#include <wvx509.h>
Inheritance diagram for WvX509Mgr:
Public Types | |
enum | DumpMode { CertPEM = 0, RsaPEM, RsaPubPEM, RsaRaw } |
Type for the encode() and decode() methods. More... | |
Public Member Functions | |
WvX509Mgr (X509 *_cert=NULL) | |
Initialize a blank X509 Object with the certificate *cert (used for client side operations...). | |
WvX509Mgr (WvStringParm hexcert, WvStringParm hexrsa) | |
Constructor to initialize this object with a pre-existing certificate and key. | |
WvX509Mgr (WvStringParm _dname, WvRSAKey *_rsa) | |
Constructor to create a self-signed certificate for the given dn and RSA key. | |
WvX509Mgr (WvStringParm _dname, int bits) | |
Constructor to create a new self-signed certificate for the given dn and number of bits. | |
virtual | ~WvX509Mgr () |
Destructor. | |
bool | bind_ssl (SSL_CTX *ctx) |
Avoid a lot of ugliness by having it so that we are binding to the SSL context, and not the other way around, since that would make ownership of the cert and rsa keys ambiguous. | |
const WvRSAKey & | get_rsa () |
Accessor for the RSA Keys. | |
void | create_selfsigned (bool is_ca=false) |
Given the Distinguished Name dname and an already generated keypair in rsa, return a Self Signed Certificate in cert. | |
WvString | certreq () |
Create a certificate request (PKCS#10) using this function.. | |
WvString | signcert (WvStringParm pkcs10req) |
Take the PKCS#10 request in the string pkcs10req, sign it with the private key in rsa, and then spit back a new X509 Certificate in PEM format. | |
bool | test () |
Test to make sure that a certificate and a keypair go together. | |
void | unhexify (WvStringParm encodedcert) |
Given a hexified certificate, fill the cert member NOTE: ALWAYS load your RSA Keys before calling this! It is best if you have hexify()'d keys to simply use the proper constructor. | |
WvString | hexify () |
Given the X509 certificate object cert, return a hexified string useful in a WvConf or UniConf file. | |
bool | validate (WvX509Mgr *cacert=NULL, X509_CRL *crl=NULL) |
Function to verify the validity of a certificate that has been placed in cert. | |
bool | signedbyCAindir (WvStringParm certdir) |
Check the certificate in cert against the CA certificates in certdir - returns true if cert was signed by one of the CA certificates. | |
bool | signedbyCAinfile (WvStringParm certfile) |
Check the certificate in cert against the CA certificate in certfile returns true if cert was signed by that CA certificate. | |
bool | signedbyCA (WvX509Mgr *cacert) |
Check the certificate in cert against the CA certificate in cacert returns true if cert was signed by that CA certificate. | |
WvString | sign (WvBuf &data) |
Sign the contents of data and return the signature as a BASE64 string. | |
WvString | sign (WvStringParm data) |
bool | verify (WvBuf &original, WvStringParm signature) |
Verify that the contents of data were signed by the certificate currently in cert. | |
bool | verify (WvStringParm original, WvStringParm signature) |
WvString | encode (const DumpMode mode) |
Return the information requested by mode as a WvString. | |
void | decode (const DumpMode mode, WvStringParm PemEncoded) |
Load the information from the format requested by mode into the class - this overwrites the certificate, and possibly the key - and to enable two stage loading (the certificate first, then the key), it DOES NOT call test() - that will be up to the programmer. | |
void | write_p12 (WvStringParm filename) |
And of course, since PKCS12 files are in the rediculous DER encoding format, which is binary, we can't use the encode/decode functions, so we deal straight with files... | |
void | read_p12 (WvStringParm filename) |
And this reads from the file specified in filename, and fills the RSA and cert members with the decoded information. | |
void | setPkcs12Password (WvStringParm passwd) |
Sets the PKCS12 password. | |
WvString | get_issuer () |
Return the Certificate Issuer (usually the CA who signed the certificate). | |
WvString | get_subject () |
Return the Subject field of the certificate. | |
WvString | get_serial () |
Return the serialNumber field of the certificate. | |
WvString | get_crl_dp () |
Return the CRL Distribution points if they exist, WvString::null if they don't. | |
WvString | get_cp_oid () |
Return the Certificate Policy OID if it exists, and WvString::null it if doesn't. | |
WvString | get_altsubject () |
Return the Subject alt name if it exists, and WvString::null if it doesn't. | |
virtual bool | isok () const |
Is this certificate Object valid, and in a non-error state. | |
virtual WvString | errstr () const |
virtual int | geterr () const |
