OSSL_CRMF_MSG_SET0_VALIDITY(3SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

💖 OSSL_CRMF_MSG_SET0_VALIDITY 💖 (man page 3SSL, courtesy of OpenSSL)

okay bestie, sit DOWN, because this is the CRMF glow-up page 🎀 — all the little functions that fill in and verify your CertReqMsg structures. no cap, it's giving "PKI but make it cute".

✨ NAME ✨

OSSL_CRMF_MSG_set0_validity, OSSL_CRMF_MSG_set_certReqId, OSSL_CRMF_CERTTEMPLATE_fill, OSSL_CRMF_MSG_set0_extensions, OSSL_CRMF_MSG_push0_extension, OSSL_CRMF_MSG_create_popo, OSSL_CRMF_MSGS_verify_popo — the lil squad of functions that populate and verify CRMF CertReqMsg structures 💅

🌸 SYNOPSIS 🌸

#include <openssl/crmf.h>

int OSSL_CRMF_MSG_set0_validity(OSSL_CRMF_MSG *crm,
                                ASN1_TIME *notBefore, ASN1_TIME *notAfter);

int OSSL_CRMF_MSG_set_certReqId(OSSL_CRMF_MSG *crm, int rid);

int OSSL_CRMF_CERTTEMPLATE_fill(OSSL_CRMF_CERTTEMPLATE *tmpl,
                                EVP_PKEY *pubkey,
                                const X509_NAME *subject,
                                const X509_NAME *issuer,
                                const ASN1_INTEGER *serial);

int OSSL_CRMF_MSG_set0_extensions(OSSL_CRMF_MSG *crm, X509_EXTENSIONS *exts);

int OSSL_CRMF_MSG_push0_extension(OSSL_CRMF_MSG *crm, X509_EXTENSION *ext);

int OSSL_CRMF_MSG_create_popo(int meth, OSSL_CRMF_MSG *crm,
                              EVP_PKEY *pkey, const EVP_MD *digest,
                              OSSL_LIB_CTX *libctx, const char *propq);

int OSSL_CRMF_MSGS_verify_popo(const OSSL_CRMF_MSGS *reqs,
                               int rid, int acceptRAVerified,
                               OSSL_LIB_CTX *libctx, const char *propq);

🦋 DESCRIPTION 🦋

the validity moment ⏰

OSSL_CRMF_MSG_set0_validity() sets the notBefore and notAfter fields as validity constraints in the certTemplate of crm. and listen — either of the notBefore and notAfter params can be NULL, which just means "no constraint for that field, she's free ✨". on success, ownership of notBefore and notAfter gets transferred to crm, so don't you dare free them yourself after. it's their moment now.

the certReqId moment 🔢

OSSL_CRMF_MSG_set_certReqId() sets rid as the certReqId of crm. short, sweet, iconic.

the fill moment 🧁

OSSL_CRMF_CERTTEMPLATE_fill() fills in those fields of the certTemplate tmpl for which you actually handed over non-NULL values: pubkey, subject, issuer, and/or serial. X.509 extensions? those get set with OSSL_CRMF_MSG_set0_extensions(), different function, different vibe.

on success:

  • the reference counter of pubkey (if given) gets incremented ⬆️
  • while subject, issuer, and serial (if given) get copied 📋

the extensions moment 🎀

OSSL_CRMF_MSG_set0_extensions() sets exts as the extensions in the certTemplate of crm. it frees any pre-existing ones (bye girl 👋) and consumes exts.

the push moment 🫶

OSSL_CRMF_MSG_push0_extension() pushes the X509 extension ext to the extensions in the certTemplate of crm. and yes, it consumes ext too.

the POPO moment 👑

OSSL_CRMF_MSG_create_popo() creates and sets the Proof-of-Possession (POPO) according to the method meth in crm. the library context libctx and property query string propq may be NULL to select the defaults, no stress.

if meth is OSSL_CRMF_POPO_SIGNATURE, the POPO is calculated using the private key pkey and the digest method digest — and heads up, the digest argument is ignored if pkey is of a type (such as Ed25519 and Ed448) that's implicitly associated with a digest algorithm. she already knows her digest, ok? 💅

meth can be one of these:

  • OSSL_CRMF_POPO_NONE — RFC 4211, section 4, POP field omitted. CA/RA uses an out-of-band method to verify POP. note that servers may fail in this case, resulting for instance in HTTP error code 500 (Internal error). 💀 not the 500.
  • OSSL_CRMF_POPO_RAVERIFIED — RFC 4211, section 4, explicit indication that the RA has already verified the POP. she's pre-verified, trust.
  • OSSL_CRMF_POPO_SIGNATURE — RFC 4211, section 4.1, only case 3 supported so far.
  • OSSL_CRMF_POPO_KEYENC — RFC 4211, section 4.2, only the indirect method (subsequentMessage/enccert) is supported; challenge-response exchange (challengeResp) is not yet supported. 🙈
  • OSSL_CRMF_POPO_KEYAGREE — RFC 4211, section 4.3, not yet supported. waiting room energy.

the verify moment 🔍

OSSL_CRMF_MSGS_verify_popo verifies the Proof-of-Possession of the request with the given rid in the list of reqs. optionally accepts RAVerified. it can make use of the library context libctx and property query string propq. she checks, she confirms, she moves on. ✨

🍓 RETURN VALUES 🍓

all these functions return 1 on success, 0 on error. that's it. binary bestie. periodt.

🌈 SEE ALSO 🌈

RFC 4211 — go read it, iykyk 📖

💜 HISTORY 💜

the OpenSSL CRMF support was added in OpenSSL 3.0. she's not new new, but she's modern.

Copyright 2007-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie 🫶 mwah. this was version 4.0.3, dated 2026-09-29, from the OSSL_CRMF_MSG_SET0_VALIDITY(3SSL) manual. go forth and populate those CertReqMsg structures, you absolute icon 💖✨🎀

📦 where this page comes from