# GnuTLS X.509 Support

**API Group:** `xmlsec_gnutls_x509`

X.509 certificate handling for the GnuTLS back-end.

X509 certificates verification support functions for GnuTLS.

X509 certificates support functions for GnuTLS.

X509 certificates implementation for GnuTLS. X509 certificates implementation for GnuTLS.

## Macros

### `xmlSecGnuTLSKeyDataX509Id`

*Defined as:* `xmlSecGnuTLSKeyDataX509GetKlass()`

*Source:* [include/xmlsec/gnutls/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/gnutls/x509.h#L33)

The GnuTLS X509 data klass.

---

### `xmlSecGnuTLSKeyDataRawX509CertId`

*Defined as:* `xmlSecGnuTLSKeyDataRawX509CertGetKlass()`

*Source:* [include/xmlsec/gnutls/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/gnutls/x509.h#L64)

The GnuTLS raw X509 certificate klass.

---

### `xmlSecGnuTLSX509StoreId`

*Defined as:* `xmlSecGnuTLSX509StoreGetKlass()`

*Source:* [include/xmlsec/gnutls/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/gnutls/x509.h#L76)

The GnuTLS X509 store klass.

---

## Functions

### `xmlSecGnuTLSKeyDataX509GetKlass`

```c
xmlSecKeyDataId xmlSecGnuTLSKeyDataX509GetKlass(void);
```

*Source:* [include/xmlsec/gnutls/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/gnutls/x509.h#L35)

The GnuTLS X509 key data klass.

The GnuTLS X509 key data klass ([http://www.w3.org/TR/xmldsig-core/#sec-X509Data](http://www.w3.org/TR/xmldsig-core/#sec-X509Data)). 

**Returns:** the X509 data klass.

---

### `xmlSecGnuTLSKeyDataX509GetKeyCert`

```c
gnutls_x509_crt_t xmlSecGnuTLSKeyDataX509GetKeyCert(xmlSecKeyDataPtr data);
```

*Source:* [include/xmlsec/gnutls/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/gnutls/x509.h#L38)

Gets the certificate from which the key was extracted.

**Parameters:**

- `data` — the pointer to X509 key data.


**Returns:** the key's certificate or NULL if key data was not used for key extraction or an error occurs.

---

### `xmlSecGnuTLSKeyDataX509AdoptKeyCert`

```c
int xmlSecGnuTLSKeyDataX509AdoptKeyCert(xmlSecKeyDataPtr data, gnutls_x509_crt_t cert);
```

*Source:* [include/xmlsec/gnutls/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/gnutls/x509.h#L39)

Adds certificate to the X509 key data and sets the it as the key's.

**Parameters:**

- `data` — the pointer to X509 key data.
- `cert` — the pointer to GnuTLS X509 certificate.
certificate in `data`. On success, the `data` owns the cert.

**Returns:** 0 on success or a negative value if an error occurs.

---

### `xmlSecGnuTLSKeyDataX509AdoptCert`

```c
int xmlSecGnuTLSKeyDataX509AdoptCert(xmlSecKeyDataPtr data, gnutls_x509_crt_t cert);
```

*Source:* [include/xmlsec/gnutls/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/gnutls/x509.h#L42)

Adds certificate to the X509 key data.

**Parameters:**

- `data` — the pointer to X509 key data.
- `cert` — the pointer to GnuTLS X509 certificate.


**Returns:** 0 on success or a negative value if an error occurs.

---

### `xmlSecGnuTLSKeyDataX509GetCert`

```c
gnutls_x509_crt_t xmlSecGnuTLSKeyDataX509GetCert(xmlSecKeyDataPtr data, xmlSecSize pos);
```

*Source:* [include/xmlsec/gnutls/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/gnutls/x509.h#L44)

Gets a certificate from X509 key data.

**Parameters:**

- `data` — the pointer to X509 key data.
- `pos` — the desired certificate position.


**Returns:** the pointer to certificate or NULL if `pos` is larger than the number of certificates in `data` or an error occurs.

---

### `xmlSecGnuTLSKeyDataX509GetCertsSize`

```c
xmlSecSize xmlSecGnuTLSKeyDataX509GetCertsSize(xmlSecKeyDataPtr data);
```

*Source:* [include/xmlsec/gnutls/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/gnutls/x509.h#L46)

Gets the number of certificates in `data`.

**Parameters:**

- `data` — the pointer to X509 key data.


**Returns:** te number of certificates in `data`.

---

### `xmlSecGnuTLSKeyDataX509AdoptCrl`

```c
int xmlSecGnuTLSKeyDataX509AdoptCrl(xmlSecKeyDataPtr data, gnutls_x509_crl_t crl);
```

*Source:* [include/xmlsec/gnutls/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/gnutls/x509.h#L48)

Adds crl to the X509 key data.

**Parameters:**

- `data` — the pointer to X509 key data.
- `crl` — the pointer to GnuTLS X509 crl.


