#include <x509cert.h>

Inheritance diagram for Botan::X509_Certificate:

Public Member Functions
bool	allowed_extended_usage (const OID &usage) const

bool	allowed_extended_usage (std::string_view usage) const

bool	allowed_usage (Key_Constraints usage) const

bool	allowed_usage (Usage_Type usage) const

const std::vector< uint8_t > &	authority_key_id () const

std::vector< uint8_t >	BER_encode () const

std::vector< std::string >	ca_issuers () const

const std::vector< OID > &	certificate_policy_oids () const

bool	check_signature (const Public_Key &key) const

Key_Constraints	constraints () const

std::string	crl_distribution_point () const

std::vector< std::string >	crl_distribution_points () const

void	decode_from (BER_Decoder &from) override

void	encode_into (DER_Encoder &to) const override

const std::vector< OID > &	extended_key_usage () const

std::string	fingerprint (std::string_view hash_name="SHA-1") const

bool	has_constraints (Key_Constraints constraints) const

bool	has_ex_constraint (const OID &ex_constraint) const

bool	has_ex_constraint (std::string_view ex_constraint) const

bool	is_CA_cert () const

bool	is_critical (std::string_view ex_name) const

bool	is_self_signed () const

bool	is_serial_negative () const

const AlternativeName &	issuer_alt_name () const

const X509_DN &	issuer_dn () const

std::vector< std::string >	issuer_info (std::string_view name) const

std::unique_ptr< Public_Key >	load_subject_public_key () const

bool	matches_dns_name (std::string_view name) const

const NameConstraints &	name_constraints () const

const X509_Time &	not_after () const

const X509_Time &	not_before () const

std::string	ocsp_responder () const

bool	operator< (const X509_Certificate &other) const

X509_Certificate &	operator= (const X509_Certificate &other)=default

bool	operator== (const X509_Certificate &other) const

uint32_t	path_limit () const

std::string	PEM_encode () const

const std::vector< uint8_t > &	raw_issuer_dn () const

std::vector< uint8_t >	raw_issuer_dn_sha256 () const

const std::vector< uint8_t > &	raw_subject_dn () const

std::vector< uint8_t >	raw_subject_dn_sha256 () const

const std::vector< uint8_t > &	serial_number () const

const std::vector< uint8_t > &	signature () const

const AlgorithmIdentifier &	signature_algorithm () const

const std::vector< uint8_t > &	signed_body () const

const AlternativeName &	subject_alt_name () const

const X509_DN &	subject_dn () const

std::vector< std::string >	subject_info (std::string_view name) const

const std::vector< uint8_t > &	subject_key_id () const

std::unique_ptr< Public_Key >	subject_public_key () const

const AlgorithmIdentifier &	subject_public_key_algo () const

const std::vector< uint8_t > &	subject_public_key_bits () const

const std::vector< uint8_t > &	subject_public_key_bitstring () const

const std::vector< uint8_t > &	subject_public_key_bitstring_sha1 () const

const std::vector< uint8_t > &	subject_public_key_info () const

std::vector< uint8_t >	tbs_data () const

std::string	to_string () const

const std::vector< uint8_t > &	v2_issuer_key_id () const

const std::vector< uint8_t > &	v2_subject_key_id () const

const Extensions &	v3_extensions () const

std::pair< Certificate_Status_Code, std::string >	verify_signature (const Public_Key &key) const

	X509_Certificate ()=default

	X509_Certificate (const std::vector< uint8_t > &in)

	X509_Certificate (const uint8_t data[], size_t length)

	X509_Certificate (const X509_Certificate &other)=default

	X509_Certificate (DataSource &source)

uint32_t	x509_version () const

Static Public Member Functions
static std::unique_ptr< PK_Signer >	choose_sig_format (const Private_Key &key, RandomNumberGenerator &rng, std::string_view hash_fn, std::string_view padding_algo)

static std::vector< uint8_t >	make_signed (PK_Signer &signer, RandomNumberGenerator &rng, const AlgorithmIdentifier &alg_id, const secure_vector< uint8_t > &tbs)

Protected Member Functions
void	load_data (DataSource &src)

Detailed Description

This class represents an X.509 Certificate

Definition at line 36 of file x509cert.h.

Constructor & Destructor Documentation

◆ X509_Certificate() [1/5]

Botan::X509_Certificate::X509_Certificate ( DataSource & source )

explicit

Create a certificate from a data source providing the DER or PEM encoded certificate.

Parameters

source the data source

Definition at line 79 of file x509cert.cpp.

                                                  {
   load_data(src);
}

References Botan::X509_Object::load_data().

◆ X509_Certificate() [2/5]

Botan::X509_Certificate::X509_Certificate ( const std::vector< uint8_t > & in )

explicit

Create a certificate from a buffer

Parameters

in	the buffer containing the DER-encoded certificate

Definition at line 83 of file x509cert.cpp.

                                                                {
   DataSource_Memory src(vec.data(), vec.size());
   load_data(src);
}

References Botan::X509_Object::load_data().

◆ X509_Certificate() [3/5]

Botan::X509_Certificate::X509_Certificate	(	const uint8_t	data[],
		size_t	length )

Create a certificate from a buffer

Parameters

data	the buffer containing the DER-encoded certificate
length	length of data in bytes

Definition at line 88 of file x509cert.cpp.

                                                                   {
   DataSource_Memory src(data, len);
   load_data(src);
}

References Botan::X509_Object::load_data().

◆ X509_Certificate() [4/5]

Botan::X509_Certificate::X509_Certificate ( )

default

Create an uninitialized certificate object. Any attempts to access this object will throw an exception.

◆ X509_Certificate() [5/5]

Botan::X509_Certificate::X509_Certificate ( const X509_Certificate & other )

default

Member Function Documentation

◆ allowed_extended_usage() [1/2]

bool Botan::X509_Certificate::allowed_extended_usage ( const OID & usage ) const

Returns true if the specified usage is set in the extended key usage extension, or if no extended key usage constraints are set at all. To check if a certain extended key constraint is set in the certificate use

See also: X509_Certificate::has_ex_constraint.

Definition at line 459 of file x509cert.cpp.

                                                                    {
   const std::vector<OID>& ex = extended_key_usage();
   if(ex.empty()) {
      return true;
   }
 
   if(std::find(ex.begin(), ex.end(), usage) != ex.end()) {
      return true;
   }
 
   return false;
}

References extended_key_usage().

