Estonian ID Card C-library
DigiDocCert.h
1 #ifndef __DIGI_DOC_CERT_H__
2 #define __DIGI_DOC_CERT_H__
3 //==================================================
4 // FILE: DigiDocCert.h
5 // PROJECT: Digi Doc
6 // DESCRIPTION: Digi Doc functions for certificate handling
7 // AUTHOR: Veiko Sinivee, S|E|B IT Partner Estonia
8 //==================================================
9 // Copyright (C) AS Sertifitseerimiskeskus
10 // This library is free software; you can redistribute it and/or
11 // modify it under the terms of the GNU Lesser General Public
12 // License as published by the Free Software Foundation; either
13 // version 2.1 of the License, or (at your option) any later version.
14 // This library is distributed in the hope that it will be useful,
15 // but WITHOUT ANY WARRANTY; without even the implied warranty of
16 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 // Lesser General Public License for more details.ode
18 // GNU Lesser General Public Licence is available at
19 // http://www.gnu.org/copyleft/lesser.html
20 //==========< HISTORY >=============================
21 //==================================================
22 
23 
24 #ifdef __cplusplus
25 extern "C" {
26 #endif
27 
28 #include <openssl/evp.h>
29 #include <openssl/objects.h>
30 #include <openssl/x509.h>
31 #include <openssl/x509v3.h>
32 
33 #include <libdigidoc/DigiDocDefs.h>
34 #include <libdigidoc/DigiDocLib.h>
35 
36 // structure for reading certificate policies
37 typedef struct PolicyIdentifier_st {
38  char* szOID; // stringified OID
39  char* szCPS; // CPS URL
40  char* szUserNotice; // user notice
42 
43 
44 EXP_OPTION int ReadPrivateKey(EVP_PKEY **privKey, const char *keyfile, const char* passwd, int format);
45 EXP_OPTION int WritePrivateKey(EVP_PKEY *privKey, const char *keyfile, const char* passwd, int format);
46 int ReadPublicKey(EVP_PKEY **pkey, const char *certfile);
47 int GetPublicKey(EVP_PKEY **pubKey, const X509* x509);
48 
49 //--------------------------------------------------
50 // Writes a private key and cert to a PEM file
51 // privKey - private key
52 // pCert - certificate
53 // keyfile - name of the private key file
54 // passwd - key password (problems with encrypted passwwords!)
55 //--------------------------------------------------
56 EXP_OPTION int ddocWriteKeyAndCertPem(EVP_PKEY *privKey, X509* pCert,
57  const char *keyfile, const char* passwd);
58 
59 
60 EXP_OPTION int ReadCertificate(X509 **x509, const char *certfile);
61 EXP_OPTION int ReadCertificateNoErr(X509 **x509, const char *szCertfile);
62 EXP_OPTION int ReadCertSerialNumber(char* szSerial, int nMaxLen, X509 *x509);
63 EXP_OPTION int ReadCertificateByPKCS12(X509 **x509, const char *pkcs12file, const char *passwd, EVP_PKEY **pkey);
64 
65 // Decodes binary (DER) cert data and returns a cert object
66 EXP_OPTION int ddocDecodeX509Data(X509 **ppX509, const byte* certData, int certLen);
67 
68 // Decodes base64 (PEM) cert data and returns a cert object
69 EXP_OPTION int ddocDecodeX509PEMData(X509 **ppX509, const char* certData, int certLen);
70 
71 // get certificate PEM form
72 EXP_OPTION int getCertPEM(X509* cert, int bHeaders, char** buf);
73 
74 
75 // retrieves this certificates serial number
76 EXP_OPTION int GetCertSerialNumber(char* szSerial, int nMaxLen, const char *szCertfile);
77 // Returns the certificates validity first date
78 EXP_OPTION int getCertNotBefore(const SignedDoc* pSigDoc, X509* cert, char* timestamp, int len);
79 
80 // Retrieves the certificates first validity time as tim_t in GMT zone
81 EXP_OPTION time_t getCertNotBeforeTimeT(X509* pCert);
82 // Retrieves the certificates last validity time as tim_t in GMT zone
83 EXP_OPTION time_t getCertNotAfterTimeT(X509* pCert);
84 
85 // Returns the certificates validity last date
86 EXP_OPTION int getCertNotAfter(const SignedDoc* pSigDoc, X509* cert, char* timestamp, int len);
87 // Saves the certificate in a file
88 EXP_OPTION int saveCert(X509* cert, const char* szFileName, int nFormat);
89 // decodes PEM cert data
90 EXP_OPTION void* decodeCert(const char* pemData);
91 // encodes certificate
92 EXP_OPTION void encodeCert(const X509* x509, char * encodedCert, int* encodedCertLen);
93 
94 // Reads certificates PolicyIdentifiers and returns
95 // them in a newly allocated structure
96 EXP_OPTION int readCertPolicies(X509* pX509, PolicyIdentifier** pPolicies, int* nPols);
97 
98 // Frees policy identifiers array
99 EXP_OPTION void PolicyIdentifiers_free(PolicyIdentifier* pPolicies, int nPols);
100 
101 // Checks if this is a company CPS policy
102 EXP_OPTION int isCompanyCPSPolicy(PolicyIdentifier* pPolicy);
103 
104 EXP_OPTION int isCertValid(X509* cert, time_t tDate);
105 EXP_OPTION int isCertSignedBy(X509* cert, const char* cafile);
106 int writeCertToXMLFile(BIO* bout, X509* cert);
107 
108 //--------------------------------------------------
109 // Verifys a certificate by sending an OCSP_REQUEST object
110 // to the notary server and checking the response.
