Z.Crypto.X509

X.509 Certificates read, write and verification.

X509 Certificates

data Cert

An opaque newtype wrapper for an X.509 certificate.

A certificate is a binding between some identifying information (called a subject) and a public key. This binding is asserted by a signature on the certificate, which is placed there by some authority (the issuer) that at least claims that it knows the subject named in the certificate really “owns” the private key corresponding to the public key in the certificate.

The major certificate format in use today is X.509v3, used for instance in the Transport Layer Security (TLS) protocol. A X.509 certificate is represented by the type Cert.

Instances

Show Cert

Defined in Z.Crypto.X509

Methods

showsPrec :: Int -> Cert -> ShowS

show :: Cert -> String

showList :: [Cert] -> ShowS

Generic Cert

Defined in Z.Crypto.X509

Associated Types

type Rep Cert :: Type -> Type

Methods

from :: Cert -> Rep Cert x

to :: Rep Cert x -> Cert

Print Cert

Defined in Z.Crypto.X509

Methods

toUTF8BuilderP :: Int -> Cert -> Builder ()

type Rep Cert

Defined in Z.Crypto.X509

type Rep Cert = D1 ('MetaData "Cert" "Z.Crypto.X509" "Z-Botan-0.3.1.0-GbapUVQUdq6A2uFR3TMVx6" 'True) (C1 ('MetaCons "Cert" 'PrefixI 'True) (S1 ('MetaSel ('Just "certStruct") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedLazy) (Rec0 BotanStruct)))

withCert :: Cert -> (BotanStructT -> IO r) -> IO r

Use Cert as a botan_cert_t.

loadCert :: HasCallStack => Bytes -> IO Cert

Load a certificate from the DER or PEM representation.

loadCertFile :: HasCallStack => CBytes -> IO Cert

Load a certificate from a file.

dupCert :: HasCallStack => Cert -> IO Cert

Create a new object that refers to the same certificate.

read X509 field

certStart :: Cert -> IO Word64

Return the time the certificate becomes valid, as seconds since epoch.

certExpire :: Cert -> IO Word64

Return the time the certificate expires, as SystemTime.

certStart' :: Cert -> IO SystemTime

Return the time the certificate becomes valid.

certExpire' :: Cert -> IO SystemTime

Return the time the certificate expires, as SystemTime.

certStartText :: Cert -> IO Text

Return the time the certificate becomes valid, as a Text in form “YYYYMMDDHHMMSSZ” where Z is a literal character reflecting that this time is relative to UTC.

certExpireText :: Cert -> IO Text

Return the time the certificate expires, as a Text in form “YYYYMMDDHHMMSSZ” where Z is a literal character reflecting that this time is relative to UTC.

certFingerPrint :: Cert -> HashType -> IO Text

Return the finger print of the certificate.

certSerial :: Cert -> IO Bytes

Return the serial number of the certificate.

certIDAuthority :: Cert -> IO Bytes

Return the authority key ID set in the certificate, which may be empty.

certIDSubject :: Cert -> IO Bytes

Return the subject key ID set in the certificate, which may be empty.

certPubBits :: Cert -> IO Bytes

Get the serialized representation of the public key included in this certificate.

certPubKey :: Cert -> IO PubKey

Get the public key included in this certificate.

certDNIssuer

Arguments

:: HasCallStack

=> Cert

-> CBytes

key

-> Int

index

-> IO Text

Get a value from the issuer DN field, throw exception if not exists.

certDNSubject

Arguments

:: HasCallStack

=> Cert

-> CBytes

key

-> Int

index

-> IO Text

Get a value from the subject DN field, throw exception if not exists.

certToText :: HasCallStack => Cert -> IO Text

Format the certificate as a free-form string.

certUsage :: HasCallStack => Cert -> KeyUsageConstraint -> IO ()

Change cert's KeyUsageConstraint.

verify certificate

verifyCert

Arguments

:: HasCallStack

=> [Cert]

Intermediate certificates, set to [] if not needed.

-> [Cert]

Trusted certificates, set to [] if not needed.

-> Int

Set required strength to indicate the minimum key and hash strength that is allowed, set to zero to use default(110).

-> CBytes

Hostname.

-> Word64

Set reference time(seconds since epoch) to be the time which the certificate chain is validated against. Use zero to use the current system clock.

-> Cert

The certificate to be verified.

-> IO (Maybe CBytes)

verifyCertCRL

Arguments

:: HasCallStack

=> [Cert]

Intermediate certificates, set to [] if not needed.

-> [Cert]

Trusted certificates, set to [] if not needed.

-> [CRL]

Certificate Revocation Lists, set to [] if not needed.

-> Int

Set required strength to indicate the minimum key and hash strength that is allowed, set to zero to use default(110).

-> CBytes

Hostname.

-> Word64

Set reference time(seconds since epoch) to be the time which the certificate chain is validated against. Use zero to use the current system clock.

-> Cert

The certificate to be verified.

-> IO (Maybe CBytes)

Certificate path validation supporting Certificate Revocation Lists.