◆ allowed_extended_usage() [2/2]

bool Botan::X509_Certificate::allowed_extended_usage ( std::string_view usage ) const

Returns true if the specified

Parameters

usage is set in the extended key usage extension or if no extended key usage constraints are set at all. To check if a certain extended key constraint is set in the certificate use

See also: X509_Certificate::has_ex_constraint.

Definition at line 455 of file x509cert.cpp.

                                                                        {
   return allowed_extended_usage(OID::from_string(usage));
}

References allowed_extended_usage(), and Botan::OID::from_string().

Referenced by allowed_extended_usage(), and allowed_usage().

◆ allowed_usage() [1/2]

bool Botan::X509_Certificate::allowed_usage ( Key_Constraints usage ) const

Returns true if the specified

Parameters

usage is set in the key usage extension or if no key usage constraints are set at all. To check if a certain key constraint is set in the certificate use

See also: X509_Certificate::has_constraints.

Definition at line 448 of file x509cert.cpp.

                                                                {
   if(constraints().empty()) {
      return true;
   }
   return constraints().includes(usage);
}

References constraints(), and Botan::Key_Constraints::includes().

Referenced by allowed_usage(), and Botan::PKIX::check_crl().

◆ allowed_usage() [2/2]

bool Botan::X509_Certificate::allowed_usage ( Usage_Type usage ) const

Returns true if the required key and extended key constraints are set in the certificate for the specified

Parameters

usage or if no key constraints are set in both the key usage and extended key usage extension.

Definition at line 472 of file x509cert.cpp.

                                                           {
   // These follow suggestions in RFC 5280 4.2.1.12
 
   switch(usage) {
      case Usage_Type::UNSPECIFIED:
         return true;
 
      case Usage_Type::TLS_SERVER_AUTH:
         return (allowed_usage(Key_Constraints::KeyAgreement) || allowed_usage(Key_Constraints::KeyEncipherment) ||
                 allowed_usage(Key_Constraints::DigitalSignature)) &&
                allowed_extended_usage("PKIX.ServerAuth");
 
      case Usage_Type::TLS_CLIENT_AUTH:
         return (allowed_usage(Key_Constraints::DigitalSignature) || allowed_usage(Key_Constraints::KeyAgreement)) &&
                allowed_extended_usage("PKIX.ClientAuth");
 
      case Usage_Type::OCSP_RESPONDER:
         return (allowed_usage(Key_Constraints::DigitalSignature) || allowed_usage(Key_Constraints::NonRepudiation)) &&
                has_ex_constraint("PKIX.OCSPSigning");
 
      case Usage_Type::CERTIFICATE_AUTHORITY:
         return is_CA_cert();
 
      case Usage_Type::ENCRYPTION:
         return (allowed_usage(Key_Constraints::KeyEncipherment) || allowed_usage(Key_Constraints::DataEncipherment));
   }
 
   return false;
}

References allowed_extended_usage(), allowed_usage(), Botan::CERTIFICATE_AUTHORITY, Botan::Key_Constraints::DataEncipherment, Botan::Key_Constraints::DigitalSignature, Botan::ENCRYPTION, has_ex_constraint(), is_CA_cert(), Botan::Key_Constraints::KeyAgreement, Botan::Key_Constraints::KeyEncipherment, Botan::Key_Constraints::NonRepudiation, Botan::OCSP_RESPONDER, Botan::TLS_CLIENT_AUTH, Botan::TLS_SERVER_AUTH, and Botan::UNSPECIFIED.

◆ authority_key_id()

const std::vector< uint8_t > & Botan::X509_Certificate::authority_key_id ( ) const

Get the DER encoded AuthorityKeyIdentifier of this certificate.

Returns: DER encoded AuthorityKeyIdentifier

Definition at line 375 of file x509cert.cpp.

                                                                   {
   return data().m_authority_key_id;
}

Referenced by Botan::PKIX::build_certificate_path(), Botan::Certificate_Store_In_Memory::find_crl_for(), Botan::X509_CRL::is_revoked(), and to_string().

◆ BER_encode()

std::vector< uint8_t > Botan::ASN1_Object::BER_encode ( ) const

inherited

Return the encoding of this object. This is a convenience method when just one object needs to be serialized. Use DER_Encoder for complicated encodings.

Definition at line 19 of file asn1_obj.cpp.

                                                 {
   std::vector<uint8_t> output;
   DER_Encoder der(output);
   this->encode_into(der);
   return output;
}

References Botan::ASN1_Object::encode_into().

Referenced by Botan::PSS_Params::decode_from(), Botan::Certificate_Store_In_SQL::find_all_certs(), Botan::Certificate_Store_In_SQL::find_cert(), fingerprint(), Botan::Certificate_Store_In_SQL::insert_cert(), Botan::X509_Object::PEM_encode(), and Botan::Certificate_Store_In_SQL::revoke_cert().

◆ ca_issuers()

std::vector< std::string > Botan::X509_Certificate::ca_issuers ( ) const

Return the listed addresses of ca issuers, or empty if not set

Definition at line 522 of file x509cert.cpp.

                                                        {
   return data().m_ca_issuers;
}

Referenced by to_string().

◆ certificate_policy_oids()

const std::vector< OID > & Botan::X509_Certificate::certificate_policy_oids ( ) const

Get the policies as defined in the CertificatePolicies extension of this certificate.

Returns: certificate policies

Definition at line 431 of file x509cert.cpp.

                                                                      {
   return data().m_cert_policies;
}

Referenced by to_string().

◆ check_signature()

bool Botan::X509_Object::check_signature ( const Public_Key & key ) const

inherited

Check the signature on this data

Parameters

key	the public key purportedly used to sign this data

Returns: true if the signature is valid, otherwise false

Definition at line 97 of file x509_obj.cpp.

                                                                 {
   const auto result = this->verify_signature(pub_key);
   return (result.first == Certificate_Status_Code::VERIFIED);
}

References Botan::VERIFIED, and Botan::X509_Object::verify_signature().

◆ choose_sig_format()

std::unique_ptr< PK_Signer > Botan::X509_Object::choose_sig_format	(	const Private_Key &	key,
		RandomNumberGenerator &	rng,
		std::string_view	hash_fn,
		std::string_view	padding_algo )

staticinherited

Choose and return a signature scheme appropriate for X.509 signing using the provided parameters.

Parameters

key	will be the key to choose a padding scheme for
rng	the random generator to use
hash_fn	is the desired hash function
padding_algo	specifies the padding method

Returns: a PK_Signer object for generating signatures

Definition at line 209 of file x509_obj.cpp.

