#include <x509cert.h>

Inheritance diagram for Botan::X509_Certificate:

Public Member Functions
MemoryVector< byte >	authority_key_id () const
MemoryVector< byte >	BER_encode () const
bool	check_signature (class Public_Key &key) const
bool	check_signature (class Public_Key *key) const
Key_Constraints	constraints () const
void	encode (Pipe &out, X509_Encoding encoding=PEM) const
std::string	end_time () const
std::vector< std::string >	ex_constraints () const
std::string	hash_used_for_signature () const
bool	is_CA_cert () const
bool	is_self_signed () const
X509_DN	issuer_dn () const
std::vector< std::string >	issuer_info (const std::string &name) const
bool	operator== (const X509_Certificate &other) const
u32bit	path_limit () const
std::string	PEM_encode () const
std::vector< std::string >	policies () const
MemoryVector< byte >	serial_number () const
MemoryVector< byte >	signature () const
AlgorithmIdentifier	signature_algorithm () const
std::string	start_time () const
X509_DN	subject_dn () const
std::vector< std::string >	subject_info (const std::string &name) const
MemoryVector< byte >	subject_key_id () const
Public_Key *	subject_public_key () const
MemoryVector< byte >	tbs_data () const
std::string	to_string () const
	X509_Certificate (const std::string &filename)
	X509_Certificate (DataSource &source)
u32bit	x509_version () const

Static Public Member Functions
static MemoryVector< byte >	make_signed (class PK_Signer *signer, RandomNumberGenerator &rng, const AlgorithmIdentifier &alg_id, const MemoryRegion< byte > &tbs)

Protected Member Functions
void	do_decode ()

Protected Attributes
MemoryVector< byte >	sig
AlgorithmIdentifier	sig_algo
MemoryVector< byte >	tbs_bits

Friends
class	X509_CA

Detailed Description

This class represents X.509 Certificate

Definition at line 23 of file x509cert.h.

Constructor & Destructor Documentation

◆ X509_Certificate() [1/2]

Botan::X509_Certificate::X509_Certificate ( DataSource & source )

Create a certificate from a data source providing the DER or PEM encoded certificate.

Parameters

source the data source

Definition at line 47 of file x509cert.cpp.

                                                 :
   X509_Object(in, "CERTIFICATE/X509 CERTIFICATE")
   {
   self_signed = false;
   do_decode();
   }

References Botan::X509_Object::do_decode(), and Botan::X509_Object::X509_Object().

Referenced by Botan::X509_CA::make_cert(), operator==(), and X509_CA.

◆ X509_Certificate() [2/2]

Botan::X509_Certificate::X509_Certificate ( const std::string & filename )

Create a certificate from a file containing the DER or PEM encoded certificate.

Parameters

filename the name of the certificate file

Definition at line 57 of file x509cert.cpp.

                                                      :
   X509_Object(in, "CERTIFICATE/X509 CERTIFICATE")
   {
   self_signed = false;
   do_decode();
   }

References Botan::X509_Object::do_decode(), and Botan::X509_Object::X509_Object().

Member Function Documentation

◆ authority_key_id()

MemoryVector< byte > Botan::X509_Certificate::authority_key_id ( ) const

Get the DER encoded AuthorityKeyIdentifier of this certificate.

Returns: DER encoded AuthorityKeyIdentifier

Definition at line 250 of file x509cert.cpp.

   {
   return issuer.get1_memvec("X509v3.AuthorityKeyIdentifier");
   }

Referenced by to_string().

◆ BER_encode()

MemoryVector< byte > Botan::X509_Object::BER_encode ( ) const

inherited

Returns: BER encoding of this

Definition at line 100 of file x509_obj.cpp.

   {
   return DER_Encoder()
      .start_cons(SEQUENCE)
         .start_cons(SEQUENCE)
            .raw_bytes(tbs_bits)
         .end_cons()
         .encode(sig_algo)
         .encode(sig, BIT_STRING)
      .end_cons()
   .get_contents();
   }

References Botan::BIT_STRING, Botan::DER_Encoder::encode(), Botan::DER_Encoder::end_cons(), Botan::DER_Encoder::get_contents(), Botan::DER_Encoder::raw_bytes(), Botan::SEQUENCE, sig, sig_algo, Botan::DER_Encoder::start_cons(), and tbs_bits.

