hx509_verify(3)

✨ NAME ✨

hx509_verify — hx509 verification functions

---

🎀 SYNOPSIS 🎀

Functions

void hx509_context_set_missing_revoke (hx509_context context, int flag)
int hx509_verify_init_ctx (hx509_context context, hx509_verify_ctx *ctx)
void hx509_verify_destroy_ctx (hx509_verify_ctx ctx)
void hx509_verify_attach_anchors (hx509_verify_ctx ctx, hx509_certs set)
void hx509_verify_attach_revoke (hx509_verify_ctx ctx, hx509_revoke_ctx
    revoke_ctx)
void hx509_verify_set_time (hx509_verify_ctx ctx, time_t t)
void hx509_verify_set_max_depth (hx509_verify_ctx ctx, unsigned int
    max_depth)
void hx509_verify_set_proxy_certificate (hx509_verify_ctx ctx, int
    boolean)
void hx509_verify_set_strict_rfc3280_verification (hx509_verify_ctx ctx,
    int boolean)
int hx509_verify_path (hx509_context context, hx509_verify_ctx ctx,
    hx509_cert cert, hx509_certs pool)
int hx509_ocsp_verify (hx509_context context, time_t now, hx509_cert
    cert, int flags, const void *data, size_t length, time_t
    *expiration)
int hx509_crl_alloc (hx509_context context, hx509_crl *crl)
int hx509_crl_add_revoked_certs (hx509_context context, hx509_crl crl,
    hx509_certs certs)
int hx509_crl_lifetime (hx509_context context, hx509_crl crl, int delta)
void hx509_crl_free (hx509_context context, hx509_crl *crl)
int hx509_crl_sign (hx509_context context, hx509_cert signer, hx509_crl
    crl, heim_octet_string *os)

---

💜 DETAILED DESCRIPTION 💜

okay so bestie... this section is literally empty in the original. No vibes, no notes, nothing. We move on. 💅

---

🔥 FUNCTION DOCUMENTATION 🔥

void hx509_context_set_missing_revoke (hx509_context context, int flag)

Picks whether hx509_revoke_verify() is gonna demand that a revocation method (OCSP, CRL) actually exists, or whether it'll be chill about it. Heads up tho — hx509_verify_path(), hx509_cms_verify_signed(), and some other functions all call hx509_revoke_verify(), so this flag has reach. 👑

Parameters

• context — the hx509 context you wanna flip the flag on.
• flag — zero means a revocation method is required; non-zero means a missing revocation method is ok.

---

int hx509_crl_add_revoked_certs (hx509_context context, hx509_crl crl, hx509_certs certs)

Adds revoked certificates to a CRL context. Like, adding names to the naughty list. 🚫📜

Parameters

• context — a hx509 context.
• crl — the CRL you're adding the revoked certificate to.
• certs — keyset of certificate to revoke.

Returns

An hx509 error code, see hx509_get_error_string().

---

int hx509_crl_alloc (hx509_context context, hx509_crl * crl)

Makes a CRL context. And when you're done with it? Use hx509_crl_free() to free the CRL context, periodt.

Parameters

• context — a hx509 context.
• crl — return pointer to a newly allocated CRL context.

Returns

An hx509 error code, see hx509_get_error_string().

---

void hx509_crl_free (hx509_context context, hx509_crl * crl)

Frees a CRL context. Clean up after yourself bestie, it's giving self-care. 🧖‍♀️

Parameters

• context — a hx509 context.
• crl — a CRL context to free.

---

int hx509_crl_lifetime (hx509_context context, hx509_crl crl, int delta)

Sets the lifetime of a CRL context. 🕰️

Parameters

• context — a hx509 context.
• crl — a CRL context
• delta — delta time the certificate is valid, library adds the current time to this.

Returns

An hx509 error code, see hx509_get_error_string().

---

int hx509_crl_sign (hx509_context context, hx509_cert signer, hx509_crl crl, heim_octet_string * os)

Signs a CRL and hands you back an encode certificate. Slay. ✍️

Parameters

• context — a hx509 context.
• signer — certificate to sign the CRL with
• crl — the CRL to sign
• os — return the signed and encoded CRL, free with free_heim_octet_string()

Returns

An hx509 error code, see hx509_get_error_string().

