GNUTLS_X509_CRT_GET_NAME_CONSTRAINTS(3)

📦
version 3.8.13 · 7 versions
, in alpine 3.22, alpine 3.23, alpine 3.24, arch rolling, fedora 43, fedora 44, ubuntu stonking

💖 gnutls_x509_crt_get_name_constraints — the manual page, but make it make sense 💖

okay bestie, so this is a page from the gnutls manual, and it's about the function gnutls_x509_crt_get_name_constraints. yes the name is a whole mouthful, we're gonna get through it together 🫶

✨ NAME ✨

gnutls_x509_crt_get_name_constraints — it's an API function, bestie. that's the whole name section. slay.

🌸 SYNOPSIS 🌸

#include <gnutls/x509.h>

int gnutls_x509_crt_get_name_constraints(gnutls_x509_crt_t crt,
gnutls_x509_name_constraints_t nc, unsigned int flags, unsigned int *
critical);

like yes it's four arguments, no it's not that deep, keep reading 💅

🎀 ARGUMENTS 🎀

  • gnutls_x509_crt_t crt — this one should contain a gnutls_x509_crt_t type. that's what the page says and i'm not gonna lie to you. it's your cert, girl, hand it over.
  • gnutls_x509_name_constraints_t nc — the nameconstraints intermediate type. this is the lil container where the good stuff lands.
  • unsigned int flags — it's either zero, or GNUTLS_EXT_FLAG_APPEND. pick your fighter.
  • unsigned int * critical — the extension status. pointer, so it writes back to you. main character behaviour, honestly.

💜 DESCRIPTION 💜

so this function will return an intermediate type that contains the name constraints of the CA certificate you handed it. that structure is the whole point: you pair it up with gnutls_x509_name_constraints_check() to verify whether a server's name is actually in accordance with the constraints. vibe check for certificates, fr fr 🦋

now, the tea about flags 🍓 — when flags is set to GNUTLS_EXT_FLAG_APPEND, here's what happens:

  • if the nc structure is empty, this function behaves identically as if the flag was not set at all. no drama, no difference.
  • otherwise, if there are elements in the nc structure, then the constraints get merged with the existing constraints following RFC5280 p6.1.4. and specifically: excluded constraints will be appended, and permitted ones will be intersected. yes, exactly like that, i'm not paraphrasing, that's the rule 📜
⚠️ and this is the important one bestie: nc must be initialized prior to calling this function. do not skip this. do not pass go. initialize your nc. 💀

⭐ RETURNS ⭐

  • on success, GNUTLS_E_SUCCESS (0) is returned ✨
  • GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE if the extension is not present 🙈
  • otherwise, a negative error value. so like, if it's negative, it's not giving 💀

🌈 SINCE 🌈

3.3.0 — it's been here since 3.3.0, iconic, no cap 👑

💌 REPORTING BUGS 💌

found a bug? don't suffer in silence, tell the people:

Copyright © 2001-2023 Free Software Foundation, Inc., and others.

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. 🫶

🌟 SEE ALSO 🌟

The full documentation for gnutls is maintained as a Texinfo manual. If the /usr/share/doc/gnutls/ directory does not contain the HTML form, visit:

https://www.gnutls.org/manual/

and that's the whole page, bestie, you ate that 💅✨

this was gnutls version 3.8.13, signing off with love and correct name constraints 🎀🦋💖

📦 where this page comes from