**Returns:** 0 on success or a negative value if an error occurs.

---

### `xmlSecGnuTLSKeyDataX509GetCrl`

```c
gnutls_x509_crl_t xmlSecGnuTLSKeyDataX509GetCrl(xmlSecKeyDataPtr data, xmlSecSize pos);
```

*Source:* [include/xmlsec/gnutls/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/gnutls/x509.h#L50)

Gets a crl from X509 key data.

**Parameters:**

- `data` — the pointer to X509 key data.
- `pos` — the desired crl position.


**Returns:** the pointer to crl or NULL if `pos` is larger than the number of crls in `data` or an error occurs.

---

### `xmlSecGnuTLSKeyDataX509GetCrlsSize`

```c
xmlSecSize xmlSecGnuTLSKeyDataX509GetCrlsSize(xmlSecKeyDataPtr data);
```

*Source:* [include/xmlsec/gnutls/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/gnutls/x509.h#L52)

Gets the number of crls in `data`.

**Parameters:**

- `data` — the pointer to X509 key data.


**Returns:** te number of crls in `data`.

---

### `xmlSecGnuTLSX509CertGetKey`

```c
xmlSecKeyDataPtr xmlSecGnuTLSX509CertGetKey(gnutls_x509_crt_t cert);
```

*Source:* [include/xmlsec/gnutls/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/gnutls/x509.h#L54)

Extracts public key from the `cert`.

**Parameters:**

- `cert` — the certificate.


**Returns:** public key value or NULL if an error occurs.

---

### `xmlSecGnuTLSKeyDataRawX509CertGetKlass`

```c
xmlSecKeyDataId xmlSecGnuTLSKeyDataRawX509CertGetKlass(void);
```

*Source:* [include/xmlsec/gnutls/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/gnutls/x509.h#L66)

The raw X509 certificates key data klass.

**Returns:** raw X509 certificates key data klass.

---

### `xmlSecGnuTLSX509StoreGetKlass`

```c
xmlSecKeyDataStoreId xmlSecGnuTLSX509StoreGetKlass(void);
```

*Source:* [include/xmlsec/gnutls/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/gnutls/x509.h#L78)

The GnuTLS X509 certificates key data store klass.

**Returns:** pointer to GnuTLS X509 certificates key data store klass.

---

### `xmlSecGnuTLSX509StoreVerify`

```c
gnutls_x509_crt_t xmlSecGnuTLSX509StoreVerify(xmlSecKeyDataStorePtr store, xmlSecPtrListPtr certs, xmlSecPtrListPtr crls, const xmlSecKeyInfoCtx *keyInfoCtx);
```

*Source:* [include/xmlsec/gnutls/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/gnutls/x509.h#L80)

Verifies `certs` list.

**Parameters:**

- `store` — the pointer to X509 key data store klass.
- `certs` — the untrusted certificates.
- `crls` — the crls.
- `keyInfoCtx` — the pointer to <dsig:KeyInfo/> element processing context.


**Returns:** pointer to the first verified certificate from `certs`.

---

### `xmlSecGnuTLSX509StoreAdoptCert`

```c
int xmlSecGnuTLSX509StoreAdoptCert(xmlSecKeyDataStorePtr store, gnutls_x509_crt_t cert, xmlSecKeyDataType type);
```

*Source:* [include/xmlsec/gnutls/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/gnutls/x509.h#L84)

Adds cert to the trusted or untrusted store.

Adds trusted (root) or untrusted certificate to the store. 

**Parameters:**

- `store` — the pointer to X509 key data store klass.
- `cert` — the pointer to GnuTLS X509 certificate.
- `type` — the certificate type (trusted/untrusted).


**Returns:** 0 on success or a negative value if an error occurs.

---

### `xmlSecGnuTLSX509StoreVerifyCrl`

```c
int xmlSecGnuTLSX509StoreVerifyCrl(xmlSecKeyDataStorePtr store, gnutls_x509_crl_t crl, xmlSecKeyInfoCtxPtr keyInfoCtx);
```

*Source:* [include/xmlsec/gnutls/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/gnutls/x509.h#L87)

Verifies `crl` by checking:

**Parameters:**

- `store` — the pointer to X509 key data store klass.
- `crl` — the CRL to verify.
- `keyInfoCtx` — the key info context for verification parameters.


1. Signature is valid (signed by issuer cert in store)
2. thisUpdate <= verification_time <= nextUpdate

**Returns:** 1 if verified, 0 if not verified, or a negative value on error.

---

### `xmlSecGnuTLSX509StoreAdoptCrl`

```c
int xmlSecGnuTLSX509StoreAdoptCrl(xmlSecKeyDataStorePtr store, gnutls_x509_crl_t crl);
```

*Source:* [include/xmlsec/gnutls/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/gnutls/x509.h#L90)

Adds CRL to the store.

**Parameters:**

- `store` — the pointer to X509 key data store klass.
- `crl` — the pointer to GnuTLS X509 CRL.


**Returns:** 0 on success or a negative value if an error occurs.

---
