Estonian ID Card C-library
Loading...
Searching...
No Matches
DigiDocCert.h
1#ifndef __DIGI_DOC_CERT_H__
2#define __DIGI_DOC_CERT_H__
3//==================================================
4// FILE: DigiDocCert.h
5// PROJECT: Digi Doc
6// DESCRIPTION: Digi Doc functions for certificate handling
7// AUTHOR: Veiko Sinivee, S|E|B IT Partner Estonia
8//==================================================
9// Copyright (C) AS Sertifitseerimiskeskus
10// This library is free software; you can redistribute it and/or
11// modify it under the terms of the GNU Lesser General Public
12// License as published by the Free Software Foundation; either
13// version 2.1 of the License, or (at your option) any later version.
14// This library is distributed in the hope that it will be useful,
15// but WITHOUT ANY WARRANTY; without even the implied warranty of
16// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17// Lesser General Public License for more details.ode
18// GNU Lesser General Public Licence is available at
19// http://www.gnu.org/copyleft/lesser.html
20//==========< HISTORY >=============================
21//==================================================
22
23
24#ifdef __cplusplus
25extern "C" {
26#endif
27
28#include <openssl/evp.h>
29#include <openssl/objects.h>
30#include <openssl/x509.h>
31#include <openssl/x509v3.h>
32
33#include <libdigidoc/DigiDocDefs.h>
34#include <libdigidoc/DigiDocLib.h>
35
36// structure for reading certificate policies
37typedef struct PolicyIdentifier_st {
38 char* szOID; // stringified OID
39 char* szCPS; // CPS URL
40 char* szUserNotice; // user notice
42
43
44EXP_OPTION int ReadPrivateKey(EVP_PKEY **privKey, const char *keyfile, const char* passwd, int format);
45EXP_OPTION int WritePrivateKey(EVP_PKEY *privKey, const char *keyfile, const char* passwd, int format);
46int ReadPublicKey(EVP_PKEY **pkey, const char *certfile);
47int GetPublicKey(EVP_PKEY **pubKey, const X509* x509);
48
49//--------------------------------------------------
50// Writes a private key and cert to a PEM file
51// privKey - private key
52// pCert - certificate
53// keyfile - name of the private key file
54// passwd - key password (problems with encrypted passwwords!)
55//--------------------------------------------------
56EXP_OPTION int ddocWriteKeyAndCertPem(EVP_PKEY *privKey, X509* pCert,
57 const char *keyfile, const char* passwd);
58
59
60EXP_OPTION int ReadCertificate(X509 **x509, const char *certfile);
61EXP_OPTION int ReadCertificateNoErr(X509 **x509, const char *szCertfile);
62EXP_OPTION int ReadCertSerialNumber(char* szSerial, int nMaxLen, X509 *x509);
63EXP_OPTION int ReadCertificateByPKCS12(X509 **x509, const char *pkcs12file, const char *passwd, EVP_PKEY **pkey);
64
65// Decodes binary (DER) cert data and returns a cert object
66EXP_OPTION int ddocDecodeX509Data(X509 **ppX509, const byte* certData, int certLen);
67
68// Decodes base64 (PEM) cert data and returns a cert object
69EXP_OPTION int ddocDecodeX509PEMData(X509 **ppX509, const char* certData, int certLen);
70
71// get certificate PEM form
72EXP_OPTION int getCertPEM(X509* cert, int bHeaders, char** buf);
73
74
75// retrieves this certificates serial number
76EXP_OPTION int GetCertSerialNumber(char* szSerial, int nMaxLen, const char *szCertfile);
77// Returns the certificates validity first date
78EXP_OPTION int getCertNotBefore(const SignedDoc* pSigDoc, X509* cert, char* timestamp, int len);
79
80// Retrieves the certificates first validity time as tim_t in GMT zone
81EXP_OPTION time_t getCertNotBeforeTimeT(X509* pCert);
82// Retrieves the certificates last validity time as tim_t in GMT zone
83EXP_OPTION time_t getCertNotAfterTimeT(X509* pCert);
84
85// Returns the certificates validity last date
86EXP_OPTION int getCertNotAfter(const SignedDoc* pSigDoc, X509* cert, char* timestamp, int len);
87// Saves the certificate in a file
88EXP_OPTION int saveCert(X509* cert, const char* szFileName, int nFormat);
89// decodes PEM cert data
90EXP_OPTION void* decodeCert(const char* pemData);
91// encodes certificate
92EXP_OPTION void encodeCert(const X509* x509, char * encodedCert, int* encodedCertLen);
93
94// Reads certificates PolicyIdentifiers and returns
95// them in a newly allocated structure
96EXP_OPTION int readCertPolicies(X509* pX509, PolicyIdentifier** pPolicies, int* nPols);
97
98// Frees policy identifiers array
99EXP_OPTION void PolicyIdentifiers_free(PolicyIdentifier* pPolicies, int nPols);
100
101// Checks if this is a company CPS policy
102EXP_OPTION int isCompanyCPSPolicy(PolicyIdentifier* pPolicy);
103
104EXP_OPTION int isCertValid(X509* cert, time_t tDate);
105EXP_OPTION int isCertSignedBy(X509* cert, const char* cafile);
106int writeCertToXMLFile(BIO* bout, X509* cert);
107
108//--------------------------------------------------
109// Verifys a certificate by sending an OCSP_REQUEST object
110// to the notary server and checking the response.