Verify a certificate. Returns Nothing if validation was successful, 'Just reason' if unsuccessful.

verifyCertCRL'

Arguments

:: HasCallStack

=> [Cert]

Intermediate certificates, set to [] if not needed.

-> CertStore

Trusted certificates in CertStore

-> [CRL]

Certificate Revocation Lists, set to [] if not needed.

-> Int

Set required strength to indicate the minimum key and hash strength that is allowed, set to zero to use default(110).

-> CBytes

Hostname.

-> Word64

Set reference time(seconds since epoch) to be the time which the certificate chain is validated against. Use zero to use the current system clock.

-> Cert

The certificate to be verified.

-> IO (Maybe CBytes)

Certificate path validation supporting Certificate Revocation Lists with a CertStore.

Verify a certificate. Returns Nothing if validation was successful, 'Just reason' if unsuccessful.

CRL

data CRL

An opaque newtype wrapper for an X.509 Certificate Revocation Lists.

It will occasionally happen that a certificate must be revoked before its expiration date. Examples of this happening include the private key being compromised, or the user to which it has been assigned leaving an organization. Certificate revocation lists are an answer to this problem (though online certificate validation techniques are starting to become somewhat more popular). Every once in a while the CA will release a new CRL, listing all certificates that have been revoked. Also included is various pieces of information like what time a particular certificate was revoked, and for what reason. In most systems, it is wise to support some form of certificate revocation, and CRLs handle this easily.

Instances

Show CRL

Defined in Z.Crypto.X509

Methods

showsPrec :: Int -> CRL -> ShowS

show :: CRL -> String

showList :: [CRL] -> ShowS

Generic CRL

Defined in Z.Crypto.X509

Associated Types

type Rep CRL :: Type -> Type

Methods

from :: CRL -> Rep CRL x

to :: Rep CRL x -> CRL

Print CRL

Defined in Z.Crypto.X509

Methods

toUTF8BuilderP :: Int -> CRL -> Builder ()

type Rep CRL

Defined in Z.Crypto.X509

type Rep CRL = D1 ('MetaData "CRL" "Z.Crypto.X509" "Z-Botan-0.3.1.0-GbapUVQUdq6A2uFR3TMVx6" 'True) (C1 ('MetaCons "CRL" 'PrefixI 'True) (S1 ('MetaSel ('Just "crlStruct") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedLazy) (Rec0 BotanStruct)))

withCRL :: CRL -> (BotanStructT -> IO r) -> IO r

Use CRL as a botan_crl_t.

loadCRL :: HasCallStack => Bytes -> IO CRL

Load a CRL from the DER or PEM representation.

loadCRLFile :: HasCallStack => CBytes -> IO CRL

Load a CRL from a file.

isRevokedX509 :: HasCallStack => CRL -> Cert -> IO Bool

Check whether a given crl contains a given cert. Return True when the certificate is revoked, False otherwise.

CertStore

data CertStore

An opaque newtype wrapper for an X.509 Certificate Store based on botan's FlatFile_Certificate_Store.

Instances

Show CertStore

Defined in Z.Crypto.X509

Methods

showsPrec :: Int -> CertStore -> ShowS

show :: CertStore -> String

showList :: [CertStore] -> ShowS

Generic CertStore

Defined in Z.Crypto.X509

Associated Types

type Rep CertStore :: Type -> Type

Methods

from :: CertStore -> Rep CertStore x

to :: Rep CertStore x -> CertStore

Print CertStore

Defined in Z.Crypto.X509

Methods

toUTF8BuilderP :: Int -> CertStore -> Builder ()

type Rep CertStore

Defined in Z.Crypto.X509

type Rep CertStore = D1 ('MetaData "CertStore" "Z.Crypto.X509" "Z-Botan-0.3.1.0-GbapUVQUdq6A2uFR3TMVx6" 'True) (C1 ('MetaCons "CertStore" 'PrefixI 'True) (S1 ('MetaSel ('Just "certStoreStruct") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedLazy) (Rec0 BotanStruct)))

withCertStore :: CertStore -> (BotanStructT -> IO r) -> IO r

Use CertStore as a botan_x509_certstore_t.

loadCertStoreFile :: HasCallStack => CBytes -> IO CertStore

Load a CertStore from a file.

mozillaCertStore :: CertStore

The built-in mozilla CA CertStore.

This is a certstore extracted from Mozilla, see https://curl.se/docs/caextract.html.

systemCertStore :: CertStore

The CA CertStore on your system.

constants

type KeyUsageConstraint = CUInt

Certificate key usage constraints.

pattern NO_CONSTRAINTS :: KeyUsageConstraint

pattern DIGITAL_SIGNATURE :: KeyUsageConstraint

pattern NON_REPUDIATION :: KeyUsageConstraint

pattern KEY_ENCIPHERMENT :: KeyUsageConstraint

pattern DATA_ENCIPHERMENT :: KeyUsageConstraint

pattern KEY_AGREEMENT :: KeyUsageConstraint

pattern KEY_CERT_SIGN :: KeyUsageConstraint

pattern CRL_SIGN :: KeyUsageConstraint

pattern ENCIPHER_ONLY :: KeyUsageConstraint

pattern DECIPHER_ONLY :: KeyUsageConstraint