libressl-d2i_X5093
Decode and encode x.509 certificates
Usage
Crypto Library
(libcrypto,
-lcrypto)
X509 *
int
X509 *
X509 *
int
int
X509 *
int
X509_CERT_AUX *
int
X509_CINF *
int
X509_VAL *
int
int
int
int
Overview
These functions decode and encode X.509 certificates and some of their substructures. For details about the semantics, examples, caveats, and bugs, see ASN1_item_d2i(3).
d2i_X509() and i2d_X509() decode and encode an ASN.1 Certificate structure defined in RFC 5280 section 4.1.
d2i_X509_bio(), d2i_X509_fp(), i2d_X509_bio(), and i2d_X509_fp() are similar except that they decode or encode using a BIO or FILE pointer.
d2i_X509_AUX() is similar to d2i_X509(), but the input is expected to consist of an X.509 certificate followed by auxiliary trust information. This is used by the PEM routines to read TRUSTED CERTIFICATE objects. This function should not be called on untrusted input.
i2d_X509_AUX() is similar to i2d_X509(), but the encoded output contains both the certificate and any auxiliary trust information. This is used by the PEM routines to write TRUSTED CERTIFICATE objects. Note that this is a non-standard OpenSSL-specific data format.
d2i_X509_CERT_AUX() and i2d_X509_CERT_AUX() decode and encode optional non-standard auxiliary data appended to a certificate, for example friendly alias names and trust data.
d2i_X509_CINF() and i2d_X509_CINF() decode and encode an ASN.1 TBSCertificate structure defined in RFC 5280 section 4.1.
d2i_X509_VAL() and i2d_X509_VAL() decode and encode an ASN.1 Validity structure defined in RFC 5280 section 4.1.
i2d_re_X509_tbs() is similar to i2d_X509(), except it encodes only the TBSCertificate portion of the certificate. i2d_re_X509_CRL_tbs() and i2d_re_X509_REQ_tbs() are analogous for CRL and certificate request, respectively. The "re" in i2d_re_X509_tbs() stands for "re-encode", and ensures that a fresh encoding is generated in case the object has been modified after creation.
The encoding of the TBSCertificate portion of a certificate is cached in the X509 structure internally to improve encoding performance and to ensure certificate signatures are verified correctly in some certificates with broken (non-DER) encodings.
If, after modification, the X509 object is re-signed with X509_sign(3), the encoding is automatically renewed. Otherwise, the encoding of the TBSCertificate portion of the X509 can be manually renewed by calling i2d_re_X509_tbs().
Return values
d2i_X509(), d2i_X509_bio(), d2i_X509_fp(), and d2i_X509_AUX() return a valid X509 structure or NULL if an error occurs.
d2i_X509_CERT_AUX(), d2i_X509_CINF(), and d2i_X509_VAL() return an X509_CERT_AUX, X509_CINF, or X509_VAL object, respectively, or NULL if an error occurs.
i2d_X509(), i2d_X509_AUX(), i2d_X509_CERT_AUX(), i2d_X509_CINF(), and i2d_X509_VAL() return the number of bytes successfully encoded or a negative value if an error occurs.
i2d_X509_bio() and i2d_X509_fp() return 1 for success or 0 if an error occurs.
i2d_re_X509_tbs(), i2d_re_X509_CRL_tbs(), and i2d_re_X509_REQ_tbs() return the number of bytes successfully encoded or 0 if an error occurs.
For all functions, the error code can be obtained by ERR_get_error(3).