111// Uses servers timestamps hash code as nonce value.
112// pCert - certificate to test
113// caCerts - responder CA certs chain
114// notaryCert - notarys cert search
115// proxyHost - proxy servers name
116// proxyPort - proxy servers port
117// notaryURL - notarys URL
118// ppResp - address to return OCSP response. Use NULL if
119// you don't want OCSP response to be returned
120// return 0 for OK, or error code
121//--------------------------------------------------
122EXP_OPTION int verifyCertificateByOCSP(X509* pCert, const X509** caCerts,
123 const X509* notaryCert, char* notaryURL,
124 char* proxyHost, char* proxyPort,
125 const char* pkcs12file, const char* pkcs12paswd,
126 OCSP_RESPONSE **ppResp);
127
128//--------------------------------------------------
129// Verifys a certificate by sending an OCSP_REQUEST object
130// to the notary server and checking the response.
131// Uses servers timestamps hash code as nonce value.
132// pCert - certificate to test
133// caCerts - responder CA certs chain
134// notaryCert - notarys cert search
135// proxyHost - proxy servers name
136// proxyPort - proxy servers port
137// notaryURL - notarys URL
138// ppResp - address to return OCSP response. Use NULL if
139// you don't want OCSP response to be returned
140// return 0 for OK, or error code
141//--------------------------------------------------
142EXP_OPTION int verifyCertificateByOCSPWithIp(X509* pCert, const X509** caCerts,
143 const X509* notaryCert, char* notaryURL,
144 char* proxyHost, char* proxyPort,
145 const char* pkcs12file, const char* pkcs12paswd,
146 OCSP_RESPONSE **ppResp, unsigned long ip);
147
148 //--------------------------------------------------
149 // Returns the certificates sha1 hash.
150 // pCert - certificate data
151 // pMemBuf - memory buffer object for storing DN
152 // returns error code or ERR_OK
153 //--------------------------------------------------
154 int ddocCertGetDigest(X509* pCert, DigiDocMemBuf* pMemBuf);
155
156 //--------------------------------------------------
157 // Returns the certificates public key sha1 hash.
158 // pCert - certificate data
159 // pMemBuf - memory buffer object for storing DN
160 // returns error code or ERR_OK
161 //--------------------------------------------------
162 int ddocCertGetPubkeyDigest(X509* pCert, DigiDocMemBuf* pMemBuf);
163
164 //--------------------------------------------------
165 // Returns the certificates issuer name.
166 // pCert - certificate data
167 // pMemBuf - memory buffer object for storing DN
168 // returns error code or ERR_OK
169 //--------------------------------------------------
170 EXP_OPTION int ddocCertGetIssuerDN(X509* pCert, DigiDocMemBuf* pMemBuf);
171
172 //--------------------------------------------------
173 // Returns the certificates subject name.
174 // pCert - certificate data
175 // pMemBuf - memory buffer object for storing DN
176 // returns error code or ERR_OK
177 //--------------------------------------------------
178 EXP_OPTION int ddocCertGetSubjectDN(X509* pCert, DigiDocMemBuf* pMemBuf);
179
180 //--------------------------------------------------
181 // Returns the certificates subject name sha1 hash.
