# OpenSSL X.509 Support

**API Group:** `xmlsec_openssl_x509`

X.509 certificate handling for the OpenSSL back-end.

X509 certificates verification support functions for OpenSSL.

X509 certificates implementation for OpenSSL.

X509 key data implementation.

## Macros

### `XMLSEC_STACK_OF_X509`

*Defined as:* `STACK_OF(X509)`

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L27)

Macro. To make docbook happy.

---

### `XMLSEC_STACK_OF_X509_CRL`

*Defined as:* `STACK_OF(X509_CRL)`

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L32)

Macro. To make docbook happy.

---

### `xmlSecOpenSSLKeyDataX509Id`

*Defined as:* `xmlSecOpenSSLKeyDataX509GetKlass()`

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L37)

The OpenSSL X509 data klass.

---

### `xmlSecOpenSSLKeyDataRawX509CertId`

*Defined as:* `xmlSecOpenSSLKeyDataRawX509CertGetKlass()`

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L63)

The OpenSSL raw X509 certificate klass.

---

### `xmlSecOpenSSLX509StoreId`

*Defined as:* `xmlSecOpenSSLX509StoreGetKlass()`

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L70)

The OpenSSL X509 store klass.

---

## Functions

### `xmlSecOpenSSLKeyDataX509GetKlass`

```c
xmlSecKeyDataId xmlSecOpenSSLKeyDataX509GetKlass(void);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L39)

The OpenSSL X509 key data klass.

The OpenSSL X509 key data klass ([http://www.w3.org/TR/xmldsig-core/#sec-X509Data](http://www.w3.org/TR/xmldsig-core/#sec-X509Data)). 

**Returns:** the X509 data klass.

---

### `xmlSecOpenSSLKeyDataX509GetKeyCert`

```c
X509 * xmlSecOpenSSLKeyDataX509GetKeyCert(xmlSecKeyDataPtr data);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L41)

Gets the certificate from which the key was extracted.

**Parameters:**

- `data` — the pointer to X509 key data.


**Returns:** the key's certificate or NULL if key data was not used for key extraction or an error occurs.

---

### `xmlSecOpenSSLKeyDataX509AdoptKeyCert`

```c
int xmlSecOpenSSLKeyDataX509AdoptKeyCert(xmlSecKeyDataPtr data, X509 *cert);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L42)

Adds certificate to the X509 key data and sets the it as the key's.

**Parameters:**

- `data` — the pointer to X509 key data.
- `cert` — the pointer to OpenSSL X509 certificate.
certificate in `data`. On success, the `data` owns the cert. This function DOES NOT check if the key matches the key cert (use `xmlSecOpenSSLAppKeyCertLoadBIO` that performs this check).

**Returns:** 0 on success or a negative value if an error occurs.

---

### `xmlSecOpenSSLKeyDataX509AdoptCert`

```c
int xmlSecOpenSSLKeyDataX509AdoptCert(xmlSecKeyDataPtr data, X509 *cert);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L45)

Adds certificate to the X509 key data.

Adds certificate to the X509 key data. On success, the `data` owns the cert. 

**Parameters:**

- `data` — the pointer to X509 key data.
- `cert` — the pointer to OpenSSL X509 certificate.


**Returns:** 0 on success or a negative value if an error occurs.

---

### `xmlSecOpenSSLKeyDataX509GetCert`

```c
X509 * xmlSecOpenSSLKeyDataX509GetCert(xmlSecKeyDataPtr data, xmlSecSize pos);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L47)

Gets a certificate from X509 key data.

**Parameters:**

- `data` — the pointer to X509 key data.
- `pos` — the desired certificate position.


**Returns:** the pointer to certificate or NULL if `pos` is larger than the number of certificates in `data` or an error occurs.

---

### `xmlSecOpenSSLKeyDataX509GetCertsSize`

```c
xmlSecSize xmlSecOpenSSLKeyDataX509GetCertsSize(xmlSecKeyDataPtr data);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L49)

Gets the number of certificates in `data`.

**Parameters:**

- `data` — the pointer to X509 key data.


