Botan::X509_Certificate_Cache Class Reference

#include <x509_cert_cache.h>

Public Member Functions
X509_Certificate	find_or_insert (std::span< const uint8_t > encoding)
	X509_Certificate_Cache (size_t max_entries=64)

Detailed Description

A cache for X.509 certificates

This is primarily useful for system certificate stores (Windows, macOS) where repeated lookups via native APIs return raw DER bytes that must be parsed each time. The cache deduplicates these by keying on the SHA-256 hash of the DER encoding.

Definition at line 30 of file x509_cert_cache.h.

Constructor & Destructor Documentation

X509_Certificate_Cache()

Botan::X509_Certificate_Cache::X509_Certificate_Cache ( size_t max_entries = 64 )

explicit

Parameters

max_entries

maximum number of certificates to cache. When the cache is full, an entry is evicted to make room. If 0, caching is disabled entirely.

Definition at line 13 of file x509_cert_cache.cpp.

: m_max_entries(max_entries) {}

Member Function Documentation

find_or_insert()

X509_Certificate Botan::X509_Certificate_Cache::find_or_insert

(

std::span< const uint8_t >

encoding

)

Look up a certificate by its DER encoding, or parse and cache it.

If a certificate with the same DER encoding (by SHA-256 hash) is already in the cache, returns a (cheap, shared_ptr-backed) copy. Otherwise, parses the DER encoding into an X509_Certificate, inserts it into the cache, and returns it.

If the cache was constructed with max_entries == 0, always parses and never caches.

Parameters

encoding

DER-encoded certificate

Returns

the cached or newly parsed certificate

Exceptions

Decoding_Error

if the encoding is not a valid certificate

Definition at line 15 of file x509_cert_cache.cpp.

                                                                                       {
   if(m_max_entries == 0) {
      return X509_Certificate(encoding);
   }
 
   // Hash the DER
   auto sha256 = HashFunction::create_or_throw("SHA-256");
   DER_Hash hash;
   sha256->update(encoding);
   sha256->final(hash.m_hash);
 
   // Check for a cache hit
   {
      const lock_guard_type<mutex_type> lock(m_mutex);
      if(auto it = m_cache.find(hash); it != m_cache.end()) {
         return it->second;
      }
   }
 
   // Deserialize the certificate
   X509_Certificate cert(encoding);
 
   // Lock again
   const lock_guard_type<mutex_type> lock(m_mutex);
 
   // Check for a cache hit (possibly racing with another thread)
   if(auto it = m_cache.find(hash); it != m_cache.end()) {
      return it->second;
   }
 
   // Evict if required
   //
   // Effectively this is just a random drop, might make sense to add LRU here
   while(m_cache.size() >= m_max_entries) {
      m_cache.erase(m_cache.begin());
   }
 
   // Add the newly deserialized cert to the cache
   auto it = m_cache.emplace(hash, std::move(cert)).first;
   return it->second;
}

References Botan::HashFunction::create_or_throw(), and Botan::lock().

---

The documentation for this class was generated from the following files:

• src/lib/x509/x509_cert_cache.h
• src/lib/x509/x509_cert_cache.cpp