182 // pCert - certificate data
183 // pMemBuf - memory buffer object for storing DN
184 // returns error code or ERR_OK
185 //--------------------------------------------------
186 int ddocCertGetSubjectNameDigest(X509* pCert, DigiDocMemBuf* pMemBuf);
187
188 //--------------------------------------------------
189 // Returns the certificates issuer name sha1 hash.
190 // pCert - certificate data
191 // pMemBuf - memory buffer object for storing DN
192 // returns error code or ERR_OK
193 //--------------------------------------------------
194 int ddocCertGetIssuerNameDigest(X509* pCert, DigiDocMemBuf* pMemBuf);
195
196 //--------------------------------------------------
197 // Returns the certificates DN.
198 // Do not call directly, subject to change
199 // pName - certificate X509 name
200 // pMemBuf - memory buffer object for storing DN
201 // bIssuer - 1=issuer, 0=subject
202 // returns error code or ERR_OK
203 //--------------------------------------------------
204 EXP_OPTION int ddocCertGetDNFromName(X509_NAME* pName, DigiDocMemBuf* pMemBuf);
205
206#define KUIDX_DIGITAL_SIGNATURE 0
207#define KUIDX_NON_REPUDIATION 1
208#define KUIDX_KEY_ENCIPHERMENT 2
209#define KUIDX_DATA_ENCIPHERMENT 3
210#define KUIDX_KEY_AGREEMENT 4
211#define KUIDX_KEY_CERT_SIGN 5
212#define KUIDX_CRL_SIGN 6
213#define KUIDX_ENCIPHERMENT_ONLY 7
214#define KUIDX_DECIPHERMENT_ONLY 8
215
216#define NID_firstName 99
217#define NID_lastName 100
218#define NID_perCode 105
219#define NID_countryName 14
220#define NID_serialNumber 105
221#define NID_organization 17
222#define NID_organizationUnit 18
223#define NID_commonName 13
224#define NID_emailAddress 48
225
226
227 //--------------------------------------------------------
228 // Checks if the desired key-usage bit is set on a given cert
229 // pCert - certificate
230 // nBit - flag index
231 // return 1 if bit is set
232 //--------------------------------------------------------
233 EXP_OPTION int ddocCertCheckKeyUsage(X509 *pCert, int nBit);
234
235 //--------------------------------------------------
236 // Returns the certificates subject CN
237 // pCert - certificate data
238 // pMemBuf - memory buffer object for storing result
239 // returns error code or ERR_OK
240 //--------------------------------------------------
241 EXP_OPTION int ddocCertGetSubjectCN(X509* pCert, DigiDocMemBuf* pMemBuf);
242
243 //--------------------------------------------------
244 // Returns the certificates issuer CN
245 // pCert - certificate data
246 // pMemBuf - memory buffer object for storing result
247 // returns error code or ERR_OK
248 //--------------------------------------------------
249 EXP_OPTION int ddocCertGetIssuerCN(X509* pCert, DigiDocMemBuf* pMemBuf);
250
251 //--------------------------------------------------
252 // Returns the certificates subject first name
253 // pCert - certificate data
254 // pMemBuf - memory buffer object for storing result
255 // returns error code or ERR_OK
256 //--------------------------------------------------
257 EXP_OPTION int ddocCertGetSubjectFirstName(X509* pCert, DigiDocMemBuf* pMemBuf);
258
259 //--------------------------------------------------
260 // Returns the certificates subject last name
261 // pCert - certificate data
262 // pMemBuf - memory buffer object for storing result
263 // returns error code or ERR_OK
264 //--------------------------------------------------
265 EXP_OPTION int ddocCertGetSubjectLastName(X509* pCert, DigiDocMemBuf* pMemBuf);
266
267 //--------------------------------------------------
268 // Returns the certificates subject personal code
269 // pCert - certificate data
270 // pMemBuf - memory buffer object for storing result
271 // returns error code or ERR_OK
272 //--------------------------------------------------
273 EXP_OPTION int ddocCertGetSubjectPerCode(X509* pCert, DigiDocMemBuf* pMemBuf);
274
275 //--------------------------------------------------