                                                                                                 {
   const Signature_Format format = key.default_x509_signature_format();
 
   if(!user_specified_padding.empty()) {
      try {
         auto pk_signer = std::make_unique<PK_Signer>(key, rng, user_specified_padding, format);
         if(!hash_fn.empty() && pk_signer->hash_function() != hash_fn) {
            throw Invalid_Argument(format_padding_error_message(
               key.algo_name(), pk_signer->hash_function(), hash_fn, "", user_specified_padding));
         }
         return pk_signer;
      } catch(Lookup_Error&) {}
   }
 
   const std::string padding = x509_signature_padding_for(key.algo_name(), hash_fn, user_specified_padding);
 
   try {
      auto pk_signer = std::make_unique<PK_Signer>(key, rng, padding, format);
      if(!hash_fn.empty() && pk_signer->hash_function() != hash_fn) {
         throw Invalid_Argument(format_padding_error_message(
            key.algo_name(), pk_signer->hash_function(), hash_fn, padding, user_specified_padding));
      }
      return pk_signer;
   } catch(Not_Implemented&) {
      throw Invalid_Argument("Signatures using " + key.algo_name() + "/" + padding + " are not supported");
   }
}

References Botan::Asymmetric_Key::algo_name(), and Botan::Public_Key::default_x509_signature_format().

Referenced by Botan::PKCS10_Request::create(), Botan::X509::create_self_signed_cert(), and Botan::X509_CA::X509_CA().

◆ constraints()

Key_Constraints Botan::X509_Certificate::constraints ( ) const

Get the key constraints as defined in the KeyUsage extension of this certificate.

Returns: key constraints

Definition at line 423 of file x509cert.cpp.

                                                    {
   return data().m_key_constraints;
}

Referenced by allowed_usage(), has_constraints(), and to_string().

◆ crl_distribution_point()

std::string Botan::X509_Certificate::crl_distribution_point ( ) const

Return the CRL distribution point, or empty if not set

Definition at line 530 of file x509cert.cpp.

                                                         {
   // just returns the first (arbitrarily)
   if(!data().m_crl_distribution_points.empty()) {
      return data().m_crl_distribution_points[0];
   }
   return "";
}

◆ crl_distribution_points()

std::vector< std::string > Botan::X509_Certificate::crl_distribution_points ( ) const

Return the CRL distribution points, or empty if not set

Definition at line 526 of file x509cert.cpp.

                                                                     {
   return data().m_crl_distribution_points;
}

Referenced by Botan::PKIX::check_crl(), and to_string().

◆ decode_from()

void Botan::X509_Object::decode_from ( BER_Decoder & from )

overridevirtualinherited

Decode a BER encoded X509_Object See ASN1_Object::decode_from()

Implements Botan::ASN1_Object.

Definition at line 68 of file x509_obj.cpp.

                                               {
   from.start_sequence()
      .start_sequence()
      .raw_bytes(m_tbs_bits)
      .end_cons()
      .decode(m_sig_algo)
      .decode(m_sig, ASN1_Type::BitString)
      .end_cons();
 
   force_decode();
}

References Botan::BitString, Botan::BER_Decoder::decode(), Botan::BER_Decoder::end_cons(), Botan::BER_Decoder::raw_bytes(), and Botan::BER_Decoder::start_sequence().

Referenced by Botan::X509_Object::load_data().

◆ encode_into()

void Botan::X509_Object::encode_into ( DER_Encoder & to ) const

overridevirtualinherited

DER encode an X509_Object See ASN1_Object::encode_into()

Implements Botan::ASN1_Object.

Definition at line 55 of file x509_obj.cpp.

                                                   {
   to.start_sequence()
      .start_sequence()
      .raw_bytes(signed_body())
      .end_cons()
      .encode(signature_algorithm())
      .encode(signature(), ASN1_Type::BitString)
      .end_cons();
}

References Botan::BitString, Botan::DER_Encoder::encode(), Botan::DER_Encoder::end_cons(), Botan::DER_Encoder::raw_bytes(), Botan::X509_Object::signature(), Botan::X509_Object::signature_algorithm(), Botan::X509_Object::signed_body(), and Botan::DER_Encoder::start_sequence().

◆ extended_key_usage()

const std::vector< OID > & Botan::X509_Certificate::extended_key_usage ( ) const

Get the key usage as defined in the ExtendedKeyUsage extension of this certificate, or else an empty vector.

Returns: key usage

Definition at line 427 of file x509cert.cpp.

                                                                 {
   return data().m_extended_key_usage;
}

Referenced by allowed_extended_usage(), has_ex_constraint(), and to_string().

◆ fingerprint()

std::string Botan::X509_Certificate::fingerprint ( std::string_view hash_name = "SHA-1" ) const

Returns: a fingerprint of the certificate

Parameters

hash_name hash function used to calculate the fingerprint

Definition at line 615 of file x509cert.cpp.

                                                                      {
   /*
   * The SHA-1 and SHA-256 fingerprints are precomputed since these
   * are the most commonly used. Especially, SHA-256 fingerprints are
   * used for cycle detection during path construction.
   *
   * If SHA-1 or SHA-256 was missing at parsing time the vectors are
   * left empty in which case we fall back to create_hex_fingerprint
   * which will throw if the hash is unavailable.
   */
   if(hash_name == "SHA-256" && !data().m_fingerprint_sha256.empty()) {
      return data().m_fingerprint_sha256;
   } else if(hash_name == "SHA-1" && !data().m_fingerprint_sha1.empty()) {
      return data().m_fingerprint_sha1;
   } else {
      return create_hex_fingerprint(this->BER_encode(), hash_name);
   }
}

References Botan::ASN1_Object::BER_encode(), and Botan::create_hex_fingerprint().

Referenced by Botan::Certificate_Store_In_SQL::affirm_cert(), Botan::PKIX::build_certificate_path(), Botan::Certificate_Store_In_SQL::find_key(), Botan::Certificate_Store_In_SQL::insert_cert(), Botan::Certificate_Store_In_SQL::insert_key(), Botan::Certificate_Store_In_SQL::remove_cert(), and Botan::Certificate_Store_In_SQL::revoke_cert().

◆ has_constraints()

bool Botan::X509_Certificate::has_constraints ( Key_Constraints constraints ) const

Returns true if and only if the specified

Parameters

constraints are included in the key usage extension.

Typically for applications you want allowed_usage instead.

Definition at line 443 of file x509cert.cpp.

                                                                  {
   // Unlike allowed_usage, returns false if constraints was not set
   return constraints().includes(usage);
}

References constraints(), and Botan::Key_Constraints::includes().

