# NSS X.509 Support

**API Group:** `xmlsec_nss_x509`

X.509 certificate handling for the NSS back-end.

X509 certificates verification support functions for NSS.

X509 certificates implementation for NSS. X509 certificates implementation for NSS.

## Macros

### `xmlSecNssKeyDataX509Id`

*Defined as:* `xmlSecNssKeyDataX509GetKlass()`

*Source:* [include/xmlsec/nss/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/nss/x509.h#L29)

The NSS X509 data klass.

---

### `xmlSecNssKeyDataRawX509CertId`

*Defined as:* `xmlSecNssKeyDataRawX509CertGetKlass()`

*Source:* [include/xmlsec/nss/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/nss/x509.h#L54)

The NSS raw X509 certificate klass.

---

### `xmlSecNssX509StoreId`

*Defined as:* `xmlSecNssX509StoreGetKlass()`

*Source:* [include/xmlsec/nss/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/nss/x509.h#L61)

The NSS X509 store klass.

---

## Functions

### `xmlSecNssKeyDataX509GetKlass`

```c
xmlSecKeyDataId xmlSecNssKeyDataX509GetKlass(void);
```

*Source:* [include/xmlsec/nss/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/nss/x509.h#L31)

The NSS X509 key data klass.

The NSS X509 key data klass ([http://www.w3.org/TR/xmldsig-core/#sec-X509Data](http://www.w3.org/TR/xmldsig-core/#sec-X509Data)). 

**Returns:** the X509 data klass.

---

### `xmlSecNssKeyDataX509GetKeyCert`

```c
CERTCertificate * xmlSecNssKeyDataX509GetKeyCert(xmlSecKeyDataPtr data);
```

*Source:* [include/xmlsec/nss/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/nss/x509.h#L33)

Gets the certificate from which the key was extracted.

**Parameters:**

- `data` — the pointer to X509 key data.


**Returns:** the key's certificate or NULL if key data was not used for key extraction or an error occurs.

---

### `xmlSecNssKeyDataX509AdoptKeyCert`

```c
int xmlSecNssKeyDataX509AdoptKeyCert(xmlSecKeyDataPtr data, CERTCertificate *cert);
```

*Source:* [include/xmlsec/nss/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/nss/x509.h#L34)

Adds certificate to the X509 key data and sets the it as the key's.

**Parameters:**

- `data` — the pointer to X509 key data.
- `cert` — the pointer to NSS X509 certificate.
certificate in `data`. On success, the `data` owns the cert.

**Returns:** 0 on success or a negative value if an error occurs.

---

### `xmlSecNssKeyDataX509AdoptCert`

```c
int xmlSecNssKeyDataX509AdoptCert(xmlSecKeyDataPtr data, CERTCertificate *cert);
```

*Source:* [include/xmlsec/nss/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/nss/x509.h#L37)

Adds certificate to the X509 key data.

**Parameters:**

- `data` — the pointer to X509 key data.
- `cert` — the pointer to NSS X509 certificate.


**Returns:** 0 on success or a negative value if an error occurs.

---

### `xmlSecNssKeyDataX509GetCert`

```c
CERTCertificate * xmlSecNssKeyDataX509GetCert(xmlSecKeyDataPtr data, xmlSecSize pos);
```

*Source:* [include/xmlsec/nss/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/nss/x509.h#L39)

Gets a certificate from X509 key data.

**Parameters:**

- `data` — the pointer to X509 key data.
- `pos` — the desired certificate position.


**Returns:** the pointer to certificate or NULL if `pos` is larger than the number of certificates in `data` or an error occurs.

---

### `xmlSecNssKeyDataX509GetCertsSize`

```c
xmlSecSize xmlSecNssKeyDataX509GetCertsSize(xmlSecKeyDataPtr data);
```

*Source:* [include/xmlsec/nss/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/nss/x509.h#L41)

Gets the number of certificates in `data`.

**Parameters:**

- `data` — the pointer to X509 key data.


**Returns:** te number of certificates in `data`.

---

### `xmlSecNssKeyDataX509AdoptCrl`

```c
int xmlSecNssKeyDataX509AdoptCrl(xmlSecKeyDataPtr data, CERTSignedCrl *crl);
```

*Source:* [include/xmlsec/nss/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/nss/x509.h#L43)

Adds CRL to the X509 key data.

**Parameters:**

- `data` — the pointer to X509 key data.
- `crl` — the pointer to NSS X509 CRL.


**Returns:** 0 on success or a negative value if an error occurs.

---

### `xmlSecNssKeyDataX509GetCrl`

```c
CERTSignedCrl * xmlSecNssKeyDataX509GetCrl(xmlSecKeyDataPtr data, xmlSecSize pos);
```

*Source:* [include/xmlsec/nss/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/nss/x509.h#L45)

Gets a CRL from X509 key data.

**Parameters:**

- `data` — the pointer to X509 key data.
- `pos` — the desired CRL position.


