144 lines
6.1 KiB
HTML
Executable File
144 lines
6.1 KiB
HTML
Executable File
<?xml version="1.0" ?>
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
|
<head>
|
|
<title>OSSL_CRMF_MSG_set_validity</title>
|
|
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
|
<link rev="made" href="mailto:root@localhost" />
|
|
</head>
|
|
|
|
<body style="background-color: white">
|
|
|
|
|
|
<!-- INDEX BEGIN -->
|
|
<div name="index">
|
|
<p><a name="__index__"></a></p>
|
|
|
|
<ul>
|
|
|
|
<li><a href="#name">NAME</a></li>
|
|
<li><a href="#synopsis">SYNOPSIS</a></li>
|
|
<li><a href="#description">DESCRIPTION</a></li>
|
|
<li><a href="#return_values">RETURN VALUES</a></li>
|
|
<li><a href="#see_also">SEE ALSO</a></li>
|
|
<li><a href="#history">HISTORY</a></li>
|
|
<li><a href="#copyright">COPYRIGHT</a></li>
|
|
</ul>
|
|
|
|
<hr name="index" />
|
|
</div>
|
|
<!-- INDEX END -->
|
|
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="name">NAME</a></h1>
|
|
<p>OSSL_CRMF_MSG_set_validity,
|
|
OSSL_CRMF_MSG_set_certReqId,
|
|
OSSL_CRMF_CERTTEMPLATE_fill,
|
|
OSSL_CRMF_MSG_set0_extensions,
|
|
OSSL_CRMF_MSG_push0_extension,
|
|
OSSL_CRMF_MSG_create_popo,
|
|
OSSL_CRMF_MSGS_verify_popo
|
|
- functions populating and verifying CRMF CertReqMsg structures</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="synopsis">SYNOPSIS</a></h1>
|
|
<pre>
|
|
#include <openssl/crmf.h></pre>
|
|
<pre>
|
|
int OSSL_CRMF_MSG_set_validity(OSSL_CRMF_MSG *crm, time_t from, time_t to);</pre>
|
|
<pre>
|
|
int OSSL_CRMF_MSG_set_certReqId(OSSL_CRMF_MSG *crm, int rid);</pre>
|
|
<pre>
|
|
int OSSL_CRMF_CERTTEMPLATE_fill(OSSL_CRMF_CERTTEMPLATE *tmpl,
|
|
EVP_PKEY *pubkey,
|
|
const X509_NAME *subject,
|
|
const X509_NAME *issuer,
|
|
const ASN1_INTEGER *serial);</pre>
|
|
<pre>
|
|
int OSSL_CRMF_MSG_set0_extensions(OSSL_CRMF_MSG *crm, X509_EXTENSIONS *exts);</pre>
|
|
<pre>
|
|
int OSSL_CRMF_MSG_push0_extension(OSSL_CRMF_MSG *crm, X509_EXTENSION *ext);</pre>
|
|
<pre>
|
|
int OSSL_CRMF_MSG_create_popo(OSSL_CRMF_MSG *crm, EVP_PKEY *pkey,
|
|
int dgst, int ppmtd);</pre>
|
|
<pre>
|
|
int OSSL_CRMF_MSGS_verify_popo(const OSSL_CRMF_MSGS *reqs,
|
|
int rid, int acceptRAVerified);</pre>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="description">DESCRIPTION</a></h1>
|
|
<p><code>OSSL_CRMF_MSG_set_validity()</code> sets <strong>from</strong> as notBefore and <strong>to</strong> as notAfter
|
|
as the validity in the certTemplate of <strong>crm</strong>.</p>
|
|
<p><code>OSSL_CRMF_MSG_set_certReqId()</code> sets <strong>rid</strong> as the certReqId of <strong>crm</strong>.</p>
|
|
<p><code>OSSL_CRMF_CERTTEMPLATE_fill()</code> sets those fields of the certTemplate <strong>tmpl</strong>
|
|
for which non-NULL values are provided: <strong>pubkey</strong>, <strong>subject</strong>, <strong>issuer</strong>,
|
|
and/or <strong>serial</strong>.