◆ has_ex_constraint() [1/2]

bool Botan::X509_Certificate::has_ex_constraint ( const OID & ex_constraint ) const

Returns true if and only if OID

Parameters

ex_constraint is included in the extended key extension.

Definition at line 506 of file x509cert.cpp.

                                                               {
   const std::vector<OID>& ex = extended_key_usage();
   return (std::find(ex.begin(), ex.end(), usage) != ex.end());
}

References extended_key_usage().

◆ has_ex_constraint() [2/2]

bool Botan::X509_Certificate::has_ex_constraint ( std::string_view ex_constraint ) const

Returns true if and only if OID

Parameters

ex_constraint is included in the extended key extension.

Definition at line 502 of file x509cert.cpp.

                                                                           {
   return has_ex_constraint(OID::from_string(ex_constraint));
}

References Botan::OID::from_string(), and has_ex_constraint().

Referenced by allowed_usage(), and has_ex_constraint().

◆ is_CA_cert()

bool Botan::X509_Certificate::is_CA_cert ( ) const

Check whether this certificate is a CA certificate.

Returns: true if this certificate is a CA certificate

Definition at line 407 of file x509cert.cpp.

                                        {
   if(data().m_version < 3 && data().m_self_signed) {
      return true;
   }
 
   return data().m_is_ca_certificate;
}

Referenced by allowed_usage(), Botan::PKIX::check_chain(), Botan::Flatfile_Certificate_Store::Flatfile_Certificate_Store(), Botan::Cert_Extension::Name_Constraints::validate(), and Botan::X509_CA::X509_CA().

◆ is_critical()

bool Botan::X509_Certificate::is_critical ( std::string_view ex_name ) const

Check whenever a given X509 Extension is marked critical in this certificate.

Definition at line 514 of file x509cert.cpp.

                                                               {
   return v3_extensions().critical_extension_set(OID::from_string(ex_name));
}

References Botan::Extensions::critical_extension_set(), Botan::OID::from_string(), and v3_extensions().

Referenced by Botan::Cert_Extension::Name_Constraints::validate().

◆ is_self_signed()

bool Botan::X509_Certificate::is_self_signed ( ) const

Check whether this certificate is self signed. If the DN issuer and subject agree,

Returns: true if this certificate is self signed

Definition at line 331 of file x509cert.cpp.

                                            {
   return data().m_self_signed;
}

Referenced by Botan::PKIX::build_certificate_path(), Botan::PKIX::check_chain(), Botan::Flatfile_Certificate_Store::Flatfile_Certificate_Store(), and to_string().

◆ is_serial_negative()

bool Botan::X509_Certificate::is_serial_negative ( ) const

Get the serial number's sign

Returns: 1 iff the serial is negative.

Definition at line 387 of file x509cert.cpp.

                                                {
   return data().m_serial_negative;
}

Referenced by Botan::PKIX::check_chain().

◆ issuer_alt_name()

const AlternativeName & Botan::X509_Certificate::issuer_alt_name ( ) const

Return the issuer alternative names (DNS, IP, ...)

Definition at line 542 of file x509cert.cpp.

                                                               {
   return data().m_issuer_alt_name;
}

Referenced by issuer_info().

◆ issuer_dn()

const X509_DN & Botan::X509_Certificate::issuer_dn ( ) const

Get the certificate's issuer distinguished name (DN).

Returns: issuer DN of this certificate

Definition at line 391 of file x509cert.cpp.

                                                 {
   return data().m_issuer_dn;
}

Referenced by Botan::PKIX::build_certificate_path(), Botan::PKIX::check_chain(), Botan::Certificate_Store_In_Memory::find_crl_for(), Botan::Certificate_Store_In_SQL::find_crl_for(), Botan::X509_CRL::is_revoked(), issuer_info(), Botan::OCSP::Request::Request(), and to_string().

◆ issuer_info()

std::vector< std::string > Botan::X509_Certificate::issuer_info ( std::string_view name ) const

Get a value for a specific subject_info parameter name.

Parameters

name	the name of the parameter to look up. Possible names are "X509.Certificate.v2.key_id" or "X509v3.AuthorityKeyIdentifier".

Returns: value(s) of the specified parameter

Definition at line 582 of file x509cert.cpp.

                                                                           {
   return get_cert_user_info(req, issuer_dn(), issuer_alt_name());
}

References issuer_alt_name(), and issuer_dn().

◆ load_data()

void Botan::X509_Object::load_data ( DataSource & src )

protectedinherited

Decodes from src as either DER or PEM data, then calls force_decode()

Definition at line 24 of file x509_obj.cpp.

                                          {
   try {
      if(ASN1::maybe_BER(in) && !PEM_Code::matches(in)) {
         BER_Decoder dec(in);
         decode_from(dec);
      } else {
         std::string got_label;
         DataSource_Memory ber(PEM_Code::decode(in, got_label));
 
         if(got_label != PEM_label()) {
            bool is_alternate = false;
            for(std::string_view alt_label : alternate_PEM_labels()) {
               if(got_label == alt_label) {
                  is_alternate = true;
                  break;
               }
            }
 
            if(!is_alternate) {
               throw Decoding_Error("Unexpected PEM label for " + PEM_label() + " of " + got_label);
            }
         }
 
         BER_Decoder dec(ber);
         decode_from(dec);
      }
   } catch(Decoding_Error& e) {
      throw Decoding_Error(PEM_label() + " decoding", e);
   }
}

References Botan::X509_Object::alternate_PEM_labels(), Botan::PEM_Code::decode(), Botan::X509_Object::decode_from(), Botan::PEM_Code::matches(), Botan::ASN1::maybe_BER(), and Botan::X509_Object::PEM_label().

Referenced by Botan::PKCS10_Request::PKCS10_Request(), Botan::PKCS10_Request::PKCS10_Request(), X509_Certificate(), X509_Certificate(), X509_Certificate(), Botan::X509_CRL::X509_CRL(), and Botan::X509_CRL::X509_CRL().

◆ load_subject_public_key()

std::unique_ptr< Public_Key > Botan::X509_Certificate::load_subject_public_key ( ) const

Create a public key object associated with the public key bits in this certificate. If the public key bits was valid for X.509 encoding purposes but invalid algorithmically (for example, RSA with an even modulus) that will be detected at this point, and an exception will be thrown.

Returns: subject public key of this certificate

Definition at line 597 of file x509cert.cpp.

                                                                          {
   return this->subject_public_key();
}

References subject_public_key().

