gnutls_certifi..._x509_key_file2(3)

✨ gnutls_certifi..._x509_key_file2(3) ✨

okay bestie, gather round 💖 this one lives in the gnutls manual, and it's literally the glow-up version of loading your cert + key combo. let's get into it 🫶

---

🌸 NAME 🌸

gnutls_certificate_set_x509_key_file2 — it's an API function, bestie, and it's giving "load my certificate and my private key, pls and thank u" 💅

---

🎀 SYNOPSIS 🎀

#include <gnutls/gnutls.h>

int
gnutls_certificate_set_x509_key_file2(gnutls_certificate_credentials_t
res, const char * certfile, const char * keyfile, gnutls_x509_crt_fmt_t
type, const char * pass, unsigned int flags);

---

🦋 ARGUMENTS 🦋

• gnutls_certificate_credentials_t res — it's a gnutls_certificate_credentials_t type, that's the whole vibe ✨
• const char * certfile — a file holding the certificate list (path) for the private key you're pairing it with, either in PKCS7 format or just a list of certificates 📜
• const char * keyfile — a file with the private key inside 🤫
• gnutls_x509_crt_fmt_t type — it's PEM or DER, pick your fighter 💅
• const char * pass — the password of the key 🔑
• unsigned int flags — an ORed sequence of gnutls_pkcs_encrypt_flags_t 🚩

---

👑 DESCRIPTION 👑

So this function sets a certificate/private key pair inside the gnutls_certificate_credentials_t type. Iconic. And no cap, you can call it more than once — that's for when a server has multiple keys/certificates and it's serving looks 💅

For clients that need to send more than just their own end entity certificate — like, say, also an intermediate CA cert — then the certfile must contain the ordered certificate chain. ordered, bestie, don't be chaotic 🌈

Also, heads up: the names in the certificate you provide will be considered when it's picking the right certificate to use, in case you've got multiple certificate/key pairs. it's a whole selection situation 👀

This function can also accept URLs at keyfile and certfile. In that case it'll use the private key and certificate that the URLs point to. The supported URLs are the ones indicated by gnutls_url_is_supported(), iykyk. And here's the tea: before GnuTLS 3.4.0, when a URL was specified, the pass part was ignored and a PIN callback had to be registered — but that is no longer the case in current releases. glow-up confirmed 💖

In case the certfile is provided as a PKCS 11 URL, then the certificate and its present issuers in the token get imported, which means it's forming the required trust chain 🔗

⚠️ okay this part is important: if that function fails to load, the res structure is at an undefined state, and it must not be reused to load other keys or certificates. dead it. do not recycle. 💀

And another thing — by default this function returns zero on success and a negative value on error. But since 3.5.6, when the flag GNUTLS_CERTIFICATE_API_V2 is set using gnutls_certificate_set_flags(), it returns an index (greater or equal to zero). That index can be used by other functions to refer to the added key-pair. main character index behavior fr fr 👑

---

⭐ RETURNS ⭐

On success this function returns zero, and otherwise a negative value on error — see above for how to modify that behavior 💖

---

🐛 REPORTING BUGS 🐛

Found a bug? Report it to <bugs@gnutls.org> 📬 Home page: https://www.gnutls.org

---

📜 COPYRIGHT 📜

Copyright © 2001-2023 Free Software Foundation, Inc., and others.

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. (respect the notice bestie, it's the rules 🫶)

---

🌈 SEE ALSO 🌈

The full documentation for gnutls is maintained as a Texinfo manual. If the /usr/share/doc/gnutls/ directory does not contain the HTML form, visit:

https://www.gnutls.org/manual/

---

and that's the whole page, bestie 💜 this came out of gnutls version 3.8.13, and the page name is that iconic gnutls_certifi..._x509_key_file2(3) title you saw at the top. mwah, go forth and load your keypairs responsibly 🎀✨