wolfSSL Certificates and Keys

Functions
int	wc_KeyPemToDer (const unsigned char *pem, int pemSz, unsigned char *buff, int buffSz, const char *pass)
	Converts a key in PEM format to DER format. More...
int	wc_CertPemToDer (const unsigned char *pem, int pemSz, unsigned char *buff, int buffSz, int type)
	This function converts a PEM formatted certificate to DER format. Calls OpenSSL function PemToDer. More...
int	wc_GetPubKeyDerFromCert (struct DecodedCert *cert, byte *derKey, word32 *derKeySz)
	This function gets the public key in DER format from a populated DecodedCert struct. Users must call wc_InitDecodedCert() and wc_ParseCert() before calling this API. wc_InitDecodedCert() accepts a DER/ASN.1 encoded certificate. To convert a PEM cert to DER, first use wc_CertPemToDer() before calling wc_InitDecodedCert(). More...
int	wolfSSL_CTX_use_certificate_file (WOLFSSL_CTX *ctx, const char *file, int format)
	This function loads a certificate file into the SSL context (WOLFSSL_CTX). The file is provided by the file argument. The format argument specifies the format type of the file, either SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. Please see the examples for proper usage. More...
int	wolfSSL_CTX_use_PrivateKey_file (WOLFSSL_CTX *ctx, const char *file, int format)
	This function loads a private key file into the SSL context (WOLFSSL_CTX). The file is provided by the file argument. The format argument specifies the format type of the file - SSL_FILETYPE_ASN1or SSL_FILETYPE_PEM. Please see the examples for proper usage. More...
int	wolfSSL_CTX_load_verify_locations (WOLFSSL_CTX *ctx, const char *file, const char *path)
	This function loads PEM-formatted CA certificate files into the SSL context (WOLFSSL_CTX). These certificates will be treated as trusted root certificates and used to verify certs received from peers during the SSL handshake. The root certificate file, provided by the file argument, may be a single certificate or a file containing multiple certificates. If multiple CA certs are included in the same file, wolfSSL will load them in the same order they are presented in the file. The path argument is a pointer to the name of a directory that contains certificates of trusted root CAs. If the value of file is not NULL, path may be specified as NULL if not needed. If path is specified and NO_WOLFSSL_DIR was not defined when building the library, wolfSSL will load all CA certificates located in the given directory. This function will attempt to load all files in the directory. This function expects PEM formatted CERT_TYPE file with header “--—BEGIN CERTIFICATE--—”. More...
int	wolfSSL_CTX_load_verify_locations_ex (WOLFSSL_CTX *ctx, const char *file, const char *path, unsigned int flags)
	This function loads PEM-formatted CA certificate files into the SSL context (WOLFSSL_CTX). These certificates will be treated as trusted root certificates and used to verify certs received from peers during the SSL handshake. The root certificate file, provided by the file argument, may be a single certificate or a file containing multiple certificates. If multiple CA certs are included in the same file, wolfSSL will load them in the same order they are presented in the file. The path argument is a pointer to the name of a directory that contains certificates of trusted root CAs. If the value of file is not NULL, path may be specified as NULL if not needed. If path is specified and NO_WOLFSSL_DIR was not defined when building the library, wolfSSL will load all CA certificates located in the given directory. This function will attempt to load all files in the directory based on flags specified. This function expects PEM formatted CERT_TYPE files with header “--—BEGIN CERTIFICATE--—”. More...
const char **	wolfSSL_get_system_CA_dirs (word32 *num)
	This function returns a pointer to an array of strings representing directories wolfSSL will search for system CA certs when wolfSSL_CTX_load_system_CA_certs is called. On systems that don't store certificates in an accessible system directory (such as Apple platforms), this function will always return NULL. More...
int	wolfSSL_CTX_load_system_CA_certs (WOLFSSL_CTX *ctx)
	On most platforms (including Linux and Windows), this function attempts to load CA certificates into a WOLFSSL_CTX from an OS-dependent CA certificate store. Loaded certificates will be trusted. More...
int	wolfSSL_CTX_use_certificate_chain_file (WOLFSSL_CTX *ctx, const char *file)
	This function loads a chain of certificates into the SSL context (WOLFSSL_CTX). The file containing the certificate chain is provided by the file argument, and must contain PEM-formatted certificates. This function will process up to MAX_CHAIN_DEPTH (default = 9, defined in internal.h) certificates, plus the subject cert. More...
int	wolfSSL_CTX_der_load_verify_locations (WOLFSSL_CTX *ctx, const char *file, int format)
	This function is similar to wolfSSL_CTX_load_verify_locations, but allows the loading of DER-formatted CA files into the SSL context (WOLFSSL_CTX). It may still be used to load PEM-formatted CA files as well. These certificates will be treated as trusted root certificates and used to verify certs received from peers during the SSL handshake. The root certificate file, provided by the file argument, may be a single certificate or a file containing multiple certificates. If multiple CA certs are included in the same file, wolfSSL will load them in the same order they are presented in the file. The format argument specifies the format which the certificates are in either, SSL_FILETYPE_PEM or SSL_FILETYPE_ASN1 (DER). Unlike wolfSSL_CTX_load_verify_locations, this function does not allow the loading of CA certificates from a given directory path. Note that this function is only available when the wolfSSL library was compiled with WOLFSSL_DER_LOAD defined. More...
void	wolfSSL_SetCertCbCtx (WOLFSSL *ssl, void *ctx)
	This function stores user CTX object information for verify callback. More...
void	wolfSSL_CTX_SetCertCbCtx (WOLFSSL_CTX *ctx, void *userCtx)
	This function stores user CTX object information for verify callback. More...
int	wolfSSL_CTX_save_cert_cache (WOLFSSL_CTX *ctx, const char *fname)
	This function writes the cert cache from memory to file. More...
int	wolfSSL_CTX_restore_cert_cache (WOLFSSL_CTX *ctx, const char *fname)
	This function persistes certificate cache from a file. More...
int	wolfSSL_CTX_memsave_cert_cache (WOLFSSL_CTX *ctx, void *mem, int sz, int *used)
	This function persists the certificate cache to memory. More...
int	wolfSSL_CTX_get_cert_cache_memsize (WOLFSSL_CTX *ctx)
	Returns the size the certificate cache save buffer needs to be. More...
char *	wolfSSL_X509_NAME_oneline (WOLFSSL_X509_NAME *name, char *in, int sz)
	This function copies the name of the x509 into a buffer. More...
WOLFSSL_X509_NAME *	wolfSSL_X509_get_issuer_name (WOLFSSL_X509 *cert)
	This function returns the name of the certificate issuer. More...
WOLFSSL_X509_NAME *	wolfSSL_X509_get_subject_name (WOLFSSL_X509 *cert)