Referenced by encode(), PEM_encode(), and Botan::CMS_Encoder::sign().

◆ check_signature() [1/2]

bool Botan::X509_Object::check_signature ( class Public_Key & key ) const

inherited

Check the signature on this data

Parameters

key	the public key purportedly used to sign this data

Returns: true if the signature is valid, otherwise false

Definition at line 178 of file x509_obj.cpp.

   {
   try {
      std::vector<std::string> sig_info =
         split_on(OIDS::lookup(sig_algo.oid), '/');
 
      if(sig_info.size() != 2 || sig_info[0] != pub_key.algo_name())
         return false;
 
      std::string padding = sig_info[1];
      Signature_Format format =
         (pub_key.message_parts() >= 2) ? DER_SEQUENCE : IEEE_1363;
 
      PK_Verifier verifier(pub_key, padding, format);
 
      return verifier.verify_message(tbs_data(), signature());
      }
   catch(...)
      {
      return false;
      }
   }

References Botan::Public_Key::algo_name(), Botan::DER_SEQUENCE, Botan::IEEE_1363, Botan::OIDS::lookup(), Botan::Public_Key::message_parts(), Botan::AlgorithmIdentifier::oid, sig_algo, signature(), Botan::split_on(), tbs_data(), and Botan::PK_Verifier::verify_message().

Referenced by check_signature().

◆ check_signature() [2/2]

bool Botan::X509_Object::check_signature ( class Public_Key * key ) const

inherited

Check the signature on this data

Parameters

key	the public key purportedly used to sign this data the pointer will be deleted after use

Returns: true if the signature is valid, otherwise false

Definition at line 169 of file x509_obj.cpp.

   {
   std::auto_ptr<Public_Key> key(pub_key);
   return check_signature(*key);
   }

References check_signature().

◆ constraints()

Key_Constraints Botan::X509_Certificate::constraints ( ) const

Get the key constraints as defined in the KeyUsage extension of this certificate.

Returns: key constraints

Definition at line 225 of file x509cert.cpp.

   {
   return Key_Constraints(subject.get1_u32bit("X509v3.KeyUsage",
                                              NO_CONSTRAINTS));
   }

References Botan::NO_CONSTRAINTS.

Referenced by Botan::CMS_Encoder::encrypt(), is_CA_cert(), and to_string().

◆ do_decode()

void Botan::X509_Object::do_decode ( )

protectedinherited

Definition at line 221 of file x509_obj.cpp.

   {
   try {
      force_decode();
      }
   catch(Decoding_Error& e)
      {
      throw Decoding_Error(PEM_label_pref + " decoding failed (" +
                           e.what() + ")");
      }
   catch(Invalid_Argument& e)
      {
      throw Decoding_Error(PEM_label_pref + " decoding failed (" +
                           e.what() + ")");
      }
   }

References Botan::Decoding_Error::Decoding_Error().

Referenced by Botan::PKCS10_Request::PKCS10_Request(), Botan::PKCS10_Request::PKCS10_Request(), Botan::X509_Certificate::X509_Certificate(), Botan::X509_Certificate::X509_Certificate(), Botan::X509_CRL::X509_CRL(), and Botan::X509_CRL::X509_CRL().

◆ encode()

void Botan::X509_Object::encode	(	Pipe &	out,
		X509_Encoding	encoding = PEM ) const

inherited

Encode this to a pipe

Deprecated: use BER_encode or PEM_encode instead

Parameters

out	the pipe to write to
encoding	the encoding to use

Definition at line 89 of file x509_obj.cpp.

   {
   if(encoding == PEM)
      out.write(this->PEM_encode());
   else
      out.write(this->BER_encode());
   }

References BER_encode(), Botan::PEM, PEM_encode(), and Botan::Pipe::write().

◆ end_time()

std::string Botan::X509_Certificate::end_time ( ) const

Get the notAfter of the certificate.

Returns: notAfter of the certificate

Definition at line 170 of file x509cert.cpp.

   {
   return subject.get1("X509.Certificate.end");
   }

Referenced by to_string(), and Botan::X509_Store::validate_cert().