◆ make_signed()

std::vector< uint8_t > Botan::X509_Object::make_signed	(	PK_Signer &	signer,
		RandomNumberGenerator &	rng,
		const AlgorithmIdentifier &	alg_id,
		const secure_vector< uint8_t > &	tbs )

staticinherited

Create a signed X509 object.

Parameters

signer	the signer used to sign the object
rng	the random number generator to use
alg_id	the algorithm identifier of the signature scheme
tbs	the tbs bits to be signed

Returns: signed X509 object

Definition at line 125 of file x509_obj.cpp.

                                                                                      {
   const std::vector<uint8_t> signature = signer.sign_message(tbs_bits, rng);
 
   std::vector<uint8_t> output;
   DER_Encoder(output)
      .start_sequence()
      .raw_bytes(tbs_bits)
      .encode(algo)
      .encode(signature, ASN1_Type::BitString)
      .end_cons();
 
   return output;
}

References Botan::BitString, Botan::DER_Encoder::encode(), Botan::DER_Encoder::end_cons(), Botan::DER_Encoder::raw_bytes(), Botan::PK_Signer::sign_message(), Botan::X509_Object::signature(), and Botan::DER_Encoder::start_sequence().

Referenced by Botan::PKCS10_Request::create(), and Botan::X509_CA::make_cert().

◆ matches_dns_name()

bool Botan::X509_Certificate::matches_dns_name ( std::string_view name ) const

Check if a certain DNS name matches up with the information in the cert

Parameters

name	DNS name to match

Note: this will also accept a dotted quad input, in which case the SAN for IPv4 addresses will be checked.

Definition at line 634 of file x509cert.cpp.

                                                                 {
   if(name.empty()) {
      return false;
   }
 
   if(auto req_ipv4 = string_to_ipv4(name)) {
      const auto& ipv4_names = subject_alt_name().ipv4_address();
      return ipv4_names.contains(req_ipv4.value());
   } else {
      auto issued_names = subject_info("DNS");
 
      // Fall back to CN only if no SAN is included
      if(!data().m_subject_alt_name_exists) {
         issued_names = subject_info("Name");
      }
 
      for(const auto& issued_name : issued_names) {
         if(host_wildcard_match(issued_name, name)) {
            return true;
         }
      }
   }
 
   return false;
}

References Botan::host_wildcard_match(), Botan::AlternativeName::ipv4_address(), name, Botan::string_to_ipv4(), subject_alt_name(), and subject_info().

◆ name_constraints()

const NameConstraints & Botan::X509_Certificate::name_constraints ( ) const

Get the name constraints as defined in the NameConstraints extension of this certificate.

Returns: name constraints

Definition at line 435 of file x509cert.cpp.

                                                                {
   return data().m_name_constraints;
}

Referenced by to_string().

◆ not_after()

const X509_Time & Botan::X509_Certificate::not_after ( ) const

Get the notAfter of the certificate as X509_Time

Returns: notAfter of the certificate

Definition at line 339 of file x509cert.cpp.

                                                   {
   return data().m_not_after;
}

Referenced by Botan::PKIX::check_chain(), and to_string().

◆ not_before()

const X509_Time & Botan::X509_Certificate::not_before ( ) const

Get the notBefore of the certificate as X509_Time

Returns: notBefore of the certificate

Definition at line 335 of file x509cert.cpp.

                                                    {
   return data().m_not_before;
}

Referenced by Botan::PKIX::check_chain(), and to_string().

◆ ocsp_responder()

std::string Botan::X509_Certificate::ocsp_responder ( ) const

Return the listed address of an OCSP responder, or empty if not set

Definition at line 518 of file x509cert.cpp.

                                                 {
   return data().m_ocsp_responder;
}

Referenced by to_string().

◆ operator<()

bool Botan::X509_Certificate::operator< ( const X509_Certificate & other ) const

Impose an arbitrary (but consistent) ordering, eg to allow sorting a container of certificate objects.

Returns: true if this is less than other by some unspecified criteria

Definition at line 668 of file x509cert.cpp.

                                                                    {
   /* If signature values are not equal, sort by lexicographic ordering of that */
   if(this->signature() != other.signature()) {
      return (this->signature() < other.signature());
   }
 
   // Then compare the signed contents
   return this->signed_body() < other.signed_body();
}

References Botan::X509_Object::signature(), and Botan::X509_Object::signed_body().

◆ operator=()

X509_Certificate & Botan::X509_Certificate::operator= ( const X509_Certificate & other )

default

◆ operator==()

bool Botan::X509_Certificate::operator== ( const X509_Certificate & other ) const

Check to certificates for equality.

Returns: true both certificates are (binary) equal

Definition at line 663 of file x509cert.cpp.

                                                                     {
   return (this->signature() == other.signature() && this->signature_algorithm() == other.signature_algorithm() &&
           this->signed_body() == other.signed_body());
}

References Botan::X509_Object::signature(), Botan::X509_Object::signature_algorithm(), and Botan::X509_Object::signed_body().

◆ path_limit()

uint32_t Botan::X509_Certificate::path_limit ( ) const

Get the path limit as defined in the BasicConstraints extension of this certificate.

Returns: path limit

Definition at line 415 of file x509cert.cpp.

                                            {
   if(data().m_version < 3 && data().m_self_signed) {
      return 32;  // in theory infinite, but this is more than enough
   }
 
   return static_cast<uint32_t>(data().m_path_len_constraint);
}

Referenced by Botan::PKIX::check_chain().

◆ PEM_encode()

std::string Botan::X509_Object::PEM_encode ( ) const

inherited

Returns: PEM encoding of this

Definition at line 83 of file x509_obj.cpp.

                                        {
   return PEM_Code::encode(BER_encode(), PEM_label());
}

References Botan::ASN1_Object::BER_encode(), Botan::PEM_Code::encode(), and Botan::X509_Object::PEM_label().

◆ raw_issuer_dn()

const std::vector< uint8_t > & Botan::X509_Certificate::raw_issuer_dn ( ) const

Raw issuer DN bits

Definition at line 399 of file x509cert.cpp.

                                                                {
   return data().m_issuer_dn_bits;
}

Referenced by Botan::OCSP::CertID::is_id_for().

◆ raw_issuer_dn_sha256()

std::vector< uint8_t > Botan::X509_Certificate::raw_issuer_dn_sha256 ( ) const

SHA-256 of Raw issuer DN

Definition at line 601 of file x509cert.cpp.

