gnutls_certifi...rieve_function2(3)

📦
version 3.8.13 · 7 versions
, in alpine 3.22, alpine 3.23, alpine 3.24, arch rolling, fedora 43, fedora 44, ubuntu stonking

💖 gnutls_certifi...rieve_function2 — bestie edition 💖

okay so this is a page from the gnutls manual (yes, the whole gnutls_certifi...rieve_function2(3) thing, they really said "let's truncate the middle of the name, iconic honestly") and we're about to make gnutls_certificate_set_retrieve_function2 make sense. grab a snack. 🍓

✨ NAME ✨

gnutls_certificate_set_retrieve_function2 — it's an API function, bestie. that's the whole name. short king.

🌸 SYNOPSIS 🌸

#include <gnutls/abstract.h>

void
gnutls_certificate_set_retrieve_function2(gnutls_certificate_credentials_t
cred, gnutls_certificate_retrieve_function2 * func);

like, you include the header, and then you call it. simple as that. 💅

🎀 ARGUMENTS 🎀

  • gnutls_certificate_credentials_t cred — bestie this is a gnutls_certificate_credentials_t type. that's it. that's the whole description. it's giving "the vibes are the type".
  • gnutls_certificate_retrieve_function2 * func — and this one? it's the callback function. the star of the show. 🌟

🦋 DESCRIPTION 🦋

so the way this works: this function sets a callback that gets called when it's time to retrieve the certificate that's gonna be used in the handshake. but here's the tea — the callback only takes control if a certificate is requested by the peer. no request, no callback, no drama. 🙈

the callback's function prototype is, and I'm quoting this exactly:

int (*callback)(gnutls_session_t, const gnutls_datum_t* req_ca_dn, int nreqs,
                const gnutls_pk_algorithm_t* pk_algos, int pk_algos_length,
                gnutls_pcert_st** pcert, unsigned int *pcert_length,
                gnutls_privkey_t * pkey);

and now let's break down every single one of those params, because the way that a callback has SEVEN arguments is genuinely unhinged but we're gonna handle it:

  • req_ca_dn is only used in X.509 certificates. it contains a list with the CA names that the server considers trusted. this is a hint, okay, and typically the client should send a certificate that is signed by one of these CAs. these names, when available, are DER encoded. and if you want a more meaningful value out of them, use the function gnutls_x509_rdn_get(). slay. 🔥
  • pk_algos contains a list with the server's acceptable public key algorithms. the certificate you return should support the server's given algorithms. respect the algorithm list, it's literally the bare minimum. ✨
  • pcert should contain a single certificate and public key — or a list of them, if you're feeling extra. 👑
  • pcert_length is the size of the previous list. so like, how many things you put in there. 💅
  • pkey is the private key. keep it secret, keep it safe. 🔐

if the callback function is provided then gnutls will call it, in the handshake, after the certificate request message has been received. and get this — all the provided by the callback values will not be released or modified by gnutls. so they're yours, gnutls isn't gonna touch them, no take-backs, no cleanup. 🫶

also on the server side, pk_algos and req_ca_dn are NULL. so if you're on server side and you're getting NULL in those spots, that's not a bug bestie, that's just the design. 😭

the callback function should set the certificate list to be sent, and return 0 on success. if no certificate was selected then the number of certificates should be set to zero. and if you return (-1), that means error and the handshake will be terminated. so like, don't do that unless you mean it. 💀

and here's a spicy one — if both certificates are set in the credentials AND a callback is available, the callback takes predence. (yes, that's spelled "predence" in the original and we are preserving it with love, it's iconic, we don't fix it.) the callback is the main character here. periodt.

⭐ SINCE ⭐

3.0 — she's been around. vintage but not obsolete. 🌈

💜 REPORTING BUGS 💜

found a bug? not me having to report a bug 😭 but okay, do it properly:

Copyright © 2001-2023 Free Software Foundation, Inc., and others.

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved.

🌸 SEE ALSO 🌸

the full documentation for gnutls is maintained as a Texinfo manual. if the /usr/share/doc/gnutls/ directory does not contain the HTML form, visit:

https://www.gnutls.org/manual/
ok that's the whole page bestie, every flag, every param, every NULL, every (-1), all of it. no cap. 💅

and that's a wrap from the gnutls manual, version 3.8.13, dated alongside gnutls_certifi...rieve_function2(3) — go forth and set your retrieve functions, you absolute legend. 💖✨🎀

📦 where this page comes from