x509 0.9.0 · OCaml Package

A certificate authority (CA) deals with PKCS 10 certificate signing requests, their construction and encoding, and provisioning using a private key to generate a certificate with a signature thereof.

type t

The abstract type of a (self-signed) certification request.

Decoding and encoding in ASN.1 DER and PEM format

val decode_der : 
  ?hash_whitelist:Nocrypto.Hash.hash list ->
  Cstruct.t ->
  (t, [> Rresult.R.msg ]) Rresult.result

decode_der ~hash_whitelist cstruct is signing_request, the ASN.1 decoded cstruct or an error. The signature on the signing request is validated, and its hash algorithm must be in hash_whitelist (by default only SHA-2 is accepted).

val encode_der : t -> Cstruct.t

encode_der sr is cstruct, the ASN.1 encoded representation of the sr.

val decode_pem : Cstruct.t -> (t, [> Rresult.R.msg ]) Rresult.result

decode_pem pem is t, where the single signing request of the pem is extracted

val encode_pem : t -> Cstruct.t

encode_pem signing_request is pem, the pem encoded signing request.

Construction of a signing request

module Ext : sig ... end

type request_info = {

subject : Distinguished_name.t;
public_key : Public_key.t;
extensions : Ext.t;

}

The raw request info of a PKCS 10 certification request info.

val info : t -> request_info

info signing_request is request_info, the information inside the signing_request.

val signature_algorithm : t -> ([ `RSA | `ECDSA ] * Nocrypto.Hash.hash) option

signature_algorithm signing_request is the algorithm used for the signature.

val hostnames : t -> Certificate.Host_set.t

hostnames signing_request is the set of domain names this signing_request is requesting. This is either the content of the DNS entries of the SubjectAlternativeName extension, or the common name of the signing_request.

val create : 
  Distinguished_name.t ->
  ?digest:Nocrypto.Hash.hash ->
  ?extensions:Ext.t ->
  Private_key.t ->
  t

create subject ~digest ~extensions private creates signing_request, a certification request using the given subject, digest (defaults to `SHA256) and list of extensions.

Provision a signing request to a certificate

val sign : 
  t ->
  valid_from:Ptime.t ->
  valid_until:Ptime.t ->
  ?hash_whitelist:Nocrypto.Hash.hash list ->
  ?digest:Nocrypto.Hash.hash ->
  ?serial:Z.t ->
  ?extensions:Extension.t ->
  Private_key.t ->
  Distinguished_name.t ->
  (Certificate.t, [> Rresult.R.msg ]) Rresult.result

sign signing_request ~valid_from ~valid_until ~hash_whitelist ~digest ~serial ~extensions private issuer creates certificate, a signed certificate. Signing can fail if the signature on the signing_request is invalid, or its hash algorithm does not occur in hash_whitelist (default all SHA-2 algorithms). Public key and subject are taken from the signing_request, the extensions are added to the X.509 certificate. The private key is used to sign the certificate, the issuer is recorded in the certificate. The digest defaults to `SHA256. The serial defaults to a random value between 1 and 2^64. Certificate version is always 3. Please note that the extensions in the signing_request are ignored, you can pass them using:

match Ext.find Extensions (info csr).extensions with
| Ok ext -> ext
| Error _ -> Extension.empty

package x509

Decoding and encoding in ASN.1 DER and PEM format

Construction of a signing request

Provision a signing request to a certificate