111 // Uses servers timestamps hash code as nonce value.
112 // pCert - certificate to test
113 // caCerts - responder CA certs chain
114 // notaryCert - notarys cert search
115 // proxyHost - proxy servers name
116 // proxyPort - proxy servers port
117 // notaryURL - notarys URL
118 // ppResp - address to return OCSP response. Use NULL if
119 // you don't want OCSP response to be returned
120 // return 0 for OK, or error code
121 //--------------------------------------------------
122 EXP_OPTION int verifyCertificateByOCSP(X509* pCert, const X509** caCerts,
123  const X509* notaryCert, char* notaryURL,
124  char* proxyHost, char* proxyPort,
125  const char* pkcs12file, const char* pkcs12paswd,
126  OCSP_RESPONSE **ppResp);
127 
128 //--------------------------------------------------
129 // Verifys a certificate by sending an OCSP_REQUEST object
130 // to the notary server and checking the response.
131 // Uses servers timestamps hash code as nonce value.
132 // pCert - certificate to test
133 // caCerts - responder CA certs chain
134 // notaryCert - notarys cert search
135 // proxyHost - proxy servers name
136 // proxyPort - proxy servers port
137 // notaryURL - notarys URL
138 // ppResp - address to return OCSP response. Use NULL if
139 // you don't want OCSP response to be returned
140 // return 0 for OK, or error code
141 //--------------------------------------------------
142 EXP_OPTION int verifyCertificateByOCSPWithIp(X509* pCert, const X509** caCerts,
143  const X509* notaryCert, char* notaryURL,
144  char* proxyHost, char* proxyPort,
145  const char* pkcs12file, const char* pkcs12paswd,
146  OCSP_RESPONSE **ppResp, unsigned long ip);
147 
148  //--------------------------------------------------
149  // Returns the certificates sha1 hash.
150  // pCert - certificate data
151  // pMemBuf - memory buffer object for storing DN
152  // returns error code or ERR_OK
153  //--------------------------------------------------
154  int ddocCertGetDigest(X509* pCert, DigiDocMemBuf* pMemBuf);
155 
156  //--------------------------------------------------
157  // Returns the certificates public key sha1 hash.
158  // pCert - certificate data
159  // pMemBuf - memory buffer object for storing DN
160  // returns error code or ERR_OK
161  //--------------------------------------------------
162  int ddocCertGetPubkeyDigest(X509* pCert, DigiDocMemBuf* pMemBuf);
163 
164  //--------------------------------------------------
165  // Returns the certificates issuer name.
166  // pCert - certificate data
167  // pMemBuf - memory buffer object for storing DN
168  // returns error code or ERR_OK
169  //--------------------------------------------------
170  EXP_OPTION int ddocCertGetIssuerDN(X509* pCert, DigiDocMemBuf* pMemBuf);
171 
172  //--------------------------------------------------
173  // Returns the certificates subject name.
174  // pCert - certificate data
175  // pMemBuf - memory buffer object for storing DN
176  // returns error code or ERR_OK
177  //--------------------------------------------------
178  EXP_OPTION int ddocCertGetSubjectDN(X509* pCert, DigiDocMemBuf* pMemBuf);
179 
180  //--------------------------------------------------
181  // Returns the certificates subject name sha1 hash.
