X509: certificate authority and per-host leaf minting
Functions
| Name | |
|---|---|
| int | n_x509_mint_host_cert(const char * host, const N_STR * ca_cert_pem, const N_STR * ca_key_pem, int days, N_STR ** leaf_cert_pem, N_STR ** leaf_key_pem) Mint a per-host leaf certificate signed by the given CA. |
| int | n_x509_keypair_pem(int bits, N_STR ** key_pem) Generate an RSA private key and return it as a PEM string. |
| int | n_x509_generate_ca(const char * cn, int days, N_STR ** ca_cert_pem, N_STR ** ca_key_pem) Generate a self-signed certificate authority (CA) keypair and cert. |
Functions Documentation
function n_x509_mint_host_cert
int n_x509_mint_host_cert(
const char * host,
const N_STR * ca_cert_pem,
const N_STR * ca_key_pem,
int days,
N_STR ** leaf_cert_pem,
N_STR ** leaf_key_pem
)
Mint a per-host leaf certificate signed by the given CA.
Parameters:
- host the requested host name (or IP) to certify.
- ca_cert_pem the CA certificate PEM (issuer).
- ca_key_pem the CA private key PEM (signer).
- days validity in days from now.
- leaf_cert_pem out: newly allocated leaf certificate PEM, owned by the caller.
- leaf_key_pem out: newly allocated leaf private key PEM, owned by the caller.
Return: 0 on success, -1 on error.
The leaf has basicConstraints CA:FALSE, extendedKeyUsage serverAuth, a subjectAltName of DNS:host (or IP:host when host is a literal IP address), a fresh random serial, and is signed with the CA key using SHA-256. Cache the result per host to avoid re-minting on every connection.
function n_x509_keypair_pem
int n_x509_keypair_pem(
int bits,
N_STR ** key_pem
)
Generate an RSA private key and return it as a PEM string.
Parameters:
- bits RSA modulus size in bits (for example 2048).
- key_pem out: newly allocated PEM private key, owned by the caller.
Return: 0 on success, -1 on error.
function n_x509_generate_ca
int n_x509_generate_ca(
const char * cn,
int days,
N_STR ** ca_cert_pem,
N_STR ** ca_key_pem
)
Generate a self-signed certificate authority (CA) keypair and cert.
Parameters:
- cn common name for the CA subject/issuer (for example "Fissure CA").
- days validity in days from now.
- ca_cert_pem out: newly allocated CA certificate PEM, owned by the caller.
- ca_key_pem out: newly allocated CA private key PEM, owned by the caller.
Return: 0 on success, -1 on error.
The CA is meant to be installed by the user in their browser/OS trust store so a MITM proxy can present host certificates it signs. The certificate has basicConstraints CA:TRUE and keyUsage keyCertSign,cRLSign and is signed with SHA-256.
Modules
- AABB3D
- ACCEPT_POOL
- ALLEGRO4
- ALLEGRO5
- ANIM_LIB
- ASTAR
- ATLAS_LIB
- AVRO
- CLOCK_SYNC
- COMMONS
- CONFIGFILE
- CYPHER_BASE64
- CYPHER_VIGENERE
- DEAD_RECKONING
- ENUMS
- EXCEPTIONS
- GAME_ENV
- GIT
- GUI
- HASH_TABLE
- ISOMETRIC_ENGINE
- LIST
- LOG
- LOGNODUP
- LZ4
- NETWORKING
- NETWORK_MSG
- N_COOKIES
- N_DIFF
- N_DIGEST
- N_DISK_CACHE
- N_DNS
- N_ECC
- N_ENTROPY
- N_FILES
- N_FLUIDS
- N_GUI_COLOR
- N_GUI_COLORWHEEL
- N_GUI_CURVE
- N_GUI_GRID
- N_GUI_POPUP
- N_HEX
- N_HTTP3
- N_HTTP_COOKIE
- N_HTTP_FORM
- N_HTTP_MIME
- N_HTTP_REQ
- N_HTTP_RESP
- N_HTTP_ROUTER
- N_HTTP_SERVER
- N_ICC
- N_JSON
- N_KAFKA
- N_LINALG
- N_MODULE
- N_OPENSSL_COMPAT
- N_PRETTY
- N_PTH
- N_QUERY
- N_RANDOM
- N_SHA256
- N_STR
- N_TIFF
- N_TIME
- N_USER
- N_X509
- N_ZIP
- PARTICLES
- PCRE
- PHYSICS
- SIGNALS
- STACK
- THREADS
- TRAJECTORY
- TREE
- ZLIB