276 // Returns the certificates subject country code
277 // pCert - certificate data
278 // pMemBuf - memory buffer object for storing result
279 // returns error code or ERR_OK
280 //--------------------------------------------------
281 EXP_OPTION int ddocCertGetSubjectCountryName(X509* pCert, DigiDocMemBuf* pMemBuf);
282
283 //--------------------------------------------------
284 // Returns the certificates subject organization
285 // pCert - certificate data
286 // pMemBuf - memory buffer object for storing result
287 // returns error code or ERR_OK
288 //--------------------------------------------------
289 EXP_OPTION int ddocCertGetSubjectOrganization(X509* pCert, DigiDocMemBuf* pMemBuf);
290
291 //--------------------------------------------------
292 // Returns the certificates subject organization unit
293 // pCert - certificate data
294 // pMemBuf - memory buffer object for storing result
295 // returns error code or ERR_OK
296 //--------------------------------------------------
297 EXP_OPTION int ddocCertGetSubjectOrganizationUnit(X509* pCert, DigiDocMemBuf* pMemBuf);
298
299 //--------------------------------------------------
300 // Reads certificates authority key identifier
301 // pCert - certificate
302 // pMemBuf - memory buffer to return data
303 //--------------------------------------------------
304 EXP_OPTION int readAuthorityKeyIdentifier(X509* pCert, DigiDocMemBuf* pMemBuf);
305
306 //--------------------------------------------------
307 // Reads certificates subject key identifier
308 // pCert - certificate
309 // pMemBuf - memory buffer to return data
310 //--------------------------------------------------
311 EXP_OPTION int readSubjectKeyIdentifier(X509* pCert, DigiDocMemBuf* pMemBuf);
312
313 EXP_OPTION int ddocCertGetDNPart(X509* pCert, DigiDocMemBuf* pMemBuf, int nNid, int bIssuer);
314
315 EXP_OPTION int ddocCertGetDN(X509* pCert, DigiDocMemBuf* pMemBuf, int bIssuer);
316
317//================< deprecated functions> =================================
318// these functions are deprecated. Use the replacements in DigiDocCert.h
319// these functions will be removed in future releases!
320#ifdef WITH_DEPRECATED_FUNCTIONS
321
322// decodes cert data - deprecated!
323// USE ddocDecodeX509PEMData() instead!
324EXP_OPTION int decodeCertificateData(X509 **newX509, const byte* certData, int certLen);
325
326// Returns the certificates issuer name
327// USE: ddocCertGetIssuerDN()
328EXP_OPTION int getCertIssuerName(X509* cert, char* buf, int* buflen);
329
330// Returns the certificates subject name
331// USE: ddocCertGetSubjectDN()
332EXP_OPTION int getCertSubjectName(X509* cert, char* buf, int* buflen);
333
334
335// reads cert issuers CN
336// USE: ddocCertGetIssuerCN()
337EXP_OPTION int getCertIssuerCN(X509* cert, char* buf, int* buflen, int bUTF8);
338
339// Returns the certificates subjects DN
340// USE: ddocCertGetSubjectDN()
341EXP_OPTION int getCertSubjectDN(X509* cert, char* buf, int* buflen, int bUTF8);
342
343// reads cert subjects CN
344// USE: ddocCertGetSubjectCN()
345EXP_OPTION int getCertSubjectCN(X509* cert, char* buf, int* buflen, int bUTF8);
346
347// get certificate owners id-code
348// USE: ddocCertGetSubjectPerCode()
349EXP_OPTION int getCertOwnerCode(const X509* pCert, char* buf, int len);
350
351//--------------------------------------------------
352// Returns the desired item from string rep of DN
353// sDn - certificate DN
354// sId - searched DN part
355// pMBuf - memory buffer object for storing result
356// returns error code or ERR_OK
357//--------------------------------------------------
358EXP_OPTION int ddocGetDNPartFromString(const char* sDn, const char* sId, DigiDocMemBuf* pMBuf);
359
360#endif // WITH_DEPRECATED_FUNCTIONS
361
362#ifdef __cplusplus
363}
364#endif
365
366
367#endif // __DIGI_DOC_CERT_H__
368
Definition DigiDocMem.h:32
Definition DigiDocCert.h:37
Definition DigiDocObj.h:177