Data.X509

A Signed Certificate

A Signed CRL

X.509 Certificate type.

This type doesn't include the signature, it's describe in the RFC as tbsCertificate.

Public key types known and used in X.509

Elliptic Curve Public Key

TODO: missing support for binary curve.

Serialized Elliptic Curve Point

Private key types known and used in X.509

Elliptic Curve Private Key

TODO: missing support for binary curve.

Convert a Public key to the Public Key Algorithm type

Convert a Private key to the Public Key Algorithm type

Hash Algorithm

Public Key Algorithm

Signature Algorithm, often composed of a public key algorithm and a hash algorithm. For some signature algorithms the hash algorithm is intrinsic to the public key algorithm and is not needed in the data type.

Extension class.

each extension have a unique OID associated, and a way to encode and decode an ASN1 stream.

Errata: turns out, the content is not necessarily ASN1, it could be data that is only parsable by the extension e.g. raw ascii string. Add method to parse and encode with ByteString

Basic Constraints

Describe key usage

key usage flag that is found in the key usage extension field.

Extended key usage extension

Key usage purposes for the ExtendedKeyUsage extension

Provide a way to identify a public key by a short hash.

Provide a way to supply alternate name that can be used for matching host name.

Provide a mean to identify the public key corresponding to the private key used to signed a certificate.

Identify how CRL information is obtained

Different naming scheme use by the extension.

Not all name types are available, missing: otherName x400Address directoryName ediPartyName registeredID

Distribution point as either some GeneralNames or a DN

Reason flag for the CRL

Get a specific extension from a lists of raw extensions

Get a specific extension from a lists of raw extensions

Try to decode an ExtensionRaw.

If this function return: * Nothing, the OID doesn't match * Just Left, the OID matched, but the extension couldn't be decoded * Just Right, the OID matched, and the extension has been succesfully decoded

Encode an Extension to extensionRaw

An undecoded extension

a Set of ExtensionRaw

Describe a Certificate revocation list

Describe a revoked certificate identifiable by serial number.

A list of OID and strings.

Elements commonly available in a DistinguishedName structure

ASN1 Character String with encoding

Try to get a specific element in a DistinguishedName structure

A chain of X.509 certificates in exact form.

Represent a chain of X.509 certificates in bytestring form.

Decode a CertificateChainRaw into a CertificateChain if every raw certificate are decoded correctly, otherwise return the index of the failed certificate and the error associated.

Convert a CertificateChain into a CertificateChainRaw

Represent a signed object using a traditional X509 structure.

When dealing with external certificate, use the SignedExact structure not this one.

Represent the signed object plus the raw data that we need to keep around for non compliant case to be able to verify signature.

get the decoded Signed data

Get the signed data for the signature

Transform an object into a SignedExact object

A generalization of objectToSignedExact where the signature function runs in an arbitrary functor. This allows for example to sign using an algorithm needing random values.

The raw representation of the whole signed structure

Try to parse a bytestring that use the typical X509 signed structure format

Get the Certificate associated to a SignedCertificate

Get the CRL associated to a SignedCRL

Try to decode a bytestring to a SignedCertificate

Try to decode a bytestring to a SignedCRL

Make an OpenSSL style hash of distinguished name

OpenSSL algorithm is odd, and has been replicated here somewhat. only lower the case of ascii character.

Create an openssl style old hash of distinguished name