gnutls_x509_crq_sign2(3)

💖 gnutls_x509_crq_sign2 — the "okay bestie, seal the deal" function 💖

Okay so real talk, this is from the gnutls manual pages (the x509 corner of it), and it's the moment where your certificate request finally gets ✨signed✨. It's the glow-up finale. Let's get into it.

---

✨ SYNOPSIS ✨

#include <gnutls/x509.h>

int gnutls_x509_crq_sign2(gnutls_x509_crq_t crq, gnutls_x509_privkey_t key,
                          gnutls_digest_algorithm_t dig, unsigned int flags);

---

🎀 ARGUMENTS 🎀

• gnutls_x509_crq_t crq — bestie this should contain a gnutls_x509_crq_t type. That's the certificate request you're about to sign, the main character of this whole operation.
• gnutls_x509_privkey_t key — holds a private key. Yes, an actual private key. Guard it with your life, ngl.
• gnutls_digest_algorithm_t dig — the message digest to use, i.e., GNUTLS_DIG_SHA256. Pick your vibe.
• unsigned int flags — must be 0. That's it. Zero. No options, no extras, no sneaking anything in there. Periodt.

---

🌸 DESCRIPTION 🌸

This function signs the certificate request with a private key. And here's the tea: it has to be the same key as the one used in gnutls_x509_crt_set_key(), because a certificate request is self-signed. It's signing its own paperwork. Self-love, honestly. 💅

This also must be the last step in a certificate request generation, since every parameter you set before this point is now signed. Like, once you hit this, the ink is dry. No take-backs. So don't be out here setting stuff after.

⚠️ A known limitation of this function, and I need you to hear me on this one: a newly-signed request will not be fully functional (e.g., for signature verification) until it is exported and re-imported. The way that it needs a little round trip to become its true self. That's just how it is, no cap.

After GnuTLS 3.6.1, the value of dig may be GNUTLS_DIG_UNKNOWN, and in that case, a suitable but reasonable digest for the key algorithm will be selected for you. So if you're like "idk bestie, you pick," it will pick. 🫶

---

🦋 RETURNS 🦋

• GNUTLS_E_SUCCESS on success — slay, you did it 👑
• Otherwise, a negative error code. Sad girl hours 😭
• GNUTLS_E_ASN1_VALUE_NOT_FOUND is returned if you didn't set all the information in the certificate request (e.g., the version using gnutls_x509_crq_set_version()). Basically you skipped a step and it's calling you out. Fill in your whole form before you submit it, bestie.

---

🐛 REPORTING BUGS 🐛

Found a bug? Don't gatekeep, report it to <bugs@gnutls.org>.

Home page: https://www.gnutls.org

---

📜 COPYRIGHT 📜

Copyright © 2001-2023 Free Software Foundation, Inc., and others.

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved.

---

👀 SEE ALSO 👀

The full documentation for gnutls is maintained as a Texinfo manual. If the /usr/share/doc/gnutls/ directory does not contain the HTML form, visit:

https://www.gnutls.org/manual/

---

And that's the whole page, bestie!! This was GnuTLS version 3.8.13, and you just read gnutls_x509_crq_sign2(3) in its full, unfiltered, extremely-signable glory. Go forth and sign responsibly 💖✨🎀🦋