◆ ex_constraints()

std::vector< std::string > Botan::X509_Certificate::ex_constraints ( ) const

Get the key constraints as defined in the ExtendedKeyUsage extension of this certificate.

Returns: key constraints

Definition at line 234 of file x509cert.cpp.

   {
   return lookup_oids(subject.get("X509v3.ExtendedKeyUsage"));
   }

Referenced by to_string().

◆ hash_used_for_signature()

std::string Botan::X509_Object::hash_used_for_signature ( ) const

inherited

Returns: hash algorithm that was used to generate signature

Definition at line 148 of file x509_obj.cpp.

   {
   std::vector<std::string> sig_info =
      split_on(OIDS::lookup(sig_algo.oid), '/');
 
   if(sig_info.size() != 2)
      throw Internal_Error("Invalid name format found for " +
                           sig_algo.oid.as_string());
 
   std::vector<std::string> pad_and_hash =
      parse_algorithm_name(sig_info[1]);
 
   if(pad_and_hash.size() != 2)
      throw Internal_Error("Invalid name format " + sig_info[1]);
 
   return pad_and_hash[1];
   }

References Botan::OID::as_string(), Botan::Internal_Error::Internal_Error(), Botan::OIDS::lookup(), Botan::AlgorithmIdentifier::oid, Botan::parse_algorithm_name(), sig_algo, and Botan::split_on().

◆ is_CA_cert()

bool Botan::X509_Certificate::is_CA_cert ( ) const

Check whether this certificate is a CA certificate.

Returns: true if this certificate is a CA certificate

Definition at line 205 of file x509cert.cpp.

   {
   if(!subject.get1_u32bit("X509v3.BasicConstraints.is_ca"))
      return false;
   if((constraints() & KEY_CERT_SIGN) || (constraints() == NO_CONSTRAINTS))
      return true;
   return false;
   }

References constraints(), Botan::KEY_CERT_SIGN, and Botan::NO_CONSTRAINTS.

◆ is_self_signed()

bool Botan::X509_Certificate::is_self_signed ( ) const

inline

Check whether this certificate is self signed.

Returns: true if this certificate is self signed

Definition at line 106 of file x509cert.h.

106{ return self_signed; }

Referenced by Botan::X509_Store::add_cert().

◆ issuer_dn()

X509_DN Botan::X509_Certificate::issuer_dn ( ) const

Get the issuer certificate DN.

Returns: issuer DN of this certificate

Definition at line 274 of file x509cert.cpp.

   {
   return create_dn(issuer);
   }

References Botan::create_dn().

◆ issuer_info()

std::vector< std::string > Botan::X509_Certificate::issuer_info ( const std::string & name ) const

Get a value for a specific subject_info parameter name.

Parameters

name	the name of the paramter to look up. Possible names are "X509.Certificate.v2.key_id" or "X509v3.AuthorityKeyIdentifier".

Returns: value(s) of the specified parameter

Definition at line 188 of file x509cert.cpp.

   {
   return issuer.get(X509_DN::deref_info_field(what));
   }

References Botan::X509_DN::deref_info_field().

Referenced by to_string().

◆ make_signed()

MemoryVector< byte > Botan::X509_Object::make_signed	(	class PK_Signer *	signer,
		RandomNumberGenerator &	rng,
		const AlgorithmIdentifier &	alg_id,
		const MemoryRegion< byte > &	tbs )

staticinherited

Create a signed X509 object.

Parameters

signer	the signer used to sign the object
rng	the random number generator to use
alg_id	the algorithm identifier of the signature scheme
tbs	the tbs bits to be signed

Returns: signed X509 object

Definition at line 204 of file x509_obj.cpp.

   {
   return DER_Encoder()
      .start_cons(SEQUENCE)
         .raw_bytes(tbs_bits)
         .encode(algo)
         .encode(signer->sign_message(tbs_bits, rng), BIT_STRING)
      .end_cons()
   .get_contents();
   }

References Botan::BIT_STRING, Botan::DER_Encoder::encode(), Botan::DER_Encoder::end_cons(), Botan::DER_Encoder::get_contents(), Botan::DER_Encoder::raw_bytes(), Botan::SEQUENCE, Botan::PK_Signer::sign_message(), Botan::DER_Encoder::start_cons(), and tbs_bits.