182  // pCert - certificate data
183  // pMemBuf - memory buffer object for storing DN
184  // returns error code or ERR_OK
185  //--------------------------------------------------
186  int ddocCertGetSubjectNameDigest(X509* pCert, DigiDocMemBuf* pMemBuf);
187 
188  //--------------------------------------------------
189  // Returns the certificates issuer name sha1 hash.
190  // pCert - certificate data
191  // pMemBuf - memory buffer object for storing DN
192  // returns error code or ERR_OK
193  //--------------------------------------------------
194  int ddocCertGetIssuerNameDigest(X509* pCert, DigiDocMemBuf* pMemBuf);
195 
196  //--------------------------------------------------
197  // Returns the certificates DN.
198  // Do not call directly, subject to change
199  // pName - certificate X509 name
200  // pMemBuf - memory buffer object for storing DN
201  // bIssuer - 1=issuer, 0=subject
202  // returns error code or ERR_OK
203  //--------------------------------------------------
204  EXP_OPTION int ddocCertGetDNFromName(X509_NAME* pName, DigiDocMemBuf* pMemBuf);
205 
206 #define KUIDX_DIGITAL_SIGNATURE 0
207 #define KUIDX_NON_REPUDIATION 1
208 #define KUIDX_KEY_ENCIPHERMENT 2
209 #define KUIDX_DATA_ENCIPHERMENT 3
210 #define KUIDX_KEY_AGREEMENT 4
211 #define KUIDX_KEY_CERT_SIGN 5
212 #define KUIDX_CRL_SIGN 6
213 #define KUIDX_ENCIPHERMENT_ONLY 7
214 #define KUIDX_DECIPHERMENT_ONLY 8
215 
216 #define NID_firstName 99
217 #define NID_lastName 100
218 #define NID_perCode 105
219 #define NID_countryName 14
220 #define NID_serialNumber 105
221 #define NID_organization 17
222 #define NID_organizationUnit 18
223 #define NID_commonName 13
224 #define NID_emailAddress 48
225 
226 
227  //--------------------------------------------------------
228  // Checks if the desired key-usage bit is set on a given cert
229  // pCert - certificate
230  // nBit - flag index
231  // return 1 if bit is set
232  //--------------------------------------------------------
233  EXP_OPTION int ddocCertCheckKeyUsage(X509 *pCert, int nBit);
234 
235  //--------------------------------------------------
236  // Returns the certificates subject CN
237  // pCert - certificate data
238  // pMemBuf - memory buffer object for storing result
239  // returns error code or ERR_OK
240  //--------------------------------------------------
241  EXP_OPTION int ddocCertGetSubjectCN(X509* pCert, DigiDocMemBuf* pMemBuf);
242 
243  //--------------------------------------------------
244  // Returns the certificates issuer CN
245  // pCert - certificate data
246  // pMemBuf - memory buffer object for storing result
247  // returns error code or ERR_OK
248  //--------------------------------------------------
249  EXP_OPTION int ddocCertGetIssuerCN(X509* pCert, DigiDocMemBuf* pMemBuf);
250 
251  //--------------------------------------------------
252  // Returns the certificates subject first name
253  // pCert - certificate data
254  // pMemBuf - memory buffer object for storing result
255  // returns error code or ERR_OK
256  //--------------------------------------------------
257  EXP_OPTION int ddocCertGetSubjectFirstName(X509* pCert, DigiDocMemBuf* pMemBuf);
258 
259  //--------------------------------------------------
260  // Returns the certificates subject last name
261  // pCert - certificate data
262  // pMemBuf - memory buffer object for storing result
263  // returns error code or ERR_OK
264  //--------------------------------------------------
265  EXP_OPTION int ddocCertGetSubjectLastName(X509* pCert, DigiDocMemBuf* pMemBuf);
266 
267  //--------------------------------------------------
268  // Returns the certificates subject personal code
269  // pCert - certificate data
270  // pMemBuf - memory buffer object for storing result
271  // returns error code or ERR_OK
272  //--------------------------------------------------
273  EXP_OPTION int ddocCertGetSubjectPerCode(X509* pCert, DigiDocMemBuf* pMemBuf);
274 
275  //--------------------------------------------------
