandomNumberGenerator & | rng ) |
Create a new CA object with custom padding option
This is mostly useful for creating RSA-PSS certificates
ca_certificate | the certificate of the CA |
key | the private key of the CA |
hash_fn | name of a hash function to use for signing |
padding_method | name of the signature padding method to use |
rng | the random generator to use |
Definition at line 22 of file x509_ca.cpp.
References Botan::X509_Object::choose_sig_format(), and Botan::X509_Certificate::is_CA_cert().
|
inline |
Create a new CA object.
ca_certificate | the certificate of the CA |
key | the private key of the CA |
hash_fn | name of a hash function to use for signing |
rng | the random generator to use |
Definition at line 210 of file x509_ca.h.
|
inline |
|
delete |
|
default |
|
default |
|
inline |
Return the algorithm identifier used to identify signatures that this CA will create.
Definition at line 33 of file x509_ca.h.
Referenced by sign_request(), and sign_request().
|
inline |
Return the CA's certificate
Definition at line 38 of file x509_ca.h.
Referenced by sign_request(), and sign_request().
|
static |
Return the set of extensions that will be used for a certificate.
This is a helper method that is used internally. It is also exposed so you can call it directly and then modify the extensions before creating a certificate using X509_CA::make_cert.
Definition at line 39 of file x509_ca.cpp.
References Botan::Key_Constraints::ca_constraints(), Botan::PKCS10_Request::constraints(), Botan::PKCS10_Request::ex_constraints(), Botan::PKCS10_Request::extensions(), Botan::PKCS10_Request::is_CA(), Botan::PKCS10_Request::path_limit(), Botan::PKCS10_Request::raw_public_key(), Botan::Extensions::replace(), Botan::PKCS10_Request::subject_alt_name(), Botan::X509_Certificate::subject_key_id(), and Botan::PKCS10_Request::subject_public_key().
Referenced by sign_request(), and sign_request().
|
inline |
|
static |
Interface for creating new certificates
signer | a signing object |
rng | a random number generator |
sig_algo | the signature algorithm identifier |
pub_key | the serialized public key |
not_before | the start time of the certificate |
not_after | the end time of the certificate |
issuer_dn | the DN of the issuer |
subject_dn | the DN of the subject |
extensions | an optional list of certificate extensions |
Definition at line 106 of file x509_ca.cpp.
References make_cert().
Referenced by Botan::X509::create_self_signed_cert(), make_cert(), sign_request(), and sign_request().
|
static |
Interface for creating new certificates
signer | a signing object |
rng | a random number generator |
serial_number | the serial number the cert will be assigned |
sig_algo | the signature algorithm identifier |
pub_key | the serialized public key |
not_before | the start time of the certificate |
not_after | the end time of the certificate |
issuer_dn | the DN of the issuer |
subject_dn | the DN of the subject |
extensions | an optional list of certificate extensions |
Definition at line 125 of file x509_ca.cpp.
References Botan::X509_Object::make_signed().
X509_CRL Botan::X509_CA::new_crl | ( | RandomNumberGenerator & | rng, |
std::chrono::system_clock::time_point | issue_time, | ||
std::chrono::seconds | next_update ) const |
Create a new and empty CRL for this CA.
rng | the random number generator to use |
issue_time | the issue time (typically system_clock::now) |
next_update | the time interval after issue_data within which a new CRL will be produced. |
Definition at line 186 of file x509_ca.cpp.
Referenced by new_crl().
X509_CRL Botan::X509_CA::new_crl | ( | RandomNumberGenerator & | rng, |
uint32_t | next_update = 604800 ) const |
Create a new and empty CRL for this CA.
rng | the random number generator to use |
next_update | the time to set in next update in seconds as the offset from the current time |
Definition at line 172 of file x509_ca.cpp.
References new_crl().
X509_Certificate Botan::X509_CA::sign_request | ( | const PKCS10_Request & | req, |
RandomNumberGenerator & | rng, | ||
const BigInt & | serial_number, | ||
const X509_Time & | not_before, | ||
const X509_Time & | not_after ) const |
Sign a PKCS#10 Request.
req | the request to sign |
rng | the rng to use |
serial_number | the serial number the cert will be assigned. |
not_before | the starting time for the certificate |
not_after | the expiration time for the certificate |
Definition at line 67 of file x509_ca.cpp.
References algorithm_identifier(), ca_certificate(), choose_extensions(), make_cert(), Botan::PKCS10_Request::raw_public_key(), and Botan::PKCS10_Request::subject_dn().
X509_Certificate Botan::X509_CA::sign_request | ( | const PKCS10_Request & | req, |
RandomNumberGenerator & | rng, | ||
const X509_Time & | not_before, | ||
const X509_Time & | not_after ) const |
Sign a PKCS#10 Request.
req | the request to sign |
rng | the rng to use |
not_before | the starting time for the certificate |
not_after | the expiration time for the certificate |
Definition at line 89 of file x509_ca.cpp.
References algorithm_identifier(), ca_certificate(), choose_extensions(), make_cert(), Botan::PKCS10_Request::raw_public_key(), and Botan::PKCS10_Request::subject_dn().
|
inline |
X509_CRL Botan::X509_CA::update_crl | ( | const X509_CRL & | last_crl, |
const std::vector< CRL_Entry > & | new_entries, | ||
RandomNumberGenerator & | rng, | ||
std::chrono::system_clock::time_point | issue_time, | ||
std::chrono::seconds | next_update ) const |
Create a new CRL by with additional entries.
last_crl | the last CRL of this CA to add the new entries to |
new_entries | contains the new CRL entries to be added to the CRL |
rng | the random number generator to use |
issue_time | the issue time (typically system_clock::now) |
next_update | the time interval after issue_data within which a new CRL will be produced. |
Definition at line 193 of file x509_ca.cpp.
References Botan::X509_CRL::crl_number(), and Botan::X509_CRL::get_revoked().
Referenced by update_crl().
X509_CRL Botan::X509_CA::update_crl | ( | const X509_CRL & | last_crl, |
const std::vector< CRL_Entry > & | new_entries, | ||
RandomNumberGenerator & | rng, | ||
uint32_t | next_update = 604800 ) const |
Create a new CRL by with additional entries.
last_crl | the last CRL of this CA to add the new entries to |
new_entries | contains the new CRL entries to be added to the CRL |
rng | the random number generator to use |
next_update | the time to set in next update in seconds as the offset from the current time |
Definition at line 179 of file x509_ca.cpp.
References update_crl().