If isok() is false, return the system error number corresponding to the error, -1 for a special error string (which you can obtain with errstr()) or 0 on end of file. | |
int | get () const |
WvString | str () const |
void | set (int _errnum) |
void | set (WvStringParm specialerr) |
void | set (WVSTRING_FORMAT_DECL) |
void | set (const WvErrorBase &err) |
void | reset () |
virtual void | seterr (int _errnum) |
Set the errnum variable -- we have an error. | |
void | seterr (WvStringParm specialerr) |
void | seterr (WVSTRING_FORMAT_DECL) |
void | seterr (const WvErrorBase &err) |
void | noerr () |
Reset our error state - there's no error condition anymore. | |
Protected Attributes | |
int | errnum |
WvString | errstring |
|
Type for the encode() and decode() methods. CertPEM = PEM Encoded X.509 Certificate RsaPEM = PEM Encoded RSA Private Key RsaPubPEM = PEM Encoded RSA Public Key RsaRaw = Raw form of RSA Key (unused by most programs, FreeS/WAN being the notable exception) |
|
Initialize a blank X509 Object with the certificate *cert (used for client side operations...). This either initializes a completely empty object, or takes _cert, and extracts the distinguished name into dname, and the the RSA public key into rsa. rsa->prv is empty. |
|
Constructor to create a self-signed certificate for the given dn and RSA key. If you don't already have a WvRSAKey, try the other constructor, below, which creates one automatically. For SSL Servers, the dname must contain a "cn=" section in order to validate correctly with some clients, particularly web browsers. For example, if your domain name is nit.ca, you can try this for _dname: "cn=nit.ca,o=Net Integration,c=CA", or maybe this instead: "cn=nit.ca,dc=nit,dc=ca" We don't check automatically that your _dname complies with these restrictions, since non-SSL certificates may be perfectly valid without this. If you want to generate invalid certs, that's up to you. |
|
Constructor to create a new self-signed certificate for the given dn and number of bits. See the previous constructor for details on how to choose _dname. 'bits' is the number of bits in the auto-generated RSA key; 1024 or 2048 are good values for this. |
|
Create a certificate request (PKCS#10) using this function.. this request is what you would send off to Verisign, or Entrust.net (or any other CA), to get your real certificate. It leaves the RSA key pair in rsa, where you MUST save it for the certificate to be AT ALL valid when you get it back. Returns a PEM Encoded PKCS#10 certificate request, and leaves the RSA keypair in rsa, and a self-signed temporary certificate in cert. It uses dname as the Distinguished name to create this Request. Make sure that it has what you want in it first. |
|
Test to make sure that a certificate and a keypair go together. called internally by unhexify() although you can call it if you want to test a certificate yourself. (Such as after a decode) |
|
Given the X509 certificate object cert, return a hexified string useful in a WvConf or UniConf file. I don't provide a similar function for that for the rsa key, because you can always call get_rsa().private_str() and get_rsa().public_str() for that information. |
|
Function to verify the validity of a certificate that has been placed in cert. It can check and make sure that it was signed by the CA certificate cacert, and is not in the CRL crl, but at the very least, it checks and makes sure that your certificate is not expired |
|
Check the certificate in cert against the CA certificate in certfile returns true if cert was signed by that CA certificate.
|
|
Check the certificate in cert against the CA certificate in cacert returns true if cert was signed by that CA certificate.
|
|
Verify that the contents of data were signed by the certificate currently in cert. This only checks the signature, it doesn't check the validity of the certificate. |
|
And of course, since PKCS12 files are in the rediculous DER encoding format, which is binary, we can't use the encode/decode functions, so we deal straight with files... *sigh* As should be obvious, this writes the certificate and RSA keys in PKCS12 format to the file specified by filename. |
|
If isok() is false, return the system error number corresponding to the error, -1 for a special error string (which you can obtain with errstr()) or 0 on end of file. If isok() is true, returns an undefined number. Reimplemented from WvErrorBase. |
|
Set the errnum variable -- we have an error. If called more than once, seterr() doesn't change the error code away from the previous one. That way, we remember the _original_ cause of our problems. Subclasses may want to override seterr(int) to shut themselves down (eg. WvStream::close()) when an error condition is set. Note that seterr(WvString) will call seterr(-1). |