276  // Returns the certificates subject country code
277  // pCert - certificate data
278  // pMemBuf - memory buffer object for storing result
279  // returns error code or ERR_OK
280  //--------------------------------------------------
281  EXP_OPTION int ddocCertGetSubjectCountryName(X509* pCert, DigiDocMemBuf* pMemBuf);
282 
283  //--------------------------------------------------
284  // Returns the certificates subject organization
285  // pCert - certificate data
286  // pMemBuf - memory buffer object for storing result
287  // returns error code or ERR_OK
288  //--------------------------------------------------
289  EXP_OPTION int ddocCertGetSubjectOrganization(X509* pCert, DigiDocMemBuf* pMemBuf);
290 
291  //--------------------------------------------------
292  // Returns the certificates subject organization unit
293  // pCert - certificate data
294  // pMemBuf - memory buffer object for storing result
295  // returns error code or ERR_OK
296  //--------------------------------------------------
297  EXP_OPTION int ddocCertGetSubjectOrganizationUnit(X509* pCert, DigiDocMemBuf* pMemBuf);
298 
299  //--------------------------------------------------
300  // Reads certificates authority key identifier
301  // pCert - certificate
302  // pMemBuf - memory buffer to return data
303  //--------------------------------------------------
304  EXP_OPTION int readAuthorityKeyIdentifier(X509* pCert, DigiDocMemBuf* pMemBuf);
305 
306  //--------------------------------------------------
307  // Reads certificates subject key identifier
308  // pCert - certificate
309  // pMemBuf - memory buffer to return data
310  //--------------------------------------------------
311  EXP_OPTION int readSubjectKeyIdentifier(X509* pCert, DigiDocMemBuf* pMemBuf);
312 
313  EXP_OPTION int ddocCertGetDNPart(X509* pCert, DigiDocMemBuf* pMemBuf, int nNid, int bIssuer);
314 
315  EXP_OPTION int ddocCertGetDN(X509* pCert, DigiDocMemBuf* pMemBuf, int bIssuer);
316 
317 //================< deprecated functions> =================================
318 // these functions are deprecated. Use the replacements in DigiDocCert.h
319 // these functions will be removed in future releases!
320 #ifdef WITH_DEPRECATED_FUNCTIONS
321 
322 // decodes cert data - deprecated!
323 // USE ddocDecodeX509PEMData() instead!
324 EXP_OPTION int decodeCertificateData(X509 **newX509, const byte* certData, int certLen);
325 
326 // Returns the certificates issuer name
327 // USE: ddocCertGetIssuerDN()
328 EXP_OPTION int getCertIssuerName(X509* cert, char* buf, int* buflen);
329 
330 // Returns the certificates subject name
331 // USE: ddocCertGetSubjectDN()
332 EXP_OPTION int getCertSubjectName(X509* cert, char* buf, int* buflen);
333 
334 
335 // reads cert issuers CN
336 // USE: ddocCertGetIssuerCN()
337 EXP_OPTION int getCertIssuerCN(X509* cert, char* buf, int* buflen, int bUTF8);
338 
339 // Returns the certificates subjects DN
340 // USE: ddocCertGetSubjectDN()
341 EXP_OPTION int getCertSubjectDN(X509* cert, char* buf, int* buflen, int bUTF8);
342 
343 // reads cert subjects CN
344 // USE: ddocCertGetSubjectCN()
345 EXP_OPTION int getCertSubjectCN(X509* cert, char* buf, int* buflen, int bUTF8);
346 
347 // get certificate owners id-code
348 // USE: ddocCertGetSubjectPerCode()
349 EXP_OPTION int getCertOwnerCode(const X509* pCert, char* buf, int len);
350 
351 //--------------------------------------------------
352 // Returns the desired item from string rep of DN
353 // sDn - certificate DN
354 // sId - searched DN part
355 // pMBuf - memory buffer object for storing result
356 // returns error code or ERR_OK
357 //--------------------------------------------------
358 EXP_OPTION int ddocGetDNPartFromString(const char* sDn, const char* sId, DigiDocMemBuf* pMBuf);
359 
360 #endif // WITH_DEPRECATED_FUNCTIONS
361 
362 #ifdef __cplusplus
363 }
364 #endif
365 
366 
367 #endif // __DIGI_DOC_CERT_H__
368 
Definition: DigiDocMem.h:32
Definition: DigiDocCert.h:37
Definition: DigiDocObj.h:177