Pike v8.1 release 6

Method Tools.X509.verify_certificate_chain()


Method verify_certificate_chain

mapping verify_certificate_chain(array(string) cert_chain, mapping authorities, int|void require_trust)

Description

Decodes a certificate chain, checks the signatures. Verifies that the chain is unbroken, and that all certificates are in effect (time-wise.)

Returns a mapping with the following contents, depending on the verification of the certificate chain:

"error_code" : int

Error describing type of verification failure, if verification failed. May be one of the following: CERT_TOO_NEW, CERT_TOO_OLD, CERT_ROOT_UNTRUSTED, CERT_BAD_SIGNATURE, CERT_INVALID, CERT_UNAUTHORIZED_CA or CERT_CHAIN_BROKEN

"error_cert" : int

Index number of the certificate that caused the verification failure.

"self_signed" : bool

Non-zero if the certificate is self-signed.

"verified" : bool

Non-zero if the certificate is verified.

"authority" : string

Standards.ASN1.Sequence of the authority RDN that verified the chain.

"cn" : string

Standards.ASN1.Sequence of the common name RDN of the leaf certificate.

Parameter cert_chain

An array of certificates, with the relative-root last. Each certificate should be a DER-encoded certificate.

Parameter authorities

A mapping from (DER-encoded) names to verifiers.

Parameter require_trust

Require that the certificate be traced to an authority, even if it is self signed.

See Standards.PKCS.Certificate.get_dn_string for converting the RDN to an X500 style string.