GNUTLS_CERTIFICATE_SET_X509_KEY_MEM2(3)

📦
version 3.8.13 · 7 versions
, in alpine 3.22, alpine 3.23, alpine 3.24, arch rolling, fedora 43, fedora 44, ubuntu stonking

✨ gnutls_certificate_set_x509_key_mem2 ✨

okay bestie, so this one lives in the gnutls manual, and it's literally the glow-up version of putting your cert + private key together in memory. no files needed, no drama, just vibes and a passphrase. let's get into it 🎀

🌸 NAME 🌸

gnutls_certificate_set_x509_key_mem2 — API function 💅

🦋 SYNOPSIS 🦋

#include <gnutls/gnutls.h>

int
gnutls_certificate_set_x509_key_mem2(gnutls_certificate_credentials_t
res, const gnutls_datum_t * cert, const gnutls_datum_t * key,
gnutls_x509_crt_fmt_t type, const char * pass, unsigned int flags);

like yes, it's a whole mouthful, we know. copy it exactly, don't freestyle it 😭

💖 ARGUMENTS 💖

  • gnutls_certificate_credentials_t res — this is a gnutls_certificate_credentials_t type. it's the lil container everything gets stuffed into, main character energy fr.
  • const gnutls_datum_t * cert — holds a certificate list (path) for the private key you're matching it up with 🔑
  • const gnutls_datum_t * key — the private key itself, or NULL. yes, NULL is allowed, keep reading.
  • gnutls_x509_crt_fmt_t type — it's PEM or DER, pick your fighter ✨
  • const char * pass — the key's password 🫶
  • unsigned int flags — an ORed sequence of gnutls_pkcs_encrypt_flags_t (yes, OR them together, go off)

🌈 DESCRIPTION 🌈

so basically this function sets a certificate/private key pair inside your gnutls_certificate_credentials_t type. and the way that it's totally fine to call this more than once if you've got multiple keys/certificates hanging around for the server?? iconic. multiple keys, multiple calls, no cap.

also note that the keyUsage (2.5.29.15) PKIX extension in X.509 certificates is supported. which means, real talk: certificates intended for signing cannot be used for ciphersuites that require encryption. they're just not built for that, and no amount of manifesting will change it 💀

if the certificate and the private key are given in PEM encoding, then the strings that hold their values must be null terminated. periodt. don't forget the null terminator, that's the whole ballgame.

and the key may be NULL if you're using a sign callback — go peek at gnutls_sign_callback_set() for that whole situation 🧚

okay and here's the fun part: this function by default returns zero on success and a negative value on error. BUT, since 3.5.6, when the flag GNUTLS_CERTIFICATE_API_V2 is set using gnutls_certificate_set_flags(), it instead returns an index (greater or equal to zero). that index can be handed to other functions so they can refer to the key-pair you just added. glow-up behavior honestly 👑

⭐ RETURNS ⭐

on success this function returns zero, and otherwise a negative value on error (scroll up if you wanna know how to modify that behavior, bestie — it's the GNUTLS_CERTIFICATE_API_V2 thing).

🙈 REPORTING BUGS 🙈

found a bug? tell the people:

Copyright © 2001-2023 Free Software Foundation, Inc., and others.

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved.

🔥 SEE ALSO 🔥

the full documentation for gnutls is maintained as a Texinfo manual. if the /usr/share/doc/gnutls/ directory does not contain the HTML form, go visit:

https://www.gnutls.org/manual/

and that's the whole page, bestie!! 💜 this was gnutls version 3.8.13, brought to you by the gnutls girlies. go set those keys, stay null-terminated, and slay 🎀✨🦋

📦 where this page comes from