x509-1.6.1: X509 reader and writer

LicenseBSD-style
MaintainerVincent Hanquez <vincent@snarc.org>
Stabilityexperimental
Portabilityunknown
Safe HaskellNone
LanguageHaskell98

Data.X509

Contents

Description

Read/Write X509 Certificate, CRL and their signed equivalents.

Follows RFC5280 / RFC6818

Synopsis

Types

type SignedCertificate = SignedExact Certificate Source

A Signed Certificate

type SignedCRL = SignedExact CRL Source

A Signed CRL

data Certificate Source

X.509 Certificate type.

This type doesn't include the signature, it's describe in the RFC as tbsCertificate.

Constructors

Certificate 

Fields

certVersion :: Int

Version

certSerial :: Integer

Serial number

certSignatureAlg :: SignatureALG

Signature algorithm

certIssuerDN :: DistinguishedName

Issuer DN

certValidity :: (DateTime, DateTime)

Validity period (UTC)

certSubjectDN :: DistinguishedName

Subject DN

certPubKey :: PubKey

Public key

certExtensions :: Extensions

Extensions

data PubKey Source

Public key types known and used in X.509

Constructors

PubKeyRSA PublicKey

RSA public key

PubKeyDSA PublicKey

DSA public key

PubKeyDH (Integer, Integer, Integer, Maybe Integer, ([Word8], Integer))

DH format with (p,g,q,j,(seed,pgenCounter))

PubKeyECDSA CurveName ByteString 
PubKeyUnknown OID ByteString

unrecognized format

data PrivKey Source

Private key types known and used in X.509

Constructors

PrivKeyRSA PrivateKey

RSA private key

PrivKeyDSA PrivateKey

DSA private key

Instances

pubkeyToAlg :: PubKey -> PubKeyALG Source

Convert a Public key to the Public Key Algorithm type

privkeyToAlg :: PrivKey -> PubKeyALG Source

Convert a Public key to the Public Key Algorithm type

data PubKeyALG Source

Public Key Algorithm

Constructors

PubKeyALG_RSA

RSA Public Key algorithm

PubKeyALG_DSA

DSA Public Key algorithm

PubKeyALG_ECDSA

ECDSA Public Key algorithm

PubKeyALG_DH

Diffie Hellman Public Key algorithm

PubKeyALG_Unknown OID

Unknown Public Key algorithm

data SignatureALG Source

Signature Algorithm often composed of a public key algorithm and a hash algorithm

class Extension a where Source

Extension class.

each extension have a unique OID associated, and a way to encode and decode an ASN1 stream.

Common extension usually found in x509v3

data ExtSubjectKeyId Source

Provide a way to identify a public key by a short hash.

data ExtSubjectAltName Source

Provide a way to supply alternate name that can be used for matching host name.

Constructors

ExtSubjectAltName [AltName] 

data ExtAuthorityKeyId Source

Provide a mean to identify the public key corresponding to the private key used to signed a certificate.

data AltName Source

Different naming scheme use by the extension.

Not all name types are available, missing: otherName x400Address directoryName ediPartyName registeredID

data DistributionPoint Source

Distribution point as either some GeneralNames or a DN

Accessor turning extension into a specific one

extensionGet :: Extension a => Extensions -> Maybe a Source

Get a specific extension from a lists of raw extensions

extensionGetE :: Extension a => Extensions -> Maybe (Either String a) Source

Get a specific extension from a lists of raw extensions

extensionDecode :: Extension a => ExtensionRaw -> Maybe (Either String a) Source

Try to decode an ExtensionRaw.

If this function return: * Nothing, the OID doesn't match * Just Left, the OID matched, but the extension couldn't be decoded * Just Right, the OID matched, and the extension has been succesfully decoded

extensionEncode :: Extension a => Bool -> a -> ExtensionRaw Source

Encode an Extension to extensionRaw

data ExtensionRaw Source

An undecoded extension

Constructors

ExtensionRaw 

Fields

extRawOID :: OID

OID of this extension

extRawCritical :: Bool

if this extension is critical

extRawASN1 :: [ASN1]

the associated ASN1

Certificate Revocation List (CRL)

data RevokedCertificate Source

Describe a revoked certificate identifiable by serial number.

Naming

data DnElement Source

Elements commonly available in a DistinguishedName structure

Constructors

DnCommonName

CN

DnCountry

Country

DnOrganization

O

DnOrganizationUnit

OU

DnEmailAddress

Email Address (legacy)

getDnElement :: DnElement -> DistinguishedName -> Maybe ASN1CharacterString Source

Try to get a specific element in a DistinguishedName structure

Certificate Chain

newtype CertificateChain Source

A chain of X.509 certificates in exact form.

newtype CertificateChainRaw Source

Represent a chain of X.509 certificates in bytestring form.

marshall between CertificateChain and CertificateChainRaw

decodeCertificateChain :: CertificateChainRaw -> Either (Int, String) CertificateChain Source

Decode a CertificateChainRaw into a CertificateChain if every raw certificate are decoded correctly, otherwise return the index of the failed certificate and the error associated.

encodeCertificateChain :: CertificateChain -> CertificateChainRaw Source

Convert a CertificateChain into a CertificateChainRaw

Signed types and marshalling

data (Show a, Eq a, ASN1Object a) => Signed a Source

Represent a signed object using a traditional X509 structure.

When dealing with external certificate, use the SignedExact structure not this one.

Constructors

Signed 

Fields

signedObject :: a

Object to sign

signedAlg :: SignatureALG

Signature Algorithm used

signedSignature :: ByteString

Signature as bytes

Instances

(Eq a, Show a, ASN1Object a) => Eq (Signed a) 
(Eq a, Show a, ASN1Object a) => Show (Signed a) 

data (Show a, Eq a, ASN1Object a) => SignedExact a Source

Represent the signed object plus the raw data that we need to keep around for non compliant case to be able to verify signature.

Instances

(Eq a, Show a, ASN1Object a) => Eq (SignedExact a) 
(Eq a, Show a, ASN1Object a) => Show (SignedExact a) 

getSigned :: SignedExact a -> Signed a Source

get the decoded Signed data

getSignedData :: (Show a, Eq a, ASN1Object a) => SignedExact a -> ByteString Source

Get the signed data for the signature

objectToSignedExact Source

Arguments

:: (Show a, Eq a, ASN1Object a) 
=> (ByteString -> (ByteString, SignatureALG, r))

signature function

-> a

object to sign

-> (SignedExact a, r) 

Transform an object into a SignedExact object

encodeSignedObject :: SignedExact a -> ByteString Source

The raw representation of the whole signed structure

decodeSignedObject :: (Show a, Eq a, ASN1Object a) => ByteString -> Either String (SignedExact a) Source

Try to parse a bytestring that use the typical X509 signed structure format

Parametrized Signed accessor

getCertificate :: SignedCertificate -> Certificate Source

Get the Certificate associated to a SignedCertificate

getCRL :: SignedCRL -> CRL Source

Get the CRL associated to a SignedCRL

decodeSignedCertificate :: ByteString -> Either String SignedCertificate Source

Try to decode a bytestring to a SignedCertificate

decodeSignedCRL :: ByteString -> Either String SignedCRL Source

Try to decode a bytestring to a SignedCRL

Hash distinguished names related function

hashDN :: DistinguishedName -> ByteString Source

Make an OpenSSL style hash of distinguished name

OpenSSL algorithm is odd, and has been replicated here somewhat. only lower the case of ascii character.

hashDN_old :: DistinguishedName -> ByteString Source

Create an openssl style old hash of distinguished name