Referenced by Botan::X509::create_cert_req(), and Botan::X509_CA::make_cert().

◆ operator==()

bool Botan::X509_Certificate::operator== ( const X509_Certificate & other ) const

Check to certificates for equality.

Returns: true both certificates are (binary) equal

Definition at line 290 of file x509cert.cpp.

   {
   return (sig == other.sig &&
           sig_algo == other.sig_algo &&
           self_signed == other.self_signed &&
           issuer == other.issuer &&
           subject == other.subject);
   }

References Botan::X509_Object::sig, Botan::X509_Object::sig_algo, and X509_Certificate().

◆ path_limit()

u32bit Botan::X509_Certificate::path_limit ( ) const

Get the path limit as defined in the BasicConstraints extension of this certificate.

Returns: path limit

Definition at line 217 of file x509cert.cpp.

   {
   return subject.get1_u32bit("X509v3.BasicConstraints.path_constraint", 0);
   }

◆ PEM_encode()

std::string Botan::X509_Object::PEM_encode ( ) const

inherited

Returns: PEM encoding of this

Definition at line 116 of file x509_obj.cpp.

   {
   return PEM_Code::encode(BER_encode(), PEM_label_pref);
   }

References BER_encode(), and Botan::PEM_Code::encode().

Referenced by encode().

◆ policies()

std::vector< std::string > Botan::X509_Certificate::policies ( ) const

Get the policies as defined in the CertificatePolicies extension of this certificate.

Returns: certificate policies

Definition at line 242 of file x509cert.cpp.

   {
   return lookup_oids(subject.get("X509v3.CertificatePolicies"));
   }

Referenced by to_string().

◆ serial_number()

MemoryVector< byte > Botan::X509_Certificate::serial_number ( ) const

Get the serial number of this certificate.

Returns: certificates serial number

Definition at line 266 of file x509cert.cpp.

   {
   return subject.get1_memvec("X509.Certificate.serial");
   }

Referenced by Botan::CRL_Entry::CRL_Entry(), and to_string().

◆ signature()

MemoryVector< byte > Botan::X509_Object::signature ( ) const

inherited

Returns: signature on tbs_data()

Definition at line 132 of file x509_obj.cpp.

   {
   return sig;
   }

References sig.

Referenced by check_signature().

◆ signature_algorithm()

AlgorithmIdentifier Botan::X509_Object::signature_algorithm ( ) const

inherited

Returns: signature algorithm that was used to generate signature

Definition at line 140 of file x509_obj.cpp.

   {
   return sig_algo;
   }

References sig_algo.

Referenced by Botan::X509_Certificate::to_string().

◆ start_time()

std::string Botan::X509_Certificate::start_time ( ) const

Get the notBefore of the certificate.

Returns: notBefore of the certificate

Definition at line 162 of file x509cert.cpp.

   {
   return subject.get1("X509.Certificate.start");
   }

Referenced by to_string(), and Botan::X509_Store::validate_cert().

◆ subject_dn()

X509_DN Botan::X509_Certificate::subject_dn ( ) const

Get the subject certificate DN.

Returns: subject DN of this certificate

Definition at line 282 of file x509cert.cpp.

   {
   return create_dn(subject);
   }

References Botan::create_dn().

Referenced by Botan::X509_Store::add_cert(), and Botan::X509_Store::add_crl().

◆ subject_info()

std::vector< std::string > Botan::X509_Certificate::subject_info ( const std::string & name ) const

Get a value for a specific subject_info parameter name.

Parameters

name the name of the paramter to look up. Possible names are "X509.Certificate.version", "X509.Certificate.serial", "X509.Certificate.start", "X509.Certificate.end", "X509.Certificate.v2.key_id", "X509.Certificate.public_key", "X509v3.BasicConstraints.path_constraint", "X509v3.BasicConstraints.is_ca", "X509v3.ExtendedKeyUsage", "X509v3.CertificatePolicies", "X509v3.SubjectKeyIdentifier" or "X509.Certificate.serial".