	This function returns the subject member of the WOLFSSL_X509 structure. More...
int	wolfSSL_X509_get_isCA (WOLFSSL_X509 *cert)
	Checks the isCa member of the WOLFSSL_X509 structure and returns the value. More...
int	wolfSSL_X509_NAME_get_text_by_NID (WOLFSSL_X509_NAME *name, int nid, char *buf, int len)
	This function gets the text related to the passed in NID value. More...
int	wolfSSL_X509_get_signature_type (WOLFSSL_X509 *cert)
	This function returns the value stored in the sigOID member of the WOLFSSL_X509 structure. More...
int	wolfSSL_X509_get_signature (WOLFSSL_X509 *x509, unsigned char *buf, int *bufSz)
	Gets the X509 signature and stores it in the buffer. More...
int	wolfSSL_X509_STORE_add_cert (WOLFSSL_X509_STORE *store, WOLFSSL_X509 *x509)
	This function adds a certificate to the WOLFSSL_X509_STRE structure. More...
WOLFSSL_STACK *	wolfSSL_X509_STORE_CTX_get_chain (WOLFSSL_X509_STORE_CTX *ctx)
	This function is a getter function for chain variable in WOLFSSL_X509_STORE_CTX structure. Currently chain is not populated. More...
int	wolfSSL_X509_STORE_set_flags (WOLFSSL_X509_STORE *store, unsigned long flag)
	This function takes in a flag to change the behavior of the WOLFSSL_X509_STORE structure passed in. An example of a flag used is WOLFSSL_CRL_CHECK. More...
const byte *	wolfSSL_X509_notBefore (WOLFSSL_X509 *x509)
	This function the certificate "not before" validity encoded as a byte array. More...
const byte *	wolfSSL_X509_notAfter (WOLFSSL_X509 *x509)
	This function the certificate "not after" validity encoded as a byte array. More...
const char *	wolfSSL_get_psk_identity_hint (const WOLFSSL *)
	This function returns the psk identity hint. More...
const char *	wolfSSL_get_psk_identity (const WOLFSSL *)
	The function returns a constant pointer to the client_identity member of the Arrays structure. More...
int	wolfSSL_CTX_use_psk_identity_hint (WOLFSSL_CTX *ctx, const char *hint)
	This function stores the hint argument in the server_hint member of the WOLFSSL_CTX structure. More...
int	wolfSSL_use_psk_identity_hint (WOLFSSL *ssl, const char *hint)
	This function stores the hint argument in the server_hint member of the Arrays structure within the WOLFSSL structure. More...
WOLFSSL_X509 *	wolfSSL_get_peer_certificate (WOLFSSL *ssl)
	This function gets the peer’s certificate. More...
WOLFSSL_X509 *	wolfSSL_get_chain_X509 (WOLFSSL_X509_CHAIN *chain, int idx)
	This function gets the peer’s wolfSSL_X509_certificate at index (idx) from the chain of certificates. More...
char *	wolfSSL_X509_get_subjectCN (WOLFSSL_X509 *)
	Returns the common name of the subject from the certificate. More...
const unsigned char *	wolfSSL_X509_get_der (WOLFSSL_X509 *x509, int *outSz)
	This function gets the DER encoded certificate in the WOLFSSL_X509 struct. More...
WOLFSSL_ASN1_TIME *	wolfSSL_X509_get_notAfter (WOLFSSL_X509 *)
	This function checks to see if x509 is NULL and if it’s not, it returns the notAfter member of the x509 struct. More...
int	wolfSSL_X509_version (WOLFSSL_X509 *)
	This function retrieves the version of the X509 certificate. More...
WOLFSSL_X509 *	wolfSSL_X509_d2i_fp (WOLFSSL_X509 **x509, FILE *file)
	If NO_STDIO_FILESYSTEM is defined this function will allocate heap memory, initialize a WOLFSSL_X509 structure and return a pointer to it. More...
WOLFSSL_X509 *	wolfSSL_X509_load_certificate_file (const char *fname, int format)
	The function loads the x509 certificate into memory. More...
unsigned char *	wolfSSL_X509_get_device_type (WOLFSSL_X509 *x509, unsigned char *in, int *inOutSz)
	This function copies the device type from the x509 structure to the buffer. More...
unsigned char *	wolfSSL_X509_get_hw_type (WOLFSSL_X509 *x509, unsigned char *in, int *inOutSz)
	The function copies the hwType member of the WOLFSSL_X509 structure to the buffer. More...
unsigned char *	wolfSSL_X509_get_hw_serial_number (WOLFSSL_X509 *x509, unsigned char *in, int *inOutSz)
	This function returns the hwSerialNum member of the x509 object. More...
int	wolfSSL_SetTmpDH (WOLFSSL *ssl, const unsigned char *p, int pSz, const unsigned char *g, int gSz)
	Server Diffie-Hellman Ephemeral parameters setting. This function sets up the group parameters to be used if the server negotiates a cipher suite that uses DHE. More...
int	wolfSSL_SetTmpDH_buffer (WOLFSSL *ssl, const unsigned char *b, long sz, int format)
	The function calls the wolfSSL_SetTMpDH_buffer_wrapper, which is a wrapper for Diffie-Hellman parameters. More...
int	wolfSSL_SetTmpDH_file (WOLFSSL *ssl, const char *f, int format)
	This function calls wolfSSL_SetTmpDH_file_wrapper to set server Diffie-Hellman parameters. More...
int	wolfSSL_CTX_SetTmpDH (WOLFSSL_CTX *ctx, const unsigned char *p, int pSz, const unsigned char *g, int gSz)
	Sets the parameters for the server CTX Diffie-Hellman. More...
int	wolfSSL_CTX_SetTmpDH_buffer (WOLFSSL_CTX *ctx, const unsigned char *b, long sz, int format)
	A wrapper function that calls wolfSSL_SetTmpDH_buffer_wrapper. More...
int	wolfSSL_CTX_SetTmpDH_file (WOLFSSL_CTX *ctx, const char *f, int format)
	The function calls wolfSSL_SetTmpDH_file_wrapper to set the server Diffie-Hellman parameters. More...
int	wolfSSL_CTX_SetMinDhKey_Sz (WOLFSSL_CTX *ctx, word16)
	This function sets the minimum size (in bits) of the Diffie Hellman key size by accessing the minDhKeySz member in the WOLFSSL_CTX structure. More...
int	wolfSSL_SetMinDhKey_Sz (WOLFSSL *ssl, word16 keySz_bits)
	Sets the minimum size (in bits) for a Diffie-Hellman key in the WOLFSSL structure. More...
int	wolfSSL_CTX_SetMaxDhKey_Sz (WOLFSSL_CTX *ctx, word16 keySz_bits)
	This function sets the maximum size (in bits) of the Diffie Hellman key size by accessing the maxDhKeySz member in the WOLFSSL_CTX structure. More...
int	wolfSSL_SetMaxDhKey_Sz (WOLFSSL *ssl, word16 keySz_bits)
	Sets the maximum size (in bits) for a Diffie-Hellman key in the WOLFSSL structure. More...
int	wolfSSL_GetDhKey_Sz (WOLFSSL *)
	Returns the value of dhKeySz (in bits) that is a member of the options structure. This value represents the Diffie-Hellman key size in bytes. More...
int	wolfSSL_CTX_SetMinRsaKey_Sz (WOLFSSL_CTX *ctx, short keySz)
	Sets the minimum RSA key size in both the WOLFSSL_CTX structure and the WOLFSSL_CERT_MANAGER structure. More...
int	wolfSSL_SetMinRsaKey_Sz (WOLFSSL *ssl, short keySz)
	Sets the minimum allowable key size in bits for RSA located in the WOLFSSL structure. More...
int	wolfSSL_CTX_SetMinEccKey_Sz (WOLFSSL_CTX *ssl, short keySz)
	Sets the minimum size in bits for the ECC key in the WOLF_CTX structure and the WOLFSSL_CERT_MANAGER structure. More...
int	wolfSSL_SetMinEccKey_Sz (WOLFSSL *ssl, short keySz)
	Sets the value of the minEccKeySz member of the options structure. The options struct is a member of the WOLFSSL structure and is accessed through the ssl parameter. More...
int	wolfSSL_make_eap_keys (WOLFSSL *ssl, void *key, unsigned int len, const char *label)