**Returns:** the pointer to CRL or NULL if `pos` is larger than the number of CRLs in `data` or an error occurs.

---

### `xmlSecNssKeyDataX509GetCrlsSize`

```c
xmlSecSize xmlSecNssKeyDataX509GetCrlsSize(xmlSecKeyDataPtr data);
```

*Source:* [include/xmlsec/nss/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/nss/x509.h#L47)

Gets the number of CRLs in `data`.

**Parameters:**

- `data` — the pointer to X509 key data.


**Returns:** te number of CRLs in `data`.

---

### `xmlSecNssX509CertGetKey`

```c
xmlSecKeyDataPtr xmlSecNssX509CertGetKey(CERTCertificate *cert);
```

*Source:* [include/xmlsec/nss/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/nss/x509.h#L48)

Extracts public key from the `cert`.

**Parameters:**

- `cert` — the certificate.


**Returns:** public key value or NULL if an error occurs.

---

### `xmlSecNssKeyDataRawX509CertGetKlass`

```c
xmlSecKeyDataId xmlSecNssKeyDataRawX509CertGetKlass(void);
```

*Source:* [include/xmlsec/nss/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/nss/x509.h#L56)

The raw X509 certificates key data klass.

**Returns:** raw X509 certificates key data klass.

---

### `xmlSecNssX509StoreGetKlass`

```c
xmlSecKeyDataStoreId xmlSecNssX509StoreGetKlass(void);
```

*Source:* [include/xmlsec/nss/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/nss/x509.h#L63)

The NSS X509 certificates key data store klass.

**Returns:** pointer to NSS X509 certificates key data store klass.

---

### `xmlSecNssX509StoreVerify`

```c
CERTCertificate * xmlSecNssX509StoreVerify(xmlSecKeyDataStorePtr store, CERTCertList *certs, xmlSecKeyInfoCtx *keyInfoCtx);
```

*Source:* [include/xmlsec/nss/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/nss/x509.h#L66)

Verifies `certs` list.

**Parameters:**

- `store` — the pointer to X509 key data store klass.
- `certs` — the untrusted certificates stack.
- `keyInfoCtx` — the pointer to <dsig:KeyInfo/> element processing context.


**Returns:** pointer to the first verified certificate from `certs`.

---

### `xmlSecNssX509StoreAdoptCert`

```c
int xmlSecNssX509StoreAdoptCert(xmlSecKeyDataStorePtr store, CERTCertificate *cert, xmlSecKeyDataType type);
```

*Source:* [include/xmlsec/nss/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/nss/x509.h#L69)

Adds cert to the trusted or untrusted store.

Adds trusted (root) or untrusted certificate to the store. 

**Parameters:**

- `store` — the pointer to X509 key data store klass.
- `cert` — the pointer to NSS X509 certificate.
- `type` — the certificate type (trusted/untrusted).


**Returns:** 0 on success or a negative value if an error occurs.

---

### `xmlSecNssX509StoreAdoptCrl`

```c
int xmlSecNssX509StoreAdoptCrl(xmlSecKeyDataStorePtr store, CERTSignedCrl *crl);
```

*Source:* [include/xmlsec/nss/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/nss/x509.h#L72)

Adds CRL to the store.

**Parameters:**

- `store` — the pointer to X509 key data store klass.
- `crl` — the pointer to NSS X509 CRL.


**Returns:** 0 on success or a negative value if an error occurs.

---

### `xmlSecNssX509StoreFindCert`

```c
CERTCertificate * xmlSecNssX509StoreFindCert(xmlSecKeyDataStorePtr store, xmlChar *subjectName, xmlChar *issuerName, xmlChar *issuerSerial, xmlChar *ski, xmlSecKeyInfoCtx *keyInfoCtx);
```

*Source:* [include/xmlsec/nss/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/nss/x509.h#L81)

Searches `store` for a certificate that matches given criteria.

**Parameters:**

- `store` — the pointer to X509 key data store klass.
- `subjectName` — the desired certificate name.
- `issuerName` — the desired certificate issuer name.
- `issuerSerial` — the desired certificate issuer serial number.
- `ski` — the desired certificate SKI.
- `keyInfoCtx` — the pointer to <dsig:KeyInfo/> element processing context.


**Returns:** pointer to found certificate or NULL if certificate is not found or an error occurs.

---

### `xmlSecNssX509StoreFindCert_ex`

```c
CERTCertificate * xmlSecNssX509StoreFindCert_ex(xmlSecKeyDataStorePtr store, xmlChar *subjectName, xmlChar *issuerName, xmlChar *issuerSerial, xmlSecByte *ski, xmlSecSize skiSize, xmlSecKeyInfoCtx *keyInfoCtx);
```

*Source:* [include/xmlsec/nss/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/nss/x509.h#L87)

Deprecated. Searches `store` for a certificate that matches given criteria.

**Parameters:**

- `store` — the pointer to X509 key data store klass.
- `subjectName` — the desired certificate name.
- `issuerName` — the desired certificate issuer name.
- `issuerSerial` — the desired certificate issuer serial number.
- `ski` — the desired certificate SKI.
- `skiSize` — the desired certificate SKI size.
- `keyInfoCtx` — the pointer to <dsig:KeyInfo/> element processing context.


**Returns:** pointer to found certificate or NULL if certificate is not found or an error occurs.

---