                                                                {
   if(data().m_issuer_dn_bits_sha256.empty()) {
      throw Encoding_Error("X509_Certificate::raw_issuer_dn_sha256 called but SHA-256 disabled in build");
   }
   return data().m_issuer_dn_bits_sha256;
}

◆ raw_subject_dn()

const std::vector< uint8_t > & Botan::X509_Certificate::raw_subject_dn ( ) const

Raw subject DN

Definition at line 403 of file x509cert.cpp.

                                                                 {
   return data().m_subject_dn_bits;
}

Referenced by Botan::OCSP::CertID::CertID().

◆ raw_subject_dn_sha256()

std::vector< uint8_t > Botan::X509_Certificate::raw_subject_dn_sha256 ( ) const

SHA-256 of Raw subject DN

Definition at line 608 of file x509cert.cpp.

                                                                 {
   if(data().m_subject_dn_bits_sha256.empty()) {
      throw Encoding_Error("X509_Certificate::raw_subject_dn_sha256 called but SHA-256 disabled in build");
   }
   return data().m_subject_dn_bits_sha256;
}

Referenced by Botan::Flatfile_Certificate_Store::Flatfile_Certificate_Store().

◆ serial_number()

const std::vector< uint8_t > & Botan::X509_Certificate::serial_number ( ) const

Get the serial number of this certificate.

Returns: certificates serial number

Definition at line 383 of file x509cert.cpp.

                                                                {
   return data().m_serial;
}

Referenced by Botan::CRL_Entry::CRL_Entry(), Botan::OCSP::CertID::is_id_for(), Botan::X509_CRL::is_revoked(), and to_string().

◆ signature()

const std::vector< uint8_t > & Botan::X509_Object::signature ( ) const

inlineinherited

Returns: signature on tbs_data()

Definition at line 37 of file x509_obj.h.

37{ return m_sig; }

Referenced by Botan::X509_Object::encode_into(), Botan::X509_Object::make_signed(), operator<(), operator==(), and Botan::X509_Object::verify_signature().

◆ signature_algorithm()

const AlgorithmIdentifier & Botan::X509_Object::signature_algorithm ( ) const

inlineinherited

Returns: signature algorithm that was used to generate signature

Definition at line 47 of file x509_obj.h.

47{ return m_sig_algo; }

Referenced by Botan::PKIX::check_chain(), Botan::X509_Object::encode_into(), operator==(), to_string(), and Botan::X509_Object::verify_signature().

◆ signed_body()

const std::vector< uint8_t > & Botan::X509_Object::signed_body ( ) const

inlineinherited

Returns: signed body

Definition at line 42 of file x509_obj.h.

42{ return m_tbs_bits; }

Referenced by Botan::X509_Object::encode_into(), operator<(), and operator==().

◆ subject_alt_name()

const AlternativeName & Botan::X509_Certificate::subject_alt_name ( ) const

Return the subject alternative names (DNS, IP, ...)

Definition at line 538 of file x509cert.cpp.

                                                                {
   return data().m_subject_alt_name;
}

Referenced by Botan::NameConstraints::is_excluded(), Botan::NameConstraints::is_permitted(), Botan::GeneralName::matches(), matches_dns_name(), and subject_info().

◆ subject_dn()

const X509_DN & Botan::X509_Certificate::subject_dn ( ) const

Get the certificate's subject distinguished name (DN).

Returns: subject DN of this certificate

Definition at line 395 of file x509cert.cpp.

                                                  {
   return data().m_subject_dn;
}

Referenced by Botan::Certificate_Store::certificate_known(), Botan::PKIX::check_chain(), Botan::Flatfile_Certificate_Store::Flatfile_Certificate_Store(), Botan::Certificate_Store_In_SQL::insert_cert(), Botan::NameConstraints::is_excluded(), Botan::NameConstraints::is_permitted(), Botan::GeneralName::matches(), Botan::Certificate_Store_In_SQL::remove_cert(), Botan::OCSP::Request::Request(), subject_info(), and to_string().

◆ subject_info()

std::vector< std::string > Botan::X509_Certificate::subject_info ( std::string_view name ) const

Get a value for a specific subject_info parameter name.

Parameters

name the name of the parameter to look up. Possible names include "X509.Certificate.version", "X509.Certificate.serial", "X509.Certificate.start", "X509.Certificate.end", "X509.Certificate.v2.key_id", "X509.Certificate.public_key", "X509v3.BasicConstraints.path_constraint", "X509v3.BasicConstraints.is_ca", "X509v3.NameConstraints", "X509v3.ExtendedKeyUsage", "X509v3.CertificatePolicies", "X509v3.SubjectKeyIdentifier", "X509.Certificate.serial", "X520.CommonName", "X520.Organization", "X520.Country", "RFC822" (Email in SAN) or "PKCS9.EmailAddress" (Email in DN).

Returns: value(s) of the specified parameter

Definition at line 575 of file x509cert.cpp.

                                                                            {
   return get_cert_user_info(req, subject_dn(), subject_alt_name());
}

References subject_alt_name(), and subject_dn().

Referenced by Botan::NameConstraints::is_excluded(), Botan::NameConstraints::is_permitted(), and matches_dns_name().

◆ subject_key_id()

const std::vector< uint8_t > & Botan::X509_Certificate::subject_key_id ( ) const

Get the DER encoded SubjectKeyIdentifier of this certificate.

Returns: DER encoded SubjectKeyIdentifier

Definition at line 379 of file x509cert.cpp.

                                                                 {
   return data().m_subject_key_id;
}

Referenced by Botan::Certificate_Store::certificate_known(), Botan::X509_CA::choose_extensions(), Botan::Certificate_Store_In_SQL::insert_cert(), Botan::Certificate_Store_In_SQL::remove_cert(), and to_string().

◆ subject_public_key()

std::unique_ptr< Public_Key > Botan::X509_Certificate::subject_public_key ( ) const

Create a public key object associated with the public key bits in this certificate. If the public key bits was valid for X.509 encoding purposes but invalid algorithmically (for example, RSA with an even modulus) that will be detected at this point, and an exception will be thrown.

Returns: subject public key of this certificate

Definition at line 589 of file x509cert.cpp.

                                                                     {
   try {
      return std::unique_ptr<Public_Key>(X509::load_key(subject_public_key_info()));
   } catch(std::exception& e) {
      throw Decoding_Error("X509_Certificate::subject_public_key", e);
   }
}

References Botan::X509::load_key(), and subject_public_key_info().

Referenced by Botan::PKIX::check_chain(), Botan::PKIX::check_crl(), load_subject_public_key(), to_string(), Botan::TLS::Certificate_Verify_12::verify(), and Botan::OCSP::Response::verify_signature().