	This function is used by EAP_TLS and EAP-TTLS to derive keying material from the master secret. More...
int	wolfSSL_CTX_load_verify_buffer (WOLFSSL_CTX *ctx, const unsigned char *in, long sz, int format)
	This function loads a CA certificate buffer into the WOLFSSL Context. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. More than one CA certificate may be loaded per buffer as long as the format is in PEM. Please see the examples for proper usage. More...
int	wolfSSL_CTX_load_verify_buffer_ex (WOLFSSL_CTX *ctx, const unsigned char *in, long sz, int format, int userChain, word32 flags)
	This function loads a CA certificate buffer into the WOLFSSL Context. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. More than one CA certificate may be loaded per buffer as long as the format is in PEM. The _ex version was added in PR 2413 and supports additional arguments for userChain and flags. More...
int	wolfSSL_CTX_load_verify_chain_buffer_format (WOLFSSL_CTX *ctx, const unsigned char *in, long sz, int format)
	This function loads a CA certificate chain buffer into the WOLFSSL Context. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. More than one CA certificate may be loaded per buffer as long as the format is in PEM. Please see the examples for proper usage. More...
int	wolfSSL_CTX_use_certificate_buffer (WOLFSSL_CTX *ctx, const unsigned char *in, long sz, int format)
	This function loads a certificate buffer into the WOLFSSL Context. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. Please see the examples for proper usage. More...
int	wolfSSL_CTX_use_PrivateKey_buffer (WOLFSSL_CTX *ctx, const unsigned char *in, long sz, int format)
	This function loads a private key buffer into the SSL Context. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1or SSL_FILETYPE_PEM. Please see the examples for proper usage. More...
int	wolfSSL_CTX_use_certificate_chain_buffer (WOLFSSL_CTX *ctx, const unsigned char *in, long sz)
	This function loads a certificate chain buffer into the WOLFSSL Context. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. The buffer must be in PEM format and start with the subject’s certificate, ending with the root certificate. Please see the examples for proper usage. More...
int	wolfSSL_use_certificate_buffer (WOLFSSL *ssl, const unsigned char *in, long sz, int format)
	This function loads a certificate buffer into the WOLFSSL object. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. Please see the examples for proper usage. More...
int	wolfSSL_use_PrivateKey_buffer (WOLFSSL *ssl, const unsigned char *in, long sz, int format)
	This function loads a private key buffer into the WOLFSSL object. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. Please see the examples for proper usage. More...
int	wolfSSL_use_certificate_chain_buffer (WOLFSSL *ssl, const unsigned char *in, long sz)
	This function loads a certificate chain buffer into the WOLFSSL object. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. The buffer must be in PEM format and start with the subject’s certificate, ending with the root certificate. Please see the examples for proper usage. More...
int	wolfSSL_UnloadCertsKeys (WOLFSSL *)
	This function unloads any certificates or keys that SSL owns. More...
int	wolfSSL_GetIVSize (WOLFSSL *)
	Returns the iv_size member of the specs structure held in the WOLFSSL struct. More...
void	wolfSSL_KeepArrays (WOLFSSL *)
	Normally, at the end of the SSL handshake, wolfSSL frees temporary arrays. Calling this function before the handshake begins will prevent wolfSSL from freeing temporary arrays. Temporary arrays may be needed for things such as wolfSSL_get_keys() or PSK hints. When the user is done with temporary arrays, either wolfSSL_FreeArrays() may be called to free the resources immediately, or alternatively the resources will be freed when the associated SSL object is freed. More...
void	wolfSSL_FreeArrays (WOLFSSL *)
	Normally, at the end of the SSL handshake, wolfSSL frees temporary arrays. If wolfSSL_KeepArrays() has been called before the handshake, wolfSSL will not free temporary arrays. This function explicitly frees temporary arrays and should be called when the user is done with temporary arrays and does not want to wait for the SSL object to be freed to free these resources. More...
int	wolfSSL_DeriveTlsKeys (unsigned char *key_data, word32 keyLen, const unsigned char *ms, word32 msLen, const unsigned char *sr, const unsigned char *cr, int tls1_2, int hash_type)
	An external facing wrapper to derive TLS Keys. More...
int	wolfSSL_X509_get_ext_by_NID (const WOLFSSL_X509 *x509, int nid, int lastPos)
	This function looks for and returns the extension index matching the passed in NID value. More...
void *	wolfSSL_X509_get_ext_d2i (const WOLFSSL_X509 *x509, int nid, int *c, int *idx)
	This function looks for and returns the extension matching the passed in NID value. More...
int	wolfSSL_X509_digest (const WOLFSSL_X509 *x509, const WOLFSSL_EVP_MD *digest, unsigned char *buf, unsigned int *len)
	This function returns the hash of the DER certificate. More...
int	wolfSSL_use_PrivateKey (WOLFSSL *ssl, WOLFSSL_EVP_PKEY *pkey)
	This is used to set the private key for the WOLFSSL structure. More...
int	wolfSSL_use_PrivateKey_ASN1 (int pri, WOLFSSL *ssl, unsigned char *der, long derSz)
	This is used to set the private key for the WOLFSSL structure. A DER formatted key buffer is expected. More...
int	wolfSSL_use_RSAPrivateKey_ASN1 (WOLFSSL *ssl, unsigned char *der, long derSz)
	This is used to set the private key for the WOLFSSL structure. A DER formatted RSA key buffer is expected. More...
WOLFSSL_DH *	wolfSSL_DSA_dup_DH (const WOLFSSL_DSA *r)
	This function duplicates the parameters in dsa to a newly created WOLFSSL_DH structure. More...
WOLFSSL_X509 *	wolfSSL_d2i_X509_bio (WOLFSSL_BIO *bio, WOLFSSL_X509 **x509)
	This function get the DER buffer from bio and converts it to a WOLFSSL_X509 structure. More...
WOLFSSL_X509 *	wolfSSL_PEM_read_bio_X509_AUX (WOLFSSL_BIO *bp, WOLFSSL_X509 **x, wc_pem_password_cb *cb, void *u)
	This function behaves the same as wolfSSL_PEM_read_bio_X509. AUX signifies containing extra information such as trusted/rejected use cases and friendly name for human readability. More...
long	wolfSSL_CTX_set_tmp_dh (WOLFSSL_CTX *ctx, WOLFSSL_DH *dh)
	Initializes the WOLFSSL_CTX structure’s dh member with the Diffie-Hellman parameters. More...
WOLFSSL_DSA *	wolfSSL_PEM_read_bio_DSAparams (WOLFSSL_BIO *bp, WOLFSSL_DSA **x, wc_pem_password_cb *cb, void *u)
	This function get the DSA parameters from a PEM buffer in bio. More...
	WOLF_STACK_OF (WOLFSSL_X509) *wolfSSL_get_peer_cert_chain(const WOLFSSL *)
	This function gets the peer’s certificate chain. More...
char *	wolfSSL_X509_get_next_altname (WOLFSSL_X509 *)
	This function returns the next, if any, altname from the peer certificate. More...
WOLFSSL_ASN1_TIME *	wolfSSL_X509_get_notBefore (WOLFSSL_X509 *)
	The function checks to see if x509 is NULL and if it’s not, it returns the notBefore member of the x509 struct. More...