|
|
On success the reference counter of the <strong>pubkey</strong> (if given) is incremented,
|
|
while the <strong>subject</strong>, <strong>issuer</strong>, and <strong>serial</strong> structures (if given) are copied.</p>
|
|
<p>OSSL_CRMF_MSG_set0_extensions() sets <strong>exts</strong> as the extensions in the
|
|
certTemplate of <strong>crm</strong>. Frees any pre-existing ones and consumes <strong>exts</strong>.</p>
|
|
<p>OSSL_CRMF_MSG_push0_extension() pushes the X509 extension <strong>ext</strong> to the
|
|
extensions in the certTemplate of <strong>crm</strong>. Consumes <strong>ext</strong>.</p>
|
|
<p><code>OSSL_CRMF_MSG_create_popo()</code> creates and sets the Proof-of-Possession (POPO)
|
|
according to the method <strong>ppmtd</strong> in <strong>crm</strong>.
|
|
In case the method is OSSL_CRMF_POPO_SIGNATURE the POPO is calculated
|
|
using the private <strong>pkey</strong> and the digest algorithm NID <strong>dgst</strong>.</p>
|
|
<p><strong>ppmtd</strong> can be one of the following:</p>
|
|
<ul>
|
|
<li><strong><a name="500" class="item">OSSL_CRMF_POPO_NONE - <a href="http://www.ietf.org/rfc/rfc4211.txt" class="rfc">RFC 4211</a>, section 4, POP field omitted.
|
|
CA/RA uses out-of-band method to verify POP. Note that servers may fail in this
|
|
case, resulting for instance in HTTP error code 500 (Internal error).</a></strong>
|
|
|
|
</li>
|
|
<li><strong><a name="ossl_crmf_popo_raverified_rfc_4211_section_4_explicit_indication_that_the_ra_has_already_verified_the_pop" class="item">OSSL_CRMF_POPO_RAVERIFIED - <a href="http://www.ietf.org/rfc/rfc4211.txt" class="rfc">RFC 4211</a>, section 4, explicit indication
|
|
that the RA has already verified the POP.</a></strong>
|
|
|
|
</li>
|
|
<li><strong><a name="ossl_crmf_popo_signature_rfc_4211_section_4_1_only_case_3_supported_so_far" class="item">OSSL_CRMF_POPO_SIGNATURE - <a href="http://www.ietf.org/rfc/rfc4211.txt" class="rfc">RFC 4211</a>, section 4.1, only case 3 supported
|
|
so far.</a></strong>
|
|
|
|
</li>
|
|
<li><strong><a name="method" class="item">OSSL_CRMF_POPO_KEYENC - <a href="http://www.ietf.org/rfc/rfc4211.txt" class="rfc">RFC 4211</a>, section 4.2, only indirect method
|
|
(subsequentMessage/enccert) supported,
|
|
challenge-response exchange (challengeResp) not yet supported.</a></strong>
|
|
|
|
</li>
|
|
<li><strong><a name="ossl_crmf_popo_keyagree_rfc_4211_section_4_3_not_yet_supported" class="item">OSSL_CRMF_POPO_KEYAGREE - <a href="http://www.ietf.org/rfc/rfc4211.txt" class="rfc">RFC 4211</a>, section 4.3, not yet supported.</a></strong>
|
|
|
|
</li>
|
|
</ul>
|
|
<p>OSSL_CRMF_MSGS_verify_popo verifies the Proof-of-Possession of the request with
|
|
the given <strong>rid</strong> in the list of <strong>reqs</strong>. Optionally accepts RAVerified.</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="return_values">RETURN VALUES</a></h1>
|
|
<p>All functions return 1 on success, 0 on error.</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="see_also">SEE ALSO</a></h1>
|
|
<p>RFC 4211</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="history">HISTORY</a></h1>
|
|
<p>The OpenSSL CRMF support was added in OpenSSL 3.0.</p>
|
|
<p>
|
|
</p>
|
|
<hr />
|
|
<h1><a name="copyright">COPYRIGHT</a></h1>
|
|
<p>Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
|
<p>Licensed under the Apache License 2.0 (the "License"). You may not use
|
|
this file except in compliance with the License. You can obtain a copy
|
|
in the file LICENSE in the source distribution or at
|
|
<a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
|
|
|
</body>
|
|
|
|
</html>
|