◆ subject_public_key_algo()

const AlgorithmIdentifier & Botan::X509_Certificate::subject_public_key_algo ( ) const

Return the algorithm identifier of the public key

Definition at line 343 of file x509cert.cpp.

                                                                           {
   return data().m_subject_public_key_algid;
}

Referenced by to_string().

◆ subject_public_key_bits()

const std::vector< uint8_t > & Botan::X509_Certificate::subject_public_key_bits ( ) const

Get the public key associated with this certificate. This includes the outer AlgorithmIdentifier

Returns: subject public key of this certificate

Definition at line 355 of file x509cert.cpp.

                                                                          {
   return data().m_subject_public_key_bits;
}

◆ subject_public_key_bitstring()

const std::vector< uint8_t > & Botan::X509_Certificate::subject_public_key_bitstring ( ) const

Get the bit string of the public key associated with this certificate

Returns: public key bits

Definition at line 363 of file x509cert.cpp.

                                                                               {
   return data().m_subject_public_key_bitstring;
}

Referenced by Botan::OCSP::CertID::CertID(), Botan::OCSP::CertID::is_id_for(), and to_string().

◆ subject_public_key_bitstring_sha1()

const std::vector< uint8_t > & Botan::X509_Certificate::subject_public_key_bitstring_sha1 ( ) const

Get the SHA-1 bit string of the public key associated with this certificate. This is used for OCSP among other protocols. This function will throw if SHA-1 is not available.

Returns: hash of subject public key of this certificate

Definition at line 367 of file x509cert.cpp.

                                                                                    {
   if(data().m_subject_public_key_bitstring_sha1.empty()) {
      throw Encoding_Error("X509_Certificate::subject_public_key_bitstring_sha1 called but SHA-1 disabled in build");
   }
 
   return data().m_subject_public_key_bitstring_sha1;
}

Referenced by Botan::Flatfile_Certificate_Store::Flatfile_Certificate_Store().

◆ subject_public_key_info()

const std::vector< uint8_t > & Botan::X509_Certificate::subject_public_key_info ( ) const

Get the SubjectPublicKeyInfo associated with this certificate.

Returns: subject public key info of this certificate

Definition at line 359 of file x509cert.cpp.

                                                                          {
   return data().m_subject_public_key_bits_seq;
}

Referenced by subject_public_key().

◆ tbs_data()

std::vector< uint8_t > Botan::X509_Object::tbs_data ( ) const

inherited

The underlying data that is to be or was signed

Returns: data that is or was signed

Definition at line 90 of file x509_obj.cpp.

                                               {
   return ASN1::put_in_sequence(m_tbs_bits);
}

References Botan::ASN1::put_in_sequence().

Referenced by Botan::X509_Object::verify_signature().

◆ to_string()

std::string Botan::X509_Certificate::to_string ( ) const

Returns: a free-form string describing the certificate

Definition at line 685 of file x509cert.cpp.

                                            {
   std::ostringstream out;
 
   out << "Version: " << this->x509_version() << "\n";
   out << "Subject: " << subject_dn() << "\n";
   out << "Issuer: " << issuer_dn() << "\n";
   out << "Issued: " << this->not_before().readable_string() << "\n";
   out << "Expires: " << this->not_after().readable_string() << "\n";
 
   try {
      auto pubkey = this->subject_public_key();
      out << "Public Key [" << pubkey->algo_name() << "-" << pubkey->key_length() << "]\n\n";
      out << X509::PEM_encode(*pubkey) << "\n";
   } catch(const Decoding_Error& ex) {
      const AlgorithmIdentifier& alg_id = this->subject_public_key_algo();
      out << "Public Key Invalid!\n"
          << " OID: " << alg_id.oid().to_formatted_string() << "\n"
          << " Error: " << ex.what() << "\n"
          << " Hex: " << hex_encode(this->subject_public_key_bitstring()) << "\n";
   }
 
   out << "Constraints:\n";
   Key_Constraints constraints = this->constraints();
   if(constraints.empty()) {
      out << " No key constraints set\n";
   } else {
      if(constraints.includes(Key_Constraints::DigitalSignature)) {
         out << "   Digital Signature\n";
      }
      if(constraints.includes(Key_Constraints::NonRepudiation)) {
         out << "   Non-Repudiation\n";
      }
      if(constraints.includes(Key_Constraints::KeyEncipherment)) {
         out << "   Key Encipherment\n";
      }
      if(constraints.includes(Key_Constraints::DataEncipherment)) {
         out << "   Data Encipherment\n";
      }
      if(constraints.includes(Key_Constraints::KeyAgreement)) {
         out << "   Key Agreement\n";
      }
      if(constraints.includes(Key_Constraints::KeyCertSign)) {
         out << "   Cert Sign\n";
      }
      if(constraints.includes(Key_Constraints::CrlSign)) {
         out << "   CRL Sign\n";
      }
      if(constraints.includes(Key_Constraints::EncipherOnly)) {
         out << "   Encipher Only\n";
      }
      if(constraints.includes(Key_Constraints::DecipherOnly)) {
         out << "   Decipher Only\n";
      }
   }
 
   const std::vector<OID>& policies = this->certificate_policy_oids();
   if(!policies.empty()) {
      out << "Policies: "
          << "\n";
      for(const auto& oid : policies) {
         out << "   " << oid.to_string() << "\n";
      }
   }
 
   const std::vector<OID>& ex_constraints = this->extended_key_usage();
   if(!ex_constraints.empty()) {
      out << "Extended Constraints:\n";
      for(auto&& oid : ex_constraints) {
         out << "   " << oid.to_formatted_string() << "\n";
      }
   }
 
   const NameConstraints& name_constraints = this->name_constraints();
 
   if(!name_constraints.permitted().empty() || !name_constraints.excluded().empty()) {
      out << "Name Constraints:\n";
 
      if(!name_constraints.permitted().empty()) {
         out << "   Permit";
         for(const auto& st : name_constraints.permitted()) {
            out << " " << st.base();
         }
         out << "\n";
      }
 
      if(!name_constraints.excluded().empty()) {
         out << "   Exclude";
         for(const auto& st : name_constraints.excluded()) {
            out << " " << st.base();
         }
         out << "\n";
      }
   }
 
   if(!ocsp_responder().empty()) {
      out << "OCSP responder " << ocsp_responder() << "\n";
   }
 
   const std::vector<std::string> ca_issuers = this->ca_issuers();
   if(!ca_issuers.empty()) {
      out << "CA Issuers:\n";
      for(const auto& ca_issuer : ca_issuers) {
         out << "   URI: " << ca_issuer << "\n";
      }
   }
 
   for(const auto& cdp : crl_distribution_points()) {
      out << "CRL " << cdp << "\n";
   }
 
   out << "Signature algorithm: " << this->signature_algorithm().oid().to_formatted_string() << "\n";
 
   out << "Serial number: " << hex_encode(this->serial_number()) << "\n";
 
   if(!this->authority_key_id().empty()) {
      out << "Authority keyid: " << hex_encode(this->authority_key_id()) << "\n";
   }
 
   if(!this->subject_key_id().empty()) {
      out << "Subject keyid: " << hex_encode(this->subject_key_id()) << "\n";
   }
 
   if(this->is_self_signed()) {
      out << "Certificate is self signed\n";
   }
 
   return out.str();
}

◆ v2_issuer_key_id()

const std::vector< uint8_t > & Botan::X509_Certificate::v2_issuer_key_id ( ) const

