gnutls_pkcs12_simple_parse(3)

📦
version 3.8.13 · 7 versions
, in alpine 3.22, alpine 3.23, alpine 3.24, arch rolling, fedora 43, fedora 44, ubuntu stonking

💖 gnutls_pkcs12_simple_parse(3) 💖

okay bestie, welcome to the gnutls manual, and specifically to the page for gnutls_pkcs12_simple_parse — yes the whole thing, she's long but she ATE, trust me. this is the API function that goes into a PKCS12 blob and pulls out your key, your chain, your extras and your CRL. let's get into it 🫶

✨ NAME ✨

gnutls_pkcs12_simple_parse — it's an API function, periodt.

🌸 SYNOPSIS 🌸

#include <gnutls/pkcs12.h>

int gnutls_pkcs12_simple_parse(gnutls_pkcs12_t p12, const char *
password, gnutls_x509_privkey_t * key, gnutls_x509_crt_t ** chain,
unsigned int * chain_len, gnutls_x509_crt_t ** extra_certs, unsigned int
* extra_certs_len, gnutls_x509_crl_t * crl, unsigned int flags);

like look at all those parameters. she's doing a LOT. main character energy fr fr 💅

🎀 ARGUMENTS 🎀

  • gnutls_pkcs12_t p12 — a pkcs12 type. this is the blob, the whole vibe, the thing we're parsing.
  • const char * password — optional password used to decrypt the structure, the bags, and the keys. optional but like… if you need it you NEED it.
  • gnutls_x509_privkey_t * key — a structure to store the parsed private key. this is where your key goes 🗝️
  • gnutls_x509_crt_t ** chain — the certificate chain corresponding to key (may be NULL).
  • unsigned int * chain_len — will be updated with the number of additional certs (may be NULL). yes bestie the original really does just say "additional" and stop there. iconic of them honestly.
  • gnutls_x509_crt_t ** extra_certs — optional pointer to receive an array of additional certificates found in the PKCS12 structure (may be NULL).
  • unsigned int * extra_certs_len — will be updated with the number of additional certs (may be NULL).
  • gnutls_x509_crl_t * crl — an optional structure to store the parsed CRL (may be NULL).
  • unsigned int flags — should be zero or one of GNUTLS_PKCS12_SP_*. zero is valid, just so you know.

🦋 DESCRIPTION 🦋

so this function parses a PKCS12 structure in pkcs12 and extracts the private key, the corresponding certificate chain, any additional certificates, and a CRL. that's a lot of extraction, she's basically a spa day for your PKCS12 file ✨

BIG warning bestie: the structures in key, chain, crl, and extra_certs must not be initialized. like, don't pre-fill them, don't be cute about it, just hand them over empty.

the extra_certs and extra_certs_len parameters are optional and both may be set to NULL. but — and this is the catch — if either one is non-NULL, then both must be set. no halfsies. the value for extra_certs is allocated using gnutls_malloc(), so yes, you're responsible for that memory, go handle your business 🧚

Encrypted PKCS12 bags and PKCS8 private keys are supported, but only with password based security and the same password for all operations. one password to rule them all, no cap.

okay now the sad part 😭 — a PKCS12 structure may contain many keys and/or certificates, and there is no way to identify which key/certificate pair you want. for this reason this function is useful for PKCS12 files that contain only one key/certificate pair and/or one CRL. so like… if your file is messy, this function is not the one. she likes a simple girl.

if the provided structure has encrypted fields but no password is provided, then this function returns GNUTLS_E_DECRYPTION_FAILED. it's giving locked out of your own house 💀

also important: normally the chain constructed does not include self signed certificates, to comply with TLS' requirements. but if the flag GNUTLS_PKCS12_SP_INCLUDE_SELF_SIGNED is specified, then self signed certificates will be included in the chain. your choice, your rules 👑

don't skip this step: prior to using this function, the PKCS 12 structure integrity must be verified using gnutls_pkcs12_verify_mac(). verify first, parse second. order matters, always.

⭐ RETURNS ⭐

on success, GNUTLS_E_SUCCESS (0) is returned. otherwise a negative error value. negative = not slay, go read your error code.

🌈 SINCE 🌈

3.1.0 — she's been around a while, a true veteran of the API.

🙈 REPORTING BUGS 🙈

found a bug? don't be shy, report it to <bugs@gnutls.org>.

home page: https://www.gnutls.org

Copyright © 2001-2023 Free Software Foundation, Inc., and others.

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved.

💜 SEE ALSO 💜

the full documentation for gnutls is maintained as a Texinfo manual. if the /usr/share/doc/gnutls/ directory does not contain the HTML form, visit

https://www.gnutls.org/manual/

and that's the page bestie!! this was brought to you by gnutls, version 3.8.13, and it's gnutls_pkcs12_simple_parse(3) — go verify your MAC before you parse, mwah 💋

📦 where this page comes from