ssl_crl_cache_api(3erl)

okay bestie, welcome to ssl_crl_cache_api(3erl) — the Erlang module definition page for the TLS CRL cache API 💅✨

✨ NAME ✨

This module is literally the API for a TLS CRL (Certificate Revocation List) cache — the whole revoked-cert storage situation 🎀

💖 DESCRIPTION 💖

okay so real talk: when TLS does certificate path validation according to RFC 5280, it should also do CRL validation checks. To turn those CRL checks on, the application needs access to CRLs. A database of CRLs can be set up in many different ways — no single canonical vibe. This module provides the behavior of the API needed to integrate an arbitrary CRL cache with the erlang ssl application. It is also used by the application itself to provide a simple default implementation of a CRL cache. periodt. 💅

🌸 DATA TYPES 🌸

• crl_cache_ref() = any() — this is a reference to the CRL cache, simple as that 🫶
• dist_point() = #'DistributionPoint'{} — for description see X509 certificates records. iykyk 🦋
• logger_info() — Information for ssl applications use of Logger(3erl). The exact shape is:

logger_info() =
    {logger:level(),
     Report :: #{description => string(), reason => term()},
     logger:metadata()}

👑 EXPORTS 👑

bestie, these are the callbacks you can implement — every argument and return value matters 💅

💖 Module:fresh_crl/2

Module:fresh_crl(DistributionPoint, CRL) -> FreshCRL
Module:fresh_crl(DistributionPoint, CRL) -> FreshCRL | {LoggerInfo,
FreshCRL}

Types:

DistributionPoint =  dist_point()
CRL = [public_key:der_encoded()]
FreshCRL = [public_key:der_encoded()]
LoggerInfo = {logger,  logger_info() }}

fun fresh_crl/2 will be used as input option update_crl to public_key:pkix_crls_validate/3. slay ✨

It is possible to return logger info that will be used by the TLS connection to produce log events. log events, bestie 📝

💅 Module:lookup

Module:lookup(DistributionPoint, Issuer, DbHandle) -> not_available |
CRLs | {LoggerInfo, CRLs}
Module:lookup(DistributionPoint, Issuer, DbHandle) -> not_available |
CRLs
Module:lookup(DistributionPoint, DbHandle) -> not_available | CRLs

Types:

DistributionPoint =  dist_point()
Issuer = public_key:issuer_name()
DbHandle =  crl_cache_ref()
CRLs = [public_key:der_encoded()]
LoggerInfo = {logger,  logger_info() }}

Lookup the CRLs belonging to the distribution point Distributionpoint. This function may choose to only look in the cache or to follow distribution point links depending on how the cache is administrated. cache politics, honestly 🫠

The Issuer argument contains the issuer name of the certificate to be checked. Normally the returned CRL should be issued by this issuer, except if the cRLIssuer field of DistributionPoint has a value, in which case that value should be used instead. read that twice, bestie 👑

In an earlier version of this API, the lookup function received two arguments, omitting Issuer. For compatibility, this is still supported: if there is no lookup/3 function in the callback module, lookup/2 is called instead. compatibility era 🕰️

It is possible to return logger info that will be used by the TLS connection to produce log events. logger info stays winning 🌈

🎀 Module:select/2

Module:select(Issuer, DbHandle) -> CRLs | {LoggerInfo, CRLs}
Module:select(Issuer, DbHandle) -> CRLs

Types:

Issuer = public_key:issuer_name() | list()
DbHandle =  cache_ref()
LoggerInfo = {logger,  logger_info() }

Select the CRLs in the cache that are issued by Issuer unless the value is a list of so called general names, see X509 certificates records, originating form #'DistributionPoint'.cRLissuer and representing different mechanism to obtain the CRLs. the plot thickens 🦋

The cache callback needs to use the appropriate entry to retrieve the CRLs or return an empty list if it does not exist. empty list is a valid vibe 💅

It is possible to return logger info that will be used by the TLS connection to produce log events. we love a logging moment ✨

---

okay bestie, that's the whole page! brought to you by Ericsson AB, ssl 10.9.1.3, and ssl_crl_cache_api(3erl) — catch you in the group chat 🫶✨💅