Returns: value(s) of the specified parameter

Definition at line 179 of file x509cert.cpp.

   {
   return subject.get(X509_DN::deref_info_field(what));
   }

References Botan::X509_DN::deref_info_field().

Referenced by to_string().

◆ subject_key_id()

MemoryVector< byte > Botan::X509_Certificate::subject_key_id ( ) const

Get the DER encoded SubjectKeyIdentifier of this certificate.

Returns: DER encoded SubjectKeyIdentifier

Definition at line 258 of file x509cert.cpp.

   {
   return subject.get1_memvec("X509v3.SubjectKeyIdentifier");
   }

Referenced by Botan::X509_Store::add_cert(), Botan::X509_Store::add_crl(), Botan::CMS_Encoder::sign(), and to_string().

◆ subject_public_key()

Public_Key * Botan::X509_Certificate::subject_public_key ( ) const

Get the public key associated with this certificate.

Returns: subject public key of this certificate

Definition at line 196 of file x509cert.cpp.

   {
   DataSource_Memory source(subject.get1("X509.Certificate.public_key"));
   return X509::load_key(source);
   }

References Botan::X509::load_key().

Referenced by Botan::X509_Store::add_crl(), Botan::CMS_Encoder::encrypt(), to_string(), Botan::Certificate_Verify::verify(), and Botan::Server_Key_Exchange::verify().

◆ tbs_data()

MemoryVector< byte > Botan::X509_Object::tbs_data ( ) const

inherited

The underlying data that is to be or was signed

Returns: data that is or was signed

Definition at line 124 of file x509_obj.cpp.

   {
   return ASN1::put_in_sequence(tbs_bits);
   }

References Botan::ASN1::put_in_sequence(), and tbs_bits.

Referenced by check_signature().

◆ to_string()

std::string Botan::X509_Certificate::to_string ( ) const

Returns: a string describing the certificate

Definition at line 307 of file x509cert.cpp.

   {
   const char* dn_fields[] = { "Name",
                               "Email",
                               "Organization",
                               "Organizational Unit",
                               "Locality",
                               "State",
                               "Country",
                               "IP",
                               "DNS",
                               "URI",
                               "PKIX.XMPPAddr",
                               0 };
 
   std::ostringstream out;
 
   for(size_t i = 0; dn_fields[i]; ++i)
      {
      const std::vector<std::string> vals = this->subject_info(dn_fields[i]);
 
      if(vals.empty())
         continue;
 
      out << "Subject " << dn_fields[i] << ":";
      for(size_t j = 0; j != vals.size(); ++j)
         out << " " << vals[j];
      out << "\n";
      }
 
   for(size_t i = 0; dn_fields[i]; ++i)
      {
      const std::vector<std::string> vals = this->issuer_info(dn_fields[i]);
 
      if(vals.empty())
         continue;
 
      out << "Issuer " << dn_fields[i] << ":";
      for(size_t j = 0; j != vals.size(); ++j)
         out << " " << vals[j];
      out << "\n";
      }
 
   out << "Version: " << this->x509_version() << "\n";
 
   out << "Not valid before: " << this->start_time() << "\n";
   out << "Not valid after: " << this->end_time() << "\n";
 
   out << "Constraints:\n";
   Key_Constraints constraints = this->constraints();
   if(constraints == NO_CONSTRAINTS)
      out << " None\n";
   else
      {
      if(constraints & DIGITAL_SIGNATURE)
         out << "   Digital Signature\n";
      if(constraints & NON_REPUDIATION)
         out << "   Non-Repuidation\n";
      if(constraints & KEY_ENCIPHERMENT)
         out << "   Key Encipherment\n";
      if(constraints & DATA_ENCIPHERMENT)
         out << "   Data Encipherment\n";
      if(constraints & KEY_AGREEMENT)
         out << "   Key Agreement\n";
      if(constraints & KEY_CERT_SIGN)
         out << "   Cert Sign\n";
      if(constraints & CRL_SIGN)
         out << "   CRL Sign\n";
      }
 
   std::vector<std::string> policies = this->policies();
   if(policies.size())
      {
      out << "Policies: " << "\n";
      for(size_t i = 0; i != policies.size(); i++)
         out << "   " << policies[i] << "\n";
      }
 
