Main Page | Modules | Class Hierarchy | Alphabetical List | Class List | Directories | File List | Class Members | File Members | Related Pages

WvX509Mgr Class Reference

#include <wvx509.h>

Inheritance diagram for WvX509Mgr:

Inheritance graph
[legend]
List of all members.

Detailed Description

X509 Class to handle certificates and their related functions.


Public Types

enum  DumpMode { CertPEM = 0, RsaPEM, RsaPubPEM, RsaRaw }
 Type for the encode() and decode() methods. More...

Public Member Functions

 WvX509Mgr (X509 *_cert=NULL)
 Initialize a blank X509 Object with the certificate *cert (used for client side operations...).
 WvX509Mgr (WvStringParm hexcert, WvStringParm hexrsa)
 Constructor to initialize this object with a pre-existing certificate and key.
 WvX509Mgr (WvStringParm _dname, WvRSAKey *_rsa)
 Constructor to create a self-signed certificate for the given dn and RSA key.
 WvX509Mgr (WvStringParm _dname, int bits)
 Constructor to create a new self-signed certificate for the given dn and number of bits.
virtual ~WvX509Mgr ()
 Destructor.
bool bind_ssl (SSL_CTX *ctx)
 Avoid a lot of ugliness by having it so that we are binding to the SSL context, and not the other way around, since that would make ownership of the cert and rsa keys ambiguous.
const WvRSAKeyget_rsa ()
 Accessor for the RSA Keys.
void create_selfsigned (bool is_ca=false)
 Given the Distinguished Name dname and an already generated keypair in rsa, return a Self Signed Certificate in cert.
WvString certreq ()
 Create a certificate request (PKCS#10) using this function..
WvString signcert (WvStringParm pkcs10req)
 Take the PKCS#10 request in the string pkcs10req, sign it with the private key in rsa, and then spit back a new X509 Certificate in PEM format.
bool test ()
 Test to make sure that a certificate and a keypair go together.
void unhexify (WvStringParm encodedcert)
 Given a hexified certificate, fill the cert member NOTE: ALWAYS load your RSA Keys before calling this! It is best if you have hexify()'d keys to simply use the proper constructor.
WvString hexify ()
 Given the X509 certificate object cert, return a hexified string useful in a WvConf or UniConf file.
bool validate (WvX509Mgr *cacert=NULL, X509_CRL *crl=NULL)
 Function to verify the validity of a certificate that has been placed in cert.
bool signedbyCAindir (WvStringParm certdir)
 Check the certificate in cert against the CA certificates in certdir - returns true if cert was signed by one of the CA certificates.
bool signedbyCAinfile (WvStringParm certfile)
 Check the certificate in cert against the CA certificate in certfile returns true if cert was signed by that CA certificate.
bool signedbyCA (WvX509Mgr *cacert)
 Check the certificate in cert against the CA certificate in cacert returns true if cert was signed by that CA certificate.
WvString sign (WvBuf &data)
 Sign the contents of data and return the signature as a BASE64 string.
WvString sign (WvStringParm data)
bool verify (WvBuf &original, WvStringParm signature)
 Verify that the contents of data were signed by the certificate currently in cert.
bool verify (WvStringParm original, WvStringParm signature)
WvString encode (const DumpMode mode)
 Return the information requested by mode as a WvString.
void decode (const DumpMode mode, WvStringParm PemEncoded)
 Load the information from the format requested by mode into the class - this overwrites the certificate, and possibly the key - and to enable two stage loading (the certificate first, then the key), it DOES NOT call test() - that will be up to the programmer.
void write_p12 (WvStringParm filename)
 And of course, since PKCS12 files are in the rediculous DER encoding format, which is binary, we can't use the encode/decode functions, so we deal straight with files...
void read_p12 (WvStringParm filename)
 And this reads from the file specified in filename, and fills the RSA and cert members with the decoded information.
void setPkcs12Password (WvStringParm passwd)
 Sets the PKCS12 password.
WvString get_issuer ()
 Return the Certificate Issuer (usually the CA who signed the certificate).
WvString get_subject ()
 Return the Subject field of the certificate.
WvString get_serial ()
 Return the serialNumber field of the certificate.
WvString get_crl_dp ()
 Return the CRL Distribution points if they exist, WvString::null if they don't.
WvString get_cp_oid ()
 Return the Certificate Policy OID if it exists, and WvString::null it if doesn't.
WvString get_altsubject ()
 Return the Subject alt name if it exists, and WvString::null if it doesn't.
virtual bool isok () const
 Is this certificate Object valid, and in a non-error state.
virtual WvString errstr () const
virtual int geterr () const
 If isok() is false, return the system error number corresponding to the error, -1 for a special error string (which you can obtain with errstr()) or 0 on end of file.
int get () const
WvString str () const
void set (int _errnum)
void set (WvStringParm specialerr)
void set (WVSTRING_FORMAT_DECL)
void set (const WvErrorBase &err)
void reset ()
virtual void seterr (int _errnum)
 Set the errnum variable -- we have an error.
void seterr (WvStringParm specialerr)
void seterr (WVSTRING_FORMAT_DECL)
void seterr (const WvErrorBase &err)
void noerr ()
 Reset our error state - there's no error condition anymore.

