gnutls_x509_trust_list_add_crls(3)

📦
version 3.8.13 · 7 versions
, in alpine 3.22, alpine 3.23, alpine 3.24, arch rolling, fedora 43, fedora 44, ubuntu stonking

💖 gnutls_x509_trust_list_add_crls(3) 💖

okay bestie, so this page lives in the gnutls manual, and it's literally the glow-up moment where you teach your trust list about certificate revocation lists. CRLs, for the uninitiated. yes, the messy part. let's get into it 🎀

✨ NAME ✨

gnutls_x509_trust_list_add_crls — it's an API function, babes. that's the whole name. 💅

🦋 SYNOPSIS 🦋

#include <gnutls/x509.h>

int gnutls_x509_trust_list_add_crls(gnutls_x509_trust_list_t list, const
gnutls_x509_crl_t * crl_list, unsigned crl_size, unsigned int flags,
unsigned int verification_flags);

like, copy that exactly, do not freestyle it, i am watching 👀

🌸 ARGUMENTS 🌸

  • gnutls_x509_trust_list_t list — the list, bestie. the whole point. the main character.
  • const gnutls_x509_crl_t * crl_list — a list of CRLs. yes, a list inside a list, it's giving inception 🌀
  • unsigned crl_size — the length of that CRL list. count them. all of them.
  • unsigned int flags — flags from gnutls_trust_list_flags_t
  • unsigned int verification_flags — gnutls_certificate_verify_flags, but ONLY if flags specifies GNUTLS_TL_VERIFY_CRL. otherwise it's just... sitting there. chilling.

💜 DESCRIPTION 💜

so what does this actually do? it adds the given certificate revocation lists to the trusted list. that's it. that's the function. slay 💅

⚠️ but listen: the CRLs in crl_list must not be deinitialized during the lifetime of list. not even a little. no cap. if you deinit them early you're on your own, and the vibes will be rancid.

also, this function must be called after gnutls_x509_trust_list_add_cas() — that's how the CRLs get verified for validity. it's an order-of-operations thing, and the order is not negotiable, fr fr.

now, if the flag GNUTLS_TL_NO_DUPLICATES is given, then the final CRL list will not contain duplicate entries. clean. tidy. iconic. ✨

and, hmm, here's the part that lowkey catches people: if the flag GNUTLS_TL_NO_DUPLICATES is given, gnutls_x509_trust_list_deinit() must be called with parameter all being 1. yes, 1. remember it. write it on your hand. 🫶

if the flag GNUTLS_TL_VERIFY_CRL is given, the CRLs get verified before being added — and if verification fails, they get skipped. not added. ghosted. 💀

🌈 RETURNS 🌈

it returns the number of added elements. and heads up, that count includes duplicate entries. so don't come at me like "why is the number bigger than my list", bestie, that's literally documented. 😌

⭐ SINCE ⭐

3.0 — an elder. a legend. been here since the jump. 👑

🐛 REPORTING BUGS 🐛

found a bug? don't suffer in silence, tell the people:

Copyright © 2001-2023 Free Software Foundation, Inc., and others.

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved.

(translation: free to share, just keep the receipts 💖)

👀 SEE ALSO 👀

the full documentation for gnutls is maintained as a Texinfo manual. if the /usr/share/doc/gnutls/ directory does not contain the HTML form, visit:

https://www.gnutls.org/manual/

and that's the whole page, bestie. go forth and add those CRLs responsibly 💅✨

this was brought to you by gnutls 3.8.13, mwah 😘

📦 where this page comes from