Detailed Description

Function Documentation

wc_CertPemToDer()

int wc_CertPemToDer	(	const unsigned char *	pem,
		int	pemSz,
		unsigned char *	buff,
		int	buffSz,
		int	type
	)

This function converts a PEM formatted certificate to DER format. Calls OpenSSL function PemToDer.

Returns

buffer returns the bytes written to the buffer.

Parameters

pem	pointer PEM formatted certificate.
pemSz	size of the certificate.
buff	buffer to be copied to DER format.
buffSz	size of the buffer.
type	Certificate file type found in asn_public.h enum CertType.

Example

const unsigned char* pem;
int pemSz;
unsigned char buff[BUFSIZE];
int buffSz = sizeof(buff)/sizeof(char);
int type;
...
if(wc_CertPemToDer(pem, pemSz, buff, buffSz, type) <= 0) {
    // There were bytes written to buffer
}

See also

wc_PemToDer

wc_GetPubKeyDerFromCert()

int wc_GetPubKeyDerFromCert	(	struct DecodedCert *	cert,
		byte *	derKey,
		word32 *	derKeySz
	)

This function gets the public key in DER format from a populated DecodedCert struct. Users must call wc_InitDecodedCert() and wc_ParseCert() before calling this API. wc_InitDecodedCert() accepts a DER/ASN.1 encoded certificate. To convert a PEM cert to DER, first use wc_CertPemToDer() before calling wc_InitDecodedCert().

Returns

0 on success, negative on error. LENGTH_ONLY_E if derKey is NULL and returning length only.

Parameters

cert	populated DecodedCert struct holding X.509 certificate
derKey	output buffer to place DER encoded public key
derKeySz	[IN/OUT] size of derKey buffer on input, size of public key on return. If derKey is passed in as NULL, derKeySz will be set to required buffer size for public key and LENGTH_ONLY_E will be returned from function.

See also

wc_GetPubKeyDerFromCert

wc_KeyPemToDer()

int wc_KeyPemToDer	(	const unsigned char *	pem,
		int	pemSz,
		unsigned char *	buff,
		int	buffSz,
		const char *	pass
	)

Converts a key in PEM format to DER format.

Returns

int the function returns the number of bytes written to the buffer on successful execution.

int negative int returned indicating an error.

Parameters

pem	a pointer to the PEM encoded certificate.
pemSz	the size of the PEM buffer (pem)
buff	a pointer to the copy of the buffer member of the DerBuffer struct.
buffSz	size of the buffer space allocated in the DerBuffer struct.
pass	password passed into the function.

Example

byte* loadBuf;
long fileSz = 0;
byte* bufSz;
static int LoadKeyFile(byte** keyBuf, word32* keyBufSz,
const char* keyFile,
                int typeKey, const char* password);
…
bufSz = wc_KeyPemToDer(loadBuf, (int)fileSz, saveBuf,
(int)fileSz, password);
 
if(saveBufSz > 0){
    // Bytes were written to the buffer.
}

See also

wc_PemToDer

WOLF_STACK_OF()

WOLF_STACK_OF

(

WOLFSSL_X509

)

const

This function gets the peer’s certificate chain.

Returns

pointer returns a pointer to the peer’s Certificate stack.

NULL returned if no peer certificate.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().

Example

WOLFSSL_CTX* ctx = wolfSSL_CTX_new( method );
WOLFSSL* ssl = wolfSSL_new(ctx);
...
wolfSSL_connect(ssl);
STACK_OF(WOLFSSL_X509)* chain = wolfSSL_get_peer_cert_chain(ssl);
ifchain){
    // You have a pointer to the peer certificate chain
}

See also

wolfSSL_X509_get_issuer_name

wolfSSL_X509_get_subject_name

wolfSSL_X509_get_isCA

wolfSSL_CTX_der_load_verify_locations()

int wolfSSL_CTX_der_load_verify_locations	(	WOLFSSL_CTX *	ctx,
		const char *	file,
		int	format
	)

This function is similar to wolfSSL_CTX_load_verify_locations, but allows the loading of DER-formatted CA files into the SSL context (WOLFSSL_CTX). It may still be used to load PEM-formatted CA files as well. These certificates will be treated as trusted root certificates and used to verify certs received from peers during the SSL handshake. The root certificate file, provided by the file argument, may be a single certificate or a file containing multiple certificates. If multiple CA certs are included in the same file, wolfSSL will load them in the same order they are presented in the file. The format argument specifies the format which the certificates are in either, SSL_FILETYPE_PEM or SSL_FILETYPE_ASN1 (DER). Unlike wolfSSL_CTX_load_verify_locations, this function does not allow the loading of CA certificates from a given directory path. Note that this function is only available when the wolfSSL library was compiled with WOLFSSL_DER_LOAD defined.

Returns

SSL_SUCCESS upon success.

SSL_FAILURE upon failure.

Parameters

ctx	a pointer to a WOLFSSL_CTX structure, created using wolfSSL_CTX_new()
file	a pointer to the name of the file containing the CA certificates to be loaded into the wolfSSL SSL context, with format as specified by format.
format	the encoding type of the certificates specified by file. Possible values include SSL_FILETYPE_PEM and SSL_FILETYPE_ASN1.

Example

int ret = 0;
WOLFSSL_CTX* ctx;
...
ret = wolfSSL_CTX_der_load_verify_locations(ctx, “./ca-cert.der”,
                                      SSL_FILETYPE_ASN1);
if (ret != SSL_SUCCESS) {
    // error loading CA certs
}
...

See also

wolfSSL_CTX_load_verify_locations

wolfSSL_CTX_load_verify_buffer

wolfSSL_CTX_get_cert_cache_memsize()

int wolfSSL_CTX_get_cert_cache_memsize

(

WOLFSSL_CTX *

ctx

)

Returns the size the certificate cache save buffer needs to be.

Returns

int integer value returned representing the memory size upon success.

BAD_FUNC_ARG is returned if the WOLFSSL_CTX struct is NULL.

BAD_MUTEX_E - returned if there was a mutex lock error.

Parameters

ctx	a pointer to a wolfSSL_CTX structure, created using wolfSSL_CTX_new().

Example

WOLFSSL_CTX* ctx = WOLFSSL_CTX_new(protocol);
...
int certCacheSize = wolfSSL_CTX_get_cert_cache_memsize(ctx);
 
if(certCacheSize != BAD_FUNC_ARG || certCacheSize != BAD_MUTEX_E){
// Successfully retrieved the memory size.
}

See also

CM_GetCertCacheMemSize

wolfSSL_CTX_load_system_CA_certs()

int wolfSSL_CTX_load_system_CA_certs

(

WOLFSSL_CTX *

ctx

)

On most platforms (including Linux and Windows), this function attempts to load CA certificates into a WOLFSSL_CTX from an OS-dependent CA certificate store. Loaded certificates will be trusted.

On Apple platforms (excluding macOS), certificates can't be obtained from the system, and therefore cannot be loaded into the wolfSSL certificate manager. For these platforms, this function enables TLS connections bound to the WOLFSSL_CTX to use the native system trust APIs to verify authenticity of the peer certificate chain if the authenticity of the peer cannot first be authenticated against certificates loaded by the user.

The platforms supported and tested are: Linux (Debian, Ubuntu, Gentoo, Fedora, RHEL), Windows 10/11, Android, macOS, and iOS.

Returns

WOLFSSL_SUCCESS on success.

WOLFSSL_BAD_PATH if no system CA certs were loaded.

WOLFSSL_FAILURE for other failure types (e.g. Windows cert store wasn't properly closed).

Parameters

ctx	pointer to the SSL context, created with wolfSSL_CTX_new().

Example

int ret = 0;
WOLFSSL_CTX* ctx;
...
ret = wolfSSL_CTX_load_system_CA_certs(ctx,);
if (ret != WOLFSSL_SUCCESS) {
    // error loading system CA certs
}
...

See also

wolfSSL_get_system_CA_dirs

wolfSSL_CTX_load_verify_locations

wolfSSL_CTX_load_verify_locations_ex

wolfSSL_CTX_load_verify_buffer()

int wolfSSL_CTX_load_verify_buffer	(	WOLFSSL_CTX *	ctx,
		const unsigned char *	in,
		long	sz,
		int	format
	)

This function loads a CA certificate buffer into the WOLFSSL Context. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. More than one CA certificate may be loaded per buffer as long as the format is in PEM. Please see the examples for proper usage.

Returns

SSL_SUCCESS upon success

SSL_BAD_FILETYPE will be returned if the file is the wrong format.

SSL_BAD_FILE will be returned if the file doesn’t exist, can’t be read, or is corrupted.

MEMORY_E will be returned if an out of memory condition occurs.

ASN_INPUT_E will be returned if Base16 decoding fails on the file.

BUFFER_E will be returned if a chain buffer is bigger than the receiving buffer.

Parameters

ctx	pointer to the SSL context, created with wolfSSL_CTX_new().
in	pointer to the CA certificate buffer.
sz	size of the input CA certificate buffer, in.
format	format of the buffer certificate, either SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM.

Example

int ret = 0;
int sz = 0;
WOLFSSL_CTX* ctx;
byte certBuff[...];
...
 
ret = wolfSSL_CTX_load_verify_buffer(ctx, certBuff, sz, SSL_FILETYPE_PEM);
if (ret != SSL_SUCCESS) {
    // error loading CA certs from buffer
}
...

See also

wolfSSL_CTX_load_verify_locations

wolfSSL_CTX_use_certificate_buffer

wolfSSL_CTX_use_PrivateKey_buffer

wolfSSL_CTX_use_certificate_chain_buffer

wolfSSL_use_certificate_buffer

wolfSSL_use_PrivateKey_buffer

wolfSSL_use_certificate_chain_buffer

wolfSSL_CTX_load_verify_buffer_ex()

int wolfSSL_CTX_load_verify_buffer_ex	(	WOLFSSL_CTX *	ctx,
		const unsigned char *	in,
		long	sz,
		int	format,
		int	userChain,
		word32	flags
	)

This function loads a CA certificate buffer into the WOLFSSL Context. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. More than one CA certificate may be loaded per buffer as long as the format is in PEM. The _ex version was added in PR 2413 and supports additional arguments for userChain and flags.

Returns

SSL_SUCCESS upon success

SSL_BAD_FILETYPE will be returned if the file is the wrong format.

SSL_BAD_FILE will be returned if the file doesn’t exist, can’t be read, or is corrupted.

MEMORY_E will be returned if an out of memory condition occurs.

ASN_INPUT_E will be returned if Base16 decoding fails on the file.

BUFFER_E will be returned if a chain buffer is bigger than the receiving buffer.

Parameters

ctx	pointer to the SSL context, created with wolfSSL_CTX_new().
in	pointer to the CA certificate buffer.
sz	size of the input CA certificate buffer, in.
format	format of the buffer certificate, either SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM.
userChain	If using format WOLFSSL_FILETYPE_ASN1 this set to non-zero indicates a chain of DER's is being presented.
flags	See ssl.h around WOLFSSL_LOAD_VERIFY_DEFAULT_FLAGS.

Example

int ret = 0;
int sz = 0;
WOLFSSL_CTX* ctx;
byte certBuff[...];
...
 
// Example for force loading an expired certificate
ret = wolfSSL_CTX_load_verify_buffer_ex(ctx, certBuff, sz, SSL_FILETYPE_PEM,
    0, (WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY));
if (ret != SSL_SUCCESS) {
    // error loading CA certs from buffer
}
...

See also

wolfSSL_CTX_load_verify_buffer

wolfSSL_CTX_load_verify_locations

wolfSSL_CTX_use_certificate_buffer

wolfSSL_CTX_use_PrivateKey_buffer

wolfSSL_CTX_use_certificate_chain_buffer

wolfSSL_use_certificate_buffer

wolfSSL_use_PrivateKey_buffer

wolfSSL_use_certificate_chain_buffer

wolfSSL_CTX_load_verify_chain_buffer_format()

int wolfSSL_CTX_load_verify_chain_buffer_format	(	WOLFSSL_CTX *	ctx,
		const unsigned char *	in,
		long	sz,
		int	format
	)

This function loads a CA certificate chain buffer into the WOLFSSL Context. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. More than one CA certificate may be loaded per buffer as long as the format is in PEM. Please see the examples for proper usage.

Returns

SSL_SUCCESS upon success

SSL_BAD_FILETYPE will be returned if the file is the wrong format.

SSL_BAD_FILE will be returned if the file doesn’t exist, can’t be read, or is corrupted.

MEMORY_E will be returned if an out of memory condition occurs.

ASN_INPUT_E will be returned if Base16 decoding fails on the file.

BUFFER_E will be returned if a chain buffer is bigger than the receiving buffer.

Parameters

ctx	pointer to the SSL context, created with wolfSSL_CTX_new().
in	pointer to the CA certificate buffer.
sz	size of the input CA certificate buffer, in.
format	format of the buffer certificate, either SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM.

Example

int ret = 0;
int sz = 0;
WOLFSSL_CTX* ctx;
byte certBuff[...];
...
 
ret = wolfSSL_CTX_load_verify_chain_buffer_format(ctx,
                     certBuff, sz, WOLFSSL_FILETYPE_ASN1);
if (ret != SSL_SUCCESS) {
    // error loading CA certs from buffer
}
...

See also

wolfSSL_CTX_load_verify_locations

wolfSSL_CTX_use_certificate_buffer

wolfSSL_CTX_use_PrivateKey_buffer

wolfSSL_CTX_use_certificate_chain_buffer

wolfSSL_use_certificate_buffer

wolfSSL_use_PrivateKey_buffer

wolfSSL_use_certificate_chain_buffer

wolfSSL_CTX_load_verify_locations()

int wolfSSL_CTX_load_verify_locations	(	WOLFSSL_CTX *	ctx,
		const char *	file,
		const char *	path
	)

This function loads PEM-formatted CA certificate files into the SSL context (WOLFSSL_CTX). These certificates will be treated as trusted root certificates and used to verify certs received from peers during the SSL handshake. The root certificate file, provided by the file argument, may be a single certificate or a file containing multiple certificates. If multiple CA certs are included in the same file, wolfSSL will load them in the same order they are presented in the file. The path argument is a pointer to the name of a directory that contains certificates of trusted root CAs. If the value of file is not NULL, path may be specified as NULL if not needed. If path is specified and NO_WOLFSSL_DIR was not defined when building the library, wolfSSL will load all CA certificates located in the given directory. This function will attempt to load all files in the directory. This function expects PEM formatted CERT_TYPE file with header “--—BEGIN CERTIFICATE--—”.

Returns

SSL_SUCCESS up success.

SSL_FAILURE will be returned if ctx is NULL, or if both file and path are NULL.

SSL_BAD_FILETYPE will be returned if the file is the wrong format.

SSL_BAD_FILE will be returned if the file doesn’t exist, can’t be read, or is corrupted.

MEMORY_E will be returned if an out of memory condition occurs.

ASN_INPUT_E will be returned if Base16 decoding fails on the file.

ASN_BEFORE_DATE_E will be returned if the current date is before the before date.

ASN_AFTER_DATE_E will be returned if the current date is after the after date.

BUFFER_E will be returned if a chain buffer is bigger than the receiving buffer.

BAD_PATH_ERROR will be returned if opendir() fails when trying to open path.

Parameters

ctx	pointer to the SSL context, created with wolfSSL_CTX_new().
file	pointer to name of the file containing PEM-formatted CA certificates.
path	pointer to the name of a directory to load PEM-formatted certificates from.

Example

int ret = 0;
WOLFSSL_CTX* ctx;
...
ret = wolfSSL_CTX_load_verify_locations(ctx, “./ca-cert.pem”, NULL);
if (ret != WOLFSSL_SUCCESS) {
    // error loading CA certs
}
...

See also

wolfSSL_CTX_load_verify_locations_ex

wolfSSL_CTX_load_verify_buffer

wolfSSL_CTX_use_certificate_file

wolfSSL_CTX_use_PrivateKey_file

wolfSSL_CTX_use_certificate_chain_file

wolfSSL_use_certificate_file

wolfSSL_use_PrivateKey_file

wolfSSL_use_certificate_chain_file

wolfSSL_CTX_load_verify_locations_ex()

int wolfSSL_CTX_load_verify_locations_ex	(	WOLFSSL_CTX *	ctx,
		const char *	file,
		const char *	path,
		unsigned int	flags
	)

This function loads PEM-formatted CA certificate files into the SSL context (WOLFSSL_CTX). These certificates will be treated as trusted root certificates and used to verify certs received from peers during the SSL handshake. The root certificate file, provided by the file argument, may be a single certificate or a file containing multiple certificates. If multiple CA certs are included in the same file, wolfSSL will load them in the same order they are presented in the file. The path argument is a pointer to the name of a directory that contains certificates of trusted root CAs. If the value of file is not NULL, path may be specified as NULL if not needed. If path is specified and NO_WOLFSSL_DIR was not defined when building the library, wolfSSL will load all CA certificates located in the given directory. This function will attempt to load all files in the directory based on flags specified. This function expects PEM formatted CERT_TYPE files with header “--—BEGIN CERTIFICATE--—”.

Returns

SSL_SUCCESS up success.

SSL_FAILURE will be returned if ctx is NULL, or if both file and path are NULL. This will also be returned if at least one cert is loaded successfully but there is one or more that failed. Check error stack for reason.

SSL_BAD_FILETYPE will be returned if the file is the wrong format.

SSL_BAD_FILE will be returned if the file doesn’t exist, can’t be read, or is corrupted.

MEMORY_E will be returned if an out of memory condition occurs.

ASN_INPUT_E will be returned if Base16 decoding fails on the file.

BUFFER_E will be returned if a chain buffer is bigger than the receiving buffer.

BAD_PATH_ERROR will be returned if opendir() fails when trying to open path.

Parameters

ctx	pointer to the SSL context, created with wolfSSL_CTX_new().
file	pointer to name of the file containing PEM-formatted CA certificates.
path	pointer to the name of a directory to load PEM-formatted certificates from.
flags	possible mask values are: WOLFSSL_LOAD_FLAG_IGNORE_ERR, WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY and WOLFSSL_LOAD_FLAG_PEM_CA_ONLY

Example

int ret = 0;
WOLFSSL_CTX* ctx;
...
ret = wolfSSL_CTX_load_verify_locations_ex(ctx, NULL, “./certs/external",
    WOLFSSL_LOAD_FLAG_PEM_CA_ONLY);
if (ret != WOLFSSL_SUCCESS) {
    // error loading CA certs
}
...

See also

wolfSSL_CTX_load_verify_locations

wolfSSL_CTX_load_verify_buffer

wolfSSL_CTX_use_certificate_file

wolfSSL_CTX_use_PrivateKey_file

wolfSSL_CTX_use_certificate_chain_file

wolfSSL_use_certificate_file

wolfSSL_use_PrivateKey_file

wolfSSL_use_certificate_chain_file

wolfSSL_CTX_memsave_cert_cache()

int wolfSSL_CTX_memsave_cert_cache	(	WOLFSSL_CTX *	ctx,
		void *	mem,
		int	sz,
		int *	used
	)

This function persists the certificate cache to memory.

Returns

SSL_SUCCESS returned on successful execution of the function. No errors were thrown.

BAD_MUTEX_E mutex error where the WOLFSSL_CERT_MANAGER member caLock was not 0 (zero).

BAD_FUNC_ARG returned if ctx, mem, or used is NULL or if sz is less than or equal to 0 (zero).

BUFFER_E output buffer mem was too small.

Parameters

ctx	a pointer to a WOLFSSL_CTX structure, created using wolfSSL_CTX_new().
mem	a void pointer to the destination (output buffer).
sz	the size of the output buffer.
used	a pointer to size of the cert cache header.

Example

WOLFSSL_CTX* ctx = WOLFSSL_CTX_new( protocol );
void* mem;
int sz;
int* used;
...
if(wolfSSL_CTX_memsave_cert_cache(ctx, mem, sz, used) != SSL_SUCCESS){
    // The function returned with an error
}

See also

DoMemSaveCertCache

GetCertCacheMemSize

CM_MemRestoreCertCache

CM_GetCertCacheMemSize

wolfSSL_CTX_restore_cert_cache()

int wolfSSL_CTX_restore_cert_cache	(	WOLFSSL_CTX *	ctx,
		const char *	fname
	)

This function persistes certificate cache from a file.

Returns

SSL_SUCCESS returned if the function, CM_RestoreCertCache, executes normally.

SSL_BAD_FILE returned if XFOPEN returns XBADFILE. The file is corrupted.

MEMORY_E returned if the allocated memory for the temp buffer fails.

BAD_FUNC_ARG returned if fname or ctx have a NULL value.

Parameters

ctx	a pointer to a WOLFSSL_CTX structure, holding the certificate information.
fname	a constant char pointer that points to a file for reading.

Example

WOLFSSL_CTX* ctx = wolfSSL_CTX_new( protocol method );
WOLFSSL* ssl = wolfSSL_new(ctx);
const char* fname = "path to file";
...
if(wolfSSL_CTX_restore_cert_cache(ctx, fname)){
    // check to see if the execution was successful
}

See also

CM_RestoreCertCache

XFOPEN

wolfSSL_CTX_save_cert_cache()

int wolfSSL_CTX_save_cert_cache	(	WOLFSSL_CTX *	ctx,
		const char *	fname
	)

This function writes the cert cache from memory to file.

Returns

SSL_SUCCESS if CM_SaveCertCache exits normally.

BAD_FUNC_ARG is returned if either of the arguments are NULL.

SSL_BAD_FILE if the cert cache save file could not be opened.

BAD_MUTEX_E if the lock mutex failed.

MEMORY_E the allocation of memory failed.

FWRITE_ERROR Certificate cache file write failed.

Parameters

ctx	a pointer to a WOLFSSL_CTX structure, holding the certificate information.
fname	a constant char pointer that points to a file for writing.

Example

WOLFSSL_CTX* ctx = WOLFSSL_CTX_new( protocol def );
const char* fname;
...
if(wolfSSL_CTX_save_cert_cache(ctx, fname)){
    // file was written.
}

See also

CM_SaveCertCache

DoMemSaveCertCache

wolfSSL_CTX_set_tmp_dh()

long wolfSSL_CTX_set_tmp_dh	(	WOLFSSL_CTX *	ctx,
		WOLFSSL_DH *	dh
	)

Initializes the WOLFSSL_CTX structure’s dh member with the Diffie-Hellman parameters.

Returns

SSL_SUCCESS returned if the function executed successfully.

BAD_FUNC_ARG returned if the ctx or dh structures are NULL.

SSL_FATAL_ERROR returned if there was an error setting a structure value.

MEMORY_E returned if their was a failure to allocate memory.

Parameters

ctx	a pointer to a WOLFSSL_CTX structure, created using wolfSSL_CTX_new().
dh	a pointer to a WOLFSSL_DH structure.

Example

WOLFSSL_CTX* ctx = wolfSSL_CTX_new( protocol method );
WOLFSSL_DH* dh;
…
return wolfSSL_CTX_set_tmp_dh(ctx, dh);

See also

wolfSSL_BN_bn2bin

wolfSSL_CTX_SetCertCbCtx()

void wolfSSL_CTX_SetCertCbCtx	(	WOLFSSL_CTX *	ctx,
		void *	userCtx
	)

This function stores user CTX object information for verify callback.

Returns

none No return.

Parameters

ctx	a pointer to a WOLFSSL_CTX structure.
userCtx	a void pointer that is used to set WOLFSSL_CTX structure’s verifyCbCtx member’s value.

Example

WOLFSSL_CTX* ctx = wolfSSL_CTX_new( method );
void* userCtx = NULL; // Assign some user defined context
...
if(ctx != NULL){
    wolfSSL_SetCertCbCtx(ctx, userCtx);
} else {
    // Error case, the SSL is not initialized properly.
}

See also

wolfSSL_CTX_save_cert_cache

wolfSSL_CTX_restore_cert_cache

wolfSSL_CTX_set_verify

wolfSSL_CTX_SetMaxDhKey_Sz()

int wolfSSL_CTX_SetMaxDhKey_Sz	(	WOLFSSL_CTX *	ctx,
		word16	keySz_bits
	)

This function sets the maximum size (in bits) of the Diffie Hellman key size by accessing the maxDhKeySz member in the WOLFSSL_CTX structure.

Returns

SSL_SUCCESS returned if the function completes successfully.

BAD_FUNC_ARG returned if the WOLFSSL_CTX struct is NULL or if the keySz_bits is greater than 16,000 or not divisible by 8.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().
keySz_bits	a word16 type used to set the maximum DH key size in bits. The WOLFSSL_CTX struct holds this information in the maxDhKeySz member.

Example

public static int CTX_SetMaxDhKey_Sz(IntPtr ctx, short maxDhKey){
…
return wolfSSL_CTX_SetMaxDhKey_Sz(local_ctx, keySz_bits);

See also

wolfSSL_SetMinDhKey_Sz

wolfSSL_CTX_SetMinDhKey_Sz

wolfSSL_SetMaxDhKey_Sz

wolfSSL_GetDhKey_Sz

wolfSSL_CTX_SetTMpDH_file

wolfSSL_CTX_SetMinDhKey_Sz()

int wolfSSL_CTX_SetMinDhKey_Sz	(	WOLFSSL_CTX *	ctx,
		word16
	)

This function sets the minimum size (in bits) of the Diffie Hellman key size by accessing the minDhKeySz member in the WOLFSSL_CTX structure.

Returns

SSL_SUCCESS returned if the function completes successfully.

BAD_FUNC_ARG returned if the WOLFSSL_CTX struct is NULL or if the keySz_bits is greater than 16,000 or not divisible by 8.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().
keySz_bits	a word16 type used to set the minimum DH key size in bits. The WOLFSSL_CTX struct holds this information in the minDhKeySz member.

Example

public static int CTX_SetMinDhKey_Sz(IntPtr ctx, short minDhKey){
…
return wolfSSL_CTX_SetMinDhKey_Sz(local_ctx, minDhKeyBits);

See also

wolfSSL_SetMinDhKey_Sz

wolfSSL_CTX_SetMaxDhKey_Sz

wolfSSL_SetMaxDhKey_Sz

wolfSSL_GetDhKey_Sz

wolfSSL_CTX_SetTMpDH_file

wolfSSL_CTX_SetMinEccKey_Sz()

int wolfSSL_CTX_SetMinEccKey_Sz	(	WOLFSSL_CTX *	ssl,
		short	keySz
	)

Sets the minimum size in bits for the ECC key in the WOLF_CTX structure and the WOLFSSL_CERT_MANAGER structure.

Returns

SSL_SUCCESS returned for a successful execution and the minEccKeySz member is set.

BAD_FUNC_ARG returned if the WOLFSSL_CTX struct is NULL or if the keySz is negative or not divisible by 8.

Parameters

ctx	a pointer to a WOLFSSL_CTX structure, created using wolfSSL_CTX_new().
keySz	a short integer type that represents the minimum ECC key size in bits.

Example

WOLFSSL_CTX* ctx = wolfSSL_CTX_new( protocol method );
short keySz; // minimum key size
…
if(wolfSSL_CTX_SetMinEccKey(ctx, keySz) != SSL_SUCCESS){
    // Failed to set min key size
}

See also

wolfSSL_SetMinEccKey_Sz

wolfSSL_CTX_SetMinRsaKey_Sz()

int wolfSSL_CTX_SetMinRsaKey_Sz	(	WOLFSSL_CTX *	ctx,
		short	keySz
	)

Sets the minimum RSA key size in both the WOLFSSL_CTX structure and the WOLFSSL_CERT_MANAGER structure.

Returns

SSL_SUCCESS returned on successful execution of the function.

BAD_FUNC_ARG returned if the ctx structure is NULL or the keySz is less than zero or not divisible by 8.

Parameters

ctx	a pointer to a WOLFSSL_CTX structure, created using wolfSSL_CTX_new().
keySz	a short integer type stored in minRsaKeySz in the ctx structure and the cm structure converted to bytes.

Example

WOLFSSL_CTX* ctx = SSL_CTX_new(method);
(void)minDhKeyBits;
ourCert = myoptarg;
…
minDhKeyBits = atoi(myoptarg);
…
if(wolfSSL_CTX_SetMinRsaKey_Sz(ctx, minRsaKeyBits) != SSL