=head1 NAME
-SCT - A Certificate Transparency Signed Certificate Timestamp
+SCT_new, SCT_new_from_base64, SCT_free, SCT_LIST_free,
+SCT_get_version, SCT_set_version,
+SCT_get_log_entry_type, SCT_set_log_entry_type,
+SCT_get0_log_id, SCT_set0_log_id, SCT_set1_log_id,
+SCT_get_timestamp, SCT_set_timestamp,
+SCT_get_signature_nid, SCT_set_signature_nid,
+SCT_get0_signature, SCT_set0_signature, SCT_set1_signature,
+SCT_get0_extensions, SCT_set0_extensions, SCT_set1_extensions,
+SCT_get_source, SCT_set_source
+ - A Certificate Transparency Signed Certificate Timestamp
=head1 SYNOPSIS
#include <openssl/ct.h>
+ typedef enum {
+ CT_LOG_ENTRY_TYPE_NOT_SET = -1,
+ CT_LOG_ENTRY_TYPE_X509 = 0,
+ CT_LOG_ENTRY_TYPE_PRECERT = 1
+ } ct_log_entry_type_t;
+
+ typedef enum {
+ SCT_VERSION_NOT_SET = -1,
+ SCT_VERSION_V1 = 0
+ } sct_version_t;
+
+ typedef enum {
+ SCT_SOURCE_UNKNOWN,
+ SCT_SOURCE_TLS_EXTENSION,
+ SCT_SOURCE_X509V3_EXTENSION,
+ SCT_SOURCE_OCSP_STAPLED_RESPONSE
+ } sct_source_t;
+
SCT *SCT_new(void);
SCT *SCT_new_from_base64(unsigned char version,
const char *logid_base64,
int SCT_get_signature_nid(const SCT *sct);
int SCT_set_signature_nid(SCT *sct, int nid);
- size_t SCT_get0_extensions(const SCT *sct, unsigned char **ext);
- void SCT_set0_extensions(SCT *sct, unsigned char *ext, size_t ext_len);
- int SCT_set1_extensions(SCT *sct, const unsigned char *ext, size_t ext_len);
-
size_t SCT_get0_signature(const SCT *sct, unsigned char **sig);
void SCT_set0_signature(SCT *sct, unsigned char *sig, size_t sig_len);
int SCT_set1_signature(SCT *sct, const unsigned char *sig, size_t sig_len);
+ size_t SCT_get0_extensions(const SCT *sct, unsigned char **ext);
+ void SCT_set0_extensions(SCT *sct, unsigned char *ext, size_t ext_len);
+ int SCT_set1_extensions(SCT *sct, const unsigned char *ext, size_t ext_len);
+
sct_source_t SCT_get_source(const SCT *sct);
int SCT_set_source(SCT *sct, sct_source_t source);
an SCT, some confidence can be gained that the certificate is publicly known.
An internal representation of an SCT can be created in one of two ways.
-The first option is to create a blank SCT, using B<SCT_new>(), and then populate
+The first option is to create a blank SCT, using SCT_new(), and then populate
it using:
=over
-=item * B<SCT_set_version>() to set the SCT version.
+=item * SCT_set_version() to set the SCT version.
Only SCT_VERSION_V1 is currently supported.
-=item * B<SCT_set_log_entry_type>() to set the type of certificate the SCT was issued for:
+=item * SCT_set_log_entry_type() to set the type of certificate the SCT was issued for:
B<CT_LOG_ENTRY_TYPE_X509> for a normal certificate.
B<CT_LOG_ENTRY_TYPE_PRECERT> for a pre-certificate.
-=item * B<SCT_set0_log_id>() or B<SCT_set1_log_id>() to set the LogID of the CT log that the SCT came from.
+=item * SCT_set0_log_id() or SCT_set1_log_id() to set the LogID of the CT log that the SCT came from.
The former takes ownership, whereas the latter makes a copy.
See RFC 6962, Section 3.2 for the definition of LogID.
-=item * B<SCT_set_timestamp>() to set the time the SCT was issued (epoch time in milliseconds).
+=item * SCT_set_timestamp() to set the time the SCT was issued (epoch time in milliseconds).
-=item * B<SCT_set_signature_nid>() to set the NID of the signature.
+=item * SCT_set_signature_nid() to set the NID of the signature.
-=item * B<SCT_set0_signature>() or B<SCT_set1_signature>() to set the signature itself.
+=item * SCT_set0_signature() or SCT_set1_signature() to set the raw signature value.
The former takes ownership, whereas the latter makes a copy.
-=item * B<SCT_set0_extensions>() or B<SCT_set1_extensions> to provide SCT extensions.
+=item * SCT_set0_extensions() or B<SCT_set1_extensions> to provide SCT extensions.
The former takes ownership, whereas the latter makes a copy.
=back
Alternatively, the SCT can be pre-populated from the following data using
-B<SCT_new_from_base64>():
+SCT_new_from_base64():
=over
=back
-B<SCT_set_source>() can be used to record where the SCT was found
+SCT_set_source() can be used to record where the SCT was found
(TLS extension, X.509 certificate extension or OCSP response). This is not
required for verifying the SCT.
Most of the setters will reset the validation status of the SCT to
SCT_VALIDATION_STATUS_NOT_SET (see L<SCT_verify(3)>).
-B<SCT_set_source>() will call B<SCT_set_log_entry_type>() if the type of
+SCT_set_source() will call SCT_set_log_entry_type() if the type of
certificate the SCT was issued for can be inferred from where the SCT was found.
For example, an SCT found in an X.509 extension must have been issued for a pre-
certificate.
-B<SCT_set_source>() will not refuse unknown values.
+SCT_set_source() will not refuse unknown values.
=head1 RETURN VALUES
-B<SCT_set_version>() returns 1 if the specified version is supported, 0 otherwise.
+SCT_set_version() returns 1 if the specified version is supported, 0 otherwise.
-B<SCT_set_log_entry_type>() returns 1 if the specified log entry type is supported, 0 otherwise.
+SCT_set_log_entry_type() returns 1 if the specified log entry type is supported, 0 otherwise.
-B<SCT_set0_log_id>() and B<SCT_set1_log_id> return 1 if the specified LogID is a
+SCT_set0_log_id() and B<SCT_set1_log_id> return 1 if the specified LogID is a
valid SHA-256 hash, 0 otherwise. Aditionally, B<SCT_set1_log_id> returns 0 if
malloc fails.
projects / openssl.git / blobdiff