**Returns:** te number of certificates in `data`.

---

### `xmlSecOpenSSLKeyDataX509AdoptCrl`

```c
int xmlSecOpenSSLKeyDataX509AdoptCrl(xmlSecKeyDataPtr data, X509_CRL *crl);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L51)

Adds CRL to the X509 key data.

**Parameters:**

- `data` — the pointer to X509 key data.
- `crl` — the pointer to OpenSSL X509 CRL.


**Returns:** 0 on success or a negative value if an error occurs.

---

### `xmlSecOpenSSLKeyDataX509GetCrl`

```c
X509_CRL * xmlSecOpenSSLKeyDataX509GetCrl(xmlSecKeyDataPtr data, xmlSecSize pos);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L53)

Gets a CRL from X509 key data.

**Parameters:**

- `data` — the pointer to X509 key data.
- `pos` — the desired CRL position.


**Returns:** the pointer to CRL or NULL if `pos` is larger than the number of CRLs in `data` or an error occurs.

---

### `xmlSecOpenSSLKeyDataX509GetCrlsSize`

```c
xmlSecSize xmlSecOpenSSLKeyDataX509GetCrlsSize(xmlSecKeyDataPtr data);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L55)

Gets the number of CRLs in `data`.

**Parameters:**

- `data` — the pointer to X509 key data.


**Returns:** te number of CRLs in `data`.

---

### `xmlSecOpenSSLX509CertGetKey`

```c
xmlSecKeyDataPtr xmlSecOpenSSLX509CertGetKey(X509 *cert);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L57)

Extracts public key from the `cert`.

**Parameters:**

- `cert` — the certificate.


**Returns:** public key value or NULL if an error occurs.

---

### `xmlSecOpenSSLKeyDataRawX509CertGetKlass`

```c
xmlSecKeyDataId xmlSecOpenSSLKeyDataRawX509CertGetKlass(void);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L65)

The raw X509 certificates key data klass.

**Returns:** raw X509 certificates key data klass.

---

### `xmlSecOpenSSLX509StoreGetKlass`

```c
xmlSecKeyDataStoreId xmlSecOpenSSLX509StoreGetKlass(void);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L73)

The OpenSSL X509 certificates key data store klass.

**Returns:** the store klass.

---

### `xmlSecOpenSSLX509StoreVerify`

```c
X509 * xmlSecOpenSSLX509StoreVerify(xmlSecKeyDataStorePtr store, STACK_OF(X509) *certs, STACK_OF(X509_CRL) *crls, xmlSecKeyInfoCtx *keyInfoCtx);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L74)

Verifies `certs` list.

**Parameters:**

- `store` — the pointer to X509 key data store klass.
- `certs` — the untrusted certificates stack.
- `crls` — the crls stack.
- `keyInfoCtx` — the pointer to <dsig:KeyInfo/> element processing context.


**Returns:** pointer to the first verified certificate from `certs`.

---

### `xmlSecOpenSSLX509StoreVerifyKey`

```c
int xmlSecOpenSSLX509StoreVerifyKey(xmlSecKeyDataStorePtr store, xmlSecKeyPtr key, xmlSecKeyInfoCtxPtr keyInfoCtx);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L78)

Verifies `key` with the keys manager `mngr` created with `xmlSecCryptoAppDefaultKeysMngrInit`.

**Parameters:**

- `store` — the pointer to X509 key data store klass.
- `key` — the pointer to key.
- `keyInfoCtx` — the key info context for verification.
function:

- Checks that key certificate is present
- Checks that key certificate is valid

Adds `key` to the keys manager `mngr` created with `xmlSecCryptoAppDefaultKeysMngrInit` function.

**Returns:** 1 if key is verified, 0 otherwise, or a negative value if an error occurs.

---

### `xmlSecOpenSSLX509StoreVerifyCrl`

```c
int xmlSecOpenSSLX509StoreVerifyCrl(xmlSecKeyDataStorePtr store, X509_CRL *crl, xmlSecKeyInfoCtxPtr keyInfoCtx);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L81)

Verifies `crl` by checking:

**Parameters:**

- `store` — the pointer to X509 key data store klass.
- `crl` — the CRL to verify.
- `keyInfoCtx` — the key info context for verification parameters.


1. Signature is valid (signed by issuer cert in store)
2. thisUpdate <= verification_time <= nextUpdate

**Returns:** 1 if verified, 0 if not verified, or a negative value on error.

---

### `xmlSecOpenSSLX509StoreAdoptCert`

```c
int xmlSecOpenSSLX509StoreAdoptCert(xmlSecKeyDataStorePtr store, X509 *cert, xmlSecKeyDataType type);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L84)

Adds cert to the trusted or untrusted store.