   std::vector<std::string> ex_constraints = this->ex_constraints();
   if(ex_constraints.size())
      {
      out << "Extended Constraints:\n";
      for(size_t i = 0; i != ex_constraints.size(); i++)
         out << "   " << ex_constraints[i] << "\n";
      }
 
   out << "Signature algorithm: " <<
      OIDS::lookup(this->signature_algorithm().oid) << "\n";
 
   out << "Serial number: " << hex_encode(this->serial_number()) << "\n";
 
   if(this->authority_key_id().size())
     out << "Authority keyid: " << hex_encode(this->authority_key_id()) << "\n";
 
   if(this->subject_key_id().size())
     out << "Subject keyid: " << hex_encode(this->subject_key_id()) << "\n";
 
   X509_PublicKey* pubkey = this->subject_public_key();
   out << "Public Key:\n" << X509::PEM_encode(*pubkey);
   delete pubkey;
 
   return out.str();
   }

References authority_key_id(), constraints(), Botan::CRL_SIGN, Botan::DATA_ENCIPHERMENT, Botan::DIGITAL_SIGNATURE, end_time(), ex_constraints(), Botan::hex_encode(), issuer_info(), Botan::KEY_AGREEMENT, Botan::KEY_CERT_SIGN, Botan::KEY_ENCIPHERMENT, Botan::OIDS::lookup(), Botan::NO_CONSTRAINTS, Botan::NON_REPUDIATION, Botan::X509::PEM_encode(), policies(), serial_number(), Botan::X509_Object::signature_algorithm(), start_time(), subject_info(), subject_key_id(), subject_public_key(), and x509_version().

◆ x509_version()

u32bit Botan::X509_Certificate::x509_version ( ) const

Get the X509 version of this certificate object.

Returns: X509 version

Definition at line 154 of file x509cert.cpp.

   {
   return (subject.get1_u32bit("X509.Certificate.version") + 1);
   }

Referenced by to_string().

◆ X509_CA

friend class X509_CA

friend

Definition at line 169 of file x509cert.h.

References X509_CA, and X509_Certificate().

Referenced by X509_CA.

Member Data Documentation

◆ sig

MemoryVector<byte> Botan::X509_Object::sig

protectedinherited

Definition at line 102 of file x509_obj.h.

Referenced by BER_encode(), Botan::X509_Certificate::operator==(), and signature().

◆ sig_algo

AlgorithmIdentifier Botan::X509_Object::sig_algo

protectedinherited

Definition at line 101 of file x509_obj.h.

Referenced by BER_encode(), check_signature(), hash_used_for_signature(), Botan::X509_Certificate::operator==(), and signature_algorithm().

◆ tbs_bits

MemoryVector<byte> Botan::X509_Object::tbs_bits

protectedinherited

Definition at line 102 of file x509_obj.h.

Referenced by BER_encode(), make_signed(), and tbs_data().

The documentation for this class was generated from the following files:

src/cert/x509cert/x509cert.h
src/cert/x509cert/x509cert.cpp

Public Member Functions

Static Public Member Functions

Protected Member Functions

Protected Attributes

Friends

Detailed Description

Constructor & Destructor Documentation

◆ X509_Certificate() [1/2]

◆ X509_Certificate() [2/2]

Member Function Documentation

◆ authority_key_id()

◆ BER_encode()

◆ check_signature() [1/2]

◆ check_signature() [2/2]

◆ constraints()

◆ do_decode()

◆ encode()

◆ end_time()

◆ ex_constraints()

◆ hash_used_for_signature()

◆ is_CA_cert()

◆ is_self_signed()

◆ issuer_dn()

◆ issuer_info()

◆ make_signed()

◆ operator==()

◆ path_limit()

◆ PEM_encode()

◆ policies()

◆ serial_number()

◆ signature()

◆ signature_algorithm()

◆ start_time()

◆ subject_dn()

◆ subject_info()

◆ subject_key_id()

◆ subject_public_key()

◆ tbs_data()

◆ to_string()

◆ x509_version()

Friends And Related Symbol Documentation

◆ X509_CA

Member Data Documentation

◆ sig

◆ sig_algo

◆ tbs_bits