---

int hx509_ocsp_verify (hx509_context context, time_t now, hx509_cert cert, int flags, const void * data, size_t length, time_t * expiration)

Verifies that the certificate is part of the OCSP reply and that it's not expired.

fr fr, important caveat: this does NOT verify the signature of the OCSP reply, and it does not check that it was done by an authorized sender. That's assumed to be already done. So don't come for this function with problems it never claimed to solve. 💀

Parameters

• context — a hx509 context
• now — the time right now, if 0, use the current time.
• cert — the certificate to verify
• flags — flags control the behavior
• data — pointer to the encode ocsp reply
• length — the length of the encode ocsp reply
• expiration — return the time the OCSP will expire and need to be rechecked.

Returns

An hx509 error code, see hx509_get_error_string().

---

void hx509_verify_attach_anchors (hx509_verify_ctx ctx, hx509_certs set)

Sets the trust anchors in the verification context. It makes a reference to the keyset, so you can free the keyset independently of the destruction of the verification context (ctx). And if there's already a keyset attached? It gets released. Out with the old. 🦋

Parameters

• ctx — a verification context
• set — a keyset containing the trust anchors.

---

void hx509_verify_attach_revoke (hx509_verify_ctx ctx, hx509_revoke_ctx revoke_ctx)

Attaches a revocation context to the verification context. It makes a reference to the revoke context, so you can free the revoke context independently of the destruction of the verification context.

⚠️ If there is no revoke context, the verification process is NOT going to check any verification status. Not a drill.

Parameters

• ctx — a verification context.
• revoke_ctx — a revoke context.

---

void hx509_verify_destroy_ctx (hx509_verify_ctx ctx)

Frees an hx509 verification context. Bye bestie, you did amazing. 👋💖

Parameters

• ctx — the context to be freed.

---

int hx509_verify_init_ctx (hx509_context context, hx509_verify_ctx * ctx)

Allocates a verification context, which is what you use to control the verification process. Main character energy for the whole verification pipeline ngl.

Parameters

• context — A hx509 context.
• ctx — returns a pointer to a hx509_verify_ctx object.

Returns

An hx509 error code, see hx509_get_error_string().

---

int hx509_verify_path (hx509_context context, hx509_verify_ctx ctx, hx509_cert cert, hx509_certs pool)

Builds and verifies the path for the certificate to the trust anchor specified in the verify context. The path is constructed from the certificate, the pool, and the trust anchors. Chain building, but make it fashion. 🔗✨

Parameters

• context — A hx509 context.
• ctx — A hx509 verification context.
• cert — the certificate to build the path from.
• pool — A keyset of certificates to build the chain from.

Returns

An hx509 error code, see hx509_get_error_string().

---

void hx509_verify_set_max_depth (hx509_verify_ctx ctx, unsigned int max_depth)

Sets the maximum depth of the certificate chain that the path builder is going to try. How deep can we go?? 🌊

Parameters

• ctx — a verification context
• max_depth — maxium depth of the certificate chain, include trust anchor.

---

void hx509_verify_set_proxy_certificate (hx509_verify_ctx ctx, int boolean)

Allows or denies the use of proxy certificates. 🎭

Parameters

• ctx — a verification context
• boolean — if non zero, allow proxy certificates.

---

void hx509_verify_set_strict_rfc3280_verification (hx509_verify_ctx ctx, int boolean)

Selects strict RFC3280 verification of certificiates. This means checking key usage on CA certificates.

🚨 And the consequence? This will make version 1 certificiates unuseable. Yes, really. No cap.

Parameters

• ctx — a verification context
• boolean — if non zero, use strict verification.

---

void hx509_verify_set_time (hx509_verify_ctx ctx, time_t t)

Sets the clock time that the verification process is going to use. It's for checking certificates in the past and future time. If you don't set it, the current time will be used. Time travel, but legal. ⏳🌈

Parameters

• ctx — a verification context.
• t — the time the verifiation is using.

---

🌟 AUTHOR 🌟

Generated automatically by Doxygen for Heimdal x509 library from the source code. (Yes, a robot wrote it. We respect the robot. 🫶)

---

and that's the whole page, bestie!! this absolute icon of a manpage is from Version 7.8.0, dated Tue Nov 15 2022, and it's the hx509_verify(3) page from the Heimdal x509 library. read it, love it, verify responsibly. 💖🎀🦋🌸💅👑