Adds trusted (root) or untrusted certificate to the store. 

**Parameters:**

- `store` — the pointer to X509 key data store klass.
- `cert` — the pointer to OpenSSL X509 certificate.
- `type` — the certificate type (trusted/untrusted).


**Returns:** 0 on success or a negative value if an error occurs.

---

### `xmlSecOpenSSLX509StoreAdoptCrl`

```c
int xmlSecOpenSSLX509StoreAdoptCrl(xmlSecKeyDataStorePtr store, X509_CRL *crl);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L87)

Adds X509 CRL to the store.

**Parameters:**

- `store` — the pointer to X509 key data store klass.
- `crl` — the pointer to OpenSSL X509_CRL.


**Returns:** 0 on success or a negative value if an error occurs.

---

### `xmlSecOpenSSLX509StoreAddCertsPath`

```c
int xmlSecOpenSSLX509StoreAddCertsPath(xmlSecKeyDataStorePtr store, const char *path);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L89)

Adds all certs in the `path` to the list of trusted certs.

**Parameters:**

- `store` — the pointer to OpenSSL x509 store.
- `path` — the path to the certs dir.
in `store`.

**Returns:** 0 on success or a negative value otherwise.

---

### `xmlSecOpenSSLX509StoreAddCertsFile`

```c
int xmlSecOpenSSLX509StoreAddCertsFile(xmlSecKeyDataStorePtr store, const char *filename);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L91)

Adds all certs in the file to the list of trusted certs.

**Parameters:**

- `store` — the pointer to OpenSSL x509 store.
- `filename` — the certs file.
in `store`. It is possible for the file to contain multiple certs.

**Returns:** 0 on success or a negative value otherwise.

---

### `xmlSecOpenSSLX509StoreFindCert`

```c
X509 * xmlSecOpenSSLX509StoreFindCert(xmlSecKeyDataStorePtr store, xmlChar *subjectName, xmlChar *issuerName, xmlChar *issuerSerial, xmlChar *ski, xmlSecKeyInfoCtx *keyInfoCtx);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L99)

Deprecated. Searches `store` for a certificate that matches given criteria.

**Parameters:**

- `store` — the pointer to X509 key data store klass.
- `subjectName` — the desired certificate name.
- `issuerName` — the desired certificate issuer name.
- `issuerSerial` — the desired certificate issuer serial number.
- `ski` — the desired certificate SKI.
- `keyInfoCtx` — the pointer to <dsig:KeyInfo/> element processing context.


**Returns:** pointer to found certificate or NULL if certificate is not found or an error occurs.

---

### `xmlSecOpenSSLX509StoreFindCert_ex`

```c
X509 * xmlSecOpenSSLX509StoreFindCert_ex(xmlSecKeyDataStorePtr store, xmlChar *subjectName, xmlChar *issuerName, xmlChar *issuerSerial, xmlSecByte *ski, xmlSecSize skiSize, xmlSecKeyInfoCtx *keyInfoCtx);
```

*Source:* [include/xmlsec/openssl/x509.h](https://github.com/lsh123/xmlsec/blob/1.3.11/include/xmlsec/openssl/x509.h#L105)

Deprecated. Searches `store` for a certificate that matches given criteria.

**Parameters:**

- `store` — the pointer to X509 key data store klass.
- `subjectName` — the desired certificate name.
- `issuerName` — the desired certificate issuer name.
- `issuerSerial` — the desired certificate issuer serial number.
- `ski` — the desired certificate SKI.
- `skiSize` — the desired certificate SKI size.
- `keyInfoCtx` — the pointer to <dsig:KeyInfo/> element processing context.


**Returns:** pointer to found certificate or NULL if certificate is not found or an error occurs.

---