Protected Attributes

int errnum
WvString errstring


Member Enumeration Documentation

enum WvX509Mgr::DumpMode
 

Type for the encode() and decode() methods.

CertPEM = PEM Encoded X.509 Certificate RsaPEM = PEM Encoded RSA Private Key RsaPubPEM = PEM Encoded RSA Public Key RsaRaw = Raw form of RSA Key (unused by most programs, FreeS/WAN being the notable exception)


Constructor & Destructor Documentation

WvX509Mgr::WvX509Mgr X509 *  _cert = NULL  ) 
 

Initialize a blank X509 Object with the certificate *cert (used for client side operations...).

This either initializes a completely empty object, or takes _cert, and extracts the distinguished name into dname, and the the RSA public key into rsa. rsa->prv is empty.

WvX509Mgr::WvX509Mgr WvStringParm  _dname,
WvRSAKey _rsa
 

Constructor to create a self-signed certificate for the given dn and RSA key.

If you don't already have a WvRSAKey, try the other constructor, below, which creates one automatically.

For SSL Servers, the dname must contain a "cn=" section in order to validate correctly with some clients, particularly web browsers. For example, if your domain name is nit.ca, you can try this for _dname: "cn=nit.ca,o=Net Integration,c=CA", or maybe this instead: "cn=nit.ca,dc=nit,dc=ca"

We don't check automatically that your _dname complies with these restrictions, since non-SSL certificates may be perfectly valid without this. If you want to generate invalid certs, that's up to you.

WvX509Mgr::WvX509Mgr WvStringParm  _dname,
int  bits
 

Constructor to create a new self-signed certificate for the given dn and number of bits.

See the previous constructor for details on how to choose _dname. 'bits' is the number of bits in the auto-generated RSA key; 1024 or 2048 are good values for this.


Member Function Documentation

WvString WvX509Mgr::certreq  ) 
 

Create a certificate request (PKCS#10) using this function..

this request is what you would send off to Verisign, or Entrust.net (or any other CA), to get your real certificate. It leaves the RSA key pair in rsa, where you MUST save it for the certificate to be AT ALL valid when you get it back. Returns a PEM Encoded PKCS#10 certificate request, and leaves the RSA keypair in rsa, and a self-signed temporary certificate in cert.

It uses dname as the Distinguished name to create this Request. Make sure that it has what you want in it first.

bool WvX509Mgr::test  ) 
 

Test to make sure that a certificate and a keypair go together.

called internally by unhexify() although you can call it if you want to test a certificate yourself. (Such as after a decode)

WvString WvX509Mgr::hexify  ) 
 

Given the X509 certificate object cert, return a hexified string useful in a WvConf or UniConf file.

I don't provide a similar function for that for the rsa key, because you can always call get_rsa().private_str() and get_rsa().public_str() for that information.

bool WvX509Mgr::validate WvX509Mgr cacert = NULL,
X509_CRL *  crl = NULL
 

Function to verify the validity of a certificate that has been placed in cert.

It can check and make sure that it was signed by the CA certificate cacert, and is not in the CRL crl, but at the very least, it checks and makes sure that your certificate is not expired

bool WvX509Mgr::signedbyCAinfile WvStringParm  certfile  ) 
 

Check the certificate in cert against the CA certificate in certfile returns true if cert was signed by that CA certificate.

bool WvX509Mgr::signedbyCA WvX509Mgr cacert  ) 
 

Check the certificate in cert against the CA certificate in cacert returns true if cert was signed by that CA certificate.

bool WvX509Mgr::verify WvBuf original,
WvStringParm  signature
 

Verify that the contents of data were signed by the certificate currently in cert.

This only checks the signature, it doesn't check the validity of the certificate.

void WvX509Mgr::write_p12 WvStringParm  filename  ) 
 

And of course, since PKCS12 files are in the rediculous DER encoding format, which is binary, we can't use the encode/decode functions, so we deal straight with files...

*sigh*

As should be obvious, this writes the certificate and RSA keys in PKCS12 format to the file specified by filename.

int WvX509Mgr::geterr  )  const [virtual]
 

If isok() is false, return the system error number corresponding to the error, -1 for a special error string (which you can obtain with errstr()) or 0 on end of file.

If isok() is true, returns an undefined number.

Reimplemented from WvErrorBase.

void WvErrorBase::seterr int  _errnum  )  [virtual, inherited]
 

Set the errnum variable -- we have an error.

If called more than once, seterr() doesn't change the error code away from the previous one. That way, we remember the _original_ cause of our problems.

Subclasses may want to override seterr(int) to shut themselves down (eg. WvStream::close()) when an error condition is set.

Note that seterr(WvString) will call seterr(-1).


The documentation for this class was generated from the following files:
Generated on Sun Jul 10 18:29:39 2005 for WvStreams by  doxygen 1.4.0