mainGnuTLS - Support: sr #108634, Getter functions for...

 
 

sr #108634: Getter functions for gnutls_certificate_credentials_t

Submitter:  Armin Burgmeier <aburgm>
Submitted:  Mon 18 Aug 2014 04:47:43 PM UTC
   
 
Category:  Core library Priority:  5 - Normal
Severity:  1 - Wish Status:  Done
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Operating System:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 07 Sep 2014 08:04:09 PM UTC, comment #3: 


>  I have misread you message. Which function has that limitation and would you suggest to address that issue?


All the certificate verification functions I think. The limitation is in the internal function "verify_crt" in x509/verify.c. If, for example, the verify result is GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE or GNUTLS_CERT_SIGNER_NOT_FOUND, then the certificate is not checked for other problems, such as whether it is expired. Other errors, such as GNUTLS_CERT_SIGNATURE_FAILURE, do not stop the procedure and certificate checking continues.

Whether this is supposed to be like this or not I don't know, so maybe it is a different issue from what I mentioned in the caption of this issue.

>  That as I understand would be possible by a function that enumerates all certificates in a trust list. Is that correct?


In addition I would need to get the trust list from the gnutls_certificate_credentials_t structure, I think. It would also be nice to obtain the private key (gnutls_x509_privkey_t) and certificate(s) (gnutls_x509_crt_t) from that structure, not only the trust list.

At the moment in my program I am storing gnutls_x509_privkey_t, gnutls_x509_crt_t (a client certificate), and the gnutls_certificate_credentials_t itself. I need both: The certificate I need to extract the common name to show in the user interface, and the credentials I need to set it with the GnuTLS session (gnutls_credentials_set). This basically means I need to store the key and certificate twice in my program: Once in my data own structures, and once in the gnutls_certificate_credentials_t structure.

What I would like to do is to only keep the gnutls_certificate_credentials_t structure, and when I need to show the common name in the user interface, I would get the certificate from the gnutls_certificate_credentials_t, and then get the name from the certificate. Then I would only end up with the private key and certificate once in my program's memory.

Is it clear?

If you agree this would be good to have I can try to come up with a patch for it.

Armin Burgmeier <aburgm>
Sun 07 Sep 2014 10:22:39 AM UTC, comment #2: 


> For example, I want to verify a certificate, and if the
> certificate is invalid because the issuer is not found (this I
> can do with gnutls_certificate_verify_peers), I want to
> re-validate it with different flags to see whether there are
> other issues with the certificate (for example, expired).


I have misread you message. Which function has that limitation and would you suggest to address that issue?

> Or after I set the trusted certificates with
> gnutls_certificate_set_x509_system_trust(), I want to present a
> list of these certificates in a user interface, so it would be
> good if I could obtain the list of trusted CAs from the
> gnutls_certificate_credentials_t structure.


That as I understand would be possible by a function that enumerates all certificates in a trust list. Is that correct?

Nikos Mavrogiannopoulos <nmav>
Group administrator
Mon 25 Aug 2014 05:34:39 PM UTC, comment #1: 

Indeed it would be convenient to have these functions. The reason they are not there is because they are supposed to be shared between sessions, so it was assumed that all sessions could somehow get access it (e.g. by gnutls_session_set_ptr/get_ptr). I should reconsider though as it would reduce the code required in several cases.

Nikos Mavrogiannopoulos <nmav>
Group administrator
Mon 18 Aug 2014 04:47:43 PM UTC, original submission:  

There are setter functions to set certificate verification flags, trusted CA certificates, and other properties of a gnutls_certificate_credentials_t structure, but there are no corresponding getter functions.

Is there a particular reason for this?

I find myself often in the situation where I would like to access some of the fields that I have previously set in the gnutls_certificate_credentials_t structure.

For example, I want to verify a certificate, and if the certificate is invalid because the issuer is not found (this I can do with gnutls_certificate_verify_peers), I want to re-validate it with different flags to see whether there are other issues with the certificate (for example, expired). Or after I set the trusted certificates with gnutls_certificate_set_x509_system_trust(), I want to present a list of these certificates in a user interface, so it would be good if I could obtain the list of trusted CAs from the gnutls_certificate_credentials_t structure.

Armin Burgmeier <aburgm>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by nmav (Posted a comment)
  • -email is unavailable- added by aburgm (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-09-27 nmav StatusNone Done
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code