5 Module N_X509
gullradriel edited this page 2026-10-09 00:55:18 +02:00

X509: certificate authority and per-host leaf minting

Functions

Name
int n_x509_mint_host_cert(const char * host, const N_STR * ca_cert_pem, const N_STR * ca_key_pem, int days, N_STR ** leaf_cert_pem, N_STR ** leaf_key_pem)
Mint a per-host leaf certificate signed by the given CA.
int n_x509_keypair_pem(int bits, N_STR ** key_pem)
Generate an RSA private key and return it as a PEM string.
int n_x509_generate_ca(const char * cn, int days, N_STR ** ca_cert_pem, N_STR ** ca_key_pem)
Generate a self-signed certificate authority (CA) keypair and cert.

Functions Documentation

function n_x509_mint_host_cert

int n_x509_mint_host_cert(
    const char * host,
    const N_STR * ca_cert_pem,
    const N_STR * ca_key_pem,
    int days,
    N_STR ** leaf_cert_pem,
    N_STR ** leaf_key_pem
)

Mint a per-host leaf certificate signed by the given CA.

Parameters:

  • host the requested host name (or IP) to certify.
  • ca_cert_pem the CA certificate PEM (issuer).
  • ca_key_pem the CA private key PEM (signer).
  • days validity in days from now.
  • leaf_cert_pem out: newly allocated leaf certificate PEM, owned by the caller.
  • leaf_key_pem out: newly allocated leaf private key PEM, owned by the caller.

Return: 0 on success, -1 on error.

The leaf has basicConstraints CA:FALSE, extendedKeyUsage serverAuth, a subjectAltName of DNS:host (or IP:host when host is a literal IP address), a fresh random serial, and is signed with the CA key using SHA-256. Cache the result per host to avoid re-minting on every connection.

function n_x509_keypair_pem

int n_x509_keypair_pem(
    int bits,
    N_STR ** key_pem
)

Generate an RSA private key and return it as a PEM string.

Parameters:

  • bits RSA modulus size in bits (for example 2048).
  • key_pem out: newly allocated PEM private key, owned by the caller.

Return: 0 on success, -1 on error.

function n_x509_generate_ca

int n_x509_generate_ca(
    const char * cn,
    int days,
    N_STR ** ca_cert_pem,
    N_STR ** ca_key_pem
)

Generate a self-signed certificate authority (CA) keypair and cert.

Parameters:

  • cn common name for the CA subject/issuer (for example "Fissure CA").
  • days validity in days from now.
  • ca_cert_pem out: newly allocated CA certificate PEM, owned by the caller.
  • ca_key_pem out: newly allocated CA private key PEM, owned by the caller.

Return: 0 on success, -1 on error.

The CA is meant to be installed by the user in their browser/OS trust store so a MITM proxy can present host certificates it signs. The certificate has basicConstraints CA:TRUE and keyUsage keyCertSign,cRLSign and is signed with SHA-256.