Return the v2 issuer key ID. v2 key IDs are almost never used, instead see v3_subject_key_id.

Definition at line 347 of file x509cert.cpp.

                                                                   {
   return data().m_v2_issuer_key_id;
}

Referenced by Botan::PKIX::check_chain().

◆ v2_subject_key_id()

const std::vector< uint8_t > & Botan::X509_Certificate::v2_subject_key_id ( ) const

Return the v2 subject key ID. v2 key IDs are almost never used, instead see v3_subject_key_id.

Definition at line 351 of file x509cert.cpp.

                                                                    {
   return data().m_v2_subject_key_id;
}

Referenced by Botan::PKIX::check_chain().

◆ v3_extensions()

const Extensions & Botan::X509_Certificate::v3_extensions ( ) const

Get all extensions of this certificate.

Returns: certificate extensions

Definition at line 439 of file x509cert.cpp.

                                                        {
   return data().m_v3_extensions;
}

Referenced by Botan::PKIX::check_chain(), and is_critical().

◆ verify_signature()

std::pair< Certificate_Status_Code, std::string > Botan::X509_Object::verify_signature ( const Public_Key & key ) const

inherited

Check the signature on this data

Parameters

key	the public key purportedly used to sign this data

Returns: status of the signature - OK if verified or otherwise an indicator of the problem preventing verification, along with the hash function that was used, for further policy checks. The second parameter is empty unless the validation was sucessful.

Definition at line 102 of file x509_obj.cpp.

                                                                                                         {
   try {
      PK_Verifier verifier(pub_key, signature_algorithm());
      const bool valid = verifier.verify_message(tbs_data(), signature());
 
      if(valid) {
         return std::make_pair(Certificate_Status_Code::VERIFIED, verifier.hash_function());
      } else {
         return std::make_pair(Certificate_Status_Code::SIGNATURE_ERROR, "");
      }
   } catch(Decoding_Error&) {
      return std::make_pair(Certificate_Status_Code::SIGNATURE_ALGO_BAD_PARAMS, "");
   } catch(Algorithm_Not_Found&) {
      return std::make_pair(Certificate_Status_Code::SIGNATURE_ALGO_UNKNOWN, "");
   } catch(...) {
      // This shouldn't happen, fallback to generic signature error
      return std::make_pair(Certificate_Status_Code::SIGNATURE_ERROR, "");
   }
}

References Botan::PK_Verifier::hash_function(), Botan::X509_Object::signature(), Botan::SIGNATURE_ALGO_BAD_PARAMS, Botan::SIGNATURE_ALGO_UNKNOWN, Botan::X509_Object::signature_algorithm(), Botan::SIGNATURE_ERROR, Botan::X509_Object::tbs_data(), Botan::VERIFIED, and Botan::PK_Verifier::verify_message().

Referenced by Botan::PKIX::check_chain(), and Botan::X509_Object::check_signature().

◆ x509_version()

uint32_t Botan::X509_Certificate::x509_version ( ) const

Get the X509 version of this certificate object.

Returns: X509 version

Definition at line 327 of file x509cert.cpp.

                                              {
   return static_cast<uint32_t>(data().m_version);
}

Referenced by Botan::PKIX::check_chain(), and to_string().

The documentation for this class was generated from the following files:

src/lib/x509/x509cert.h
src/lib/x509/x509cert.cpp

Public Member Functions

Static Public Member Functions

Protected Member Functions

Detailed Description

Constructor & Destructor Documentation

◆ X509_Certificate() [1/5]

◆ X509_Certificate() [2/5]

◆ X509_Certificate() [3/5]

◆ X509_Certificate() [4/5]

◆ X509_Certificate() [5/5]

Member Function Documentation

◆ allowed_extended_usage() [1/2]

◆ allowed_extended_usage() [2/2]

◆ allowed_usage() [1/2]

◆ allowed_usage() [2/2]

◆ authority_key_id()

◆ BER_encode()

◆ ca_issuers()

◆ certificate_policy_oids()

◆ check_signature()

◆ choose_sig_format()

◆ constraints()

◆ crl_distribution_point()

◆ crl_distribution_points()

◆ decode_from()

◆ encode_into()

◆ extended_key_usage()

◆ fingerprint()

◆ has_constraints()

◆ has_ex_constraint() [1/2]

◆ has_ex_constraint() [2/2]

◆ is_CA_cert()

◆ is_critical()

◆ is_self_signed()

◆ is_serial_negative()

◆ issuer_alt_name()

◆ issuer_dn()

◆ issuer_info()

◆ load_data()

◆ load_subject_public_key()

◆ make_signed()

◆ matches_dns_name()

◆ name_constraints()

◆ not_after()

◆ not_before()

◆ ocsp_responder()

◆ operator<()

◆ operator=()

◆ operator==()

◆ path_limit()

◆ PEM_encode()

◆ raw_issuer_dn()

◆ raw_issuer_dn_sha256()

◆ raw_subject_dn()

◆ raw_subject_dn_sha256()

◆ serial_number()

◆ signature()

◆ signature_algorithm()

◆ signed_body()

◆ subject_alt_name()

◆ subject_dn()

◆ subject_info()

◆ subject_key_id()

◆ subject_public_key()

◆ subject_public_key_algo()

◆ subject_public_key_bits()

◆ subject_public_key_bitstring()

◆ subject_public_key_bitstring_sha1()

◆ subject_public_key_info()

◆ tbs_data()

◆ to_string()

◆ v2_issuer_key_id()

◆ v2_subject_key_id()

◆ v3_extensions()

◆ verify_signature()

◆ x509_version()