openbsd/src/lib/libtls/tls_peer.c, branch OPENBSD_7_9_BASE

Provide tls_peer_cert_common_name()

2024-12-10T08:40:30+00:00

There is currently no sane way of getting your hands on the common name or subject alternative name of the peer certificate from libtls. It is possible to extract it from the peer cert's PEM by hand, but that way lies madness. While the common name is close to being deprecated in the webpki, it is still the de facto standard to identify client certs. It would be nice to have a way to access the subject alternative names as well, but this is a lot more difficult to expose in a clean and sane C interface due to its multivaluedness. Initial diff from henning, with input from beck, jsing and myself henning and bluhm have plans of using this in syslogd. ok beck

Rework name verification code so that a match is indicated via an argument,

2017-04-10T17:11:13+00:00

rather than return codes. More strictly follow RFC 6125, in particular only check the CN if there are no SAN identifiers present in the certificate (per section 6.4.4). Previous behaviour questioned by Daniel Stenberg . ok beck@ jca@

Add tls_peer_cert_chain_pem - To retreive the peer certificate and chain

2017-04-05T03:19:22+00:00

as PEM format. This allows for it to be used or examined with tools external to libtls bump minor ok jsing@

Stick with the usual 'if NULL return NULL' idiom.

2016-08-22T17:08:10+00:00

ok beck@

Add tls_peer_cert_notbefore and tls_peer_cert_notafter to expose peer certificate

2015-10-07T23:33:38+00:00

validity times for tls connections. ok jsing@

Move connection info into it's own private structure allocated and filled in

2015-09-12T21:00:38+00:00

at handshake time. change accessors to return const char * to remove need for caller to free memory. ok jsing@

!= -> == that I broke while bikeshedding

2015-09-11T13:22:39+00:00

add tls_peer functions for checking names and issuers of peer certificates.

2015-09-11T12:56:55+00:00

ok jsing@

Provide tls_peer_cert_hash() which returns a hash of the raw certificate

2015-09-11T11:28:01+00:00

that was presented by the peer. The hash used is currently SHA256, however since we prefix the result with the hash name, we can change this in the future as the need arises. The same output can be generated by using: h=$(openssl x509 -outform der -in mycert.crt | sha256) printf "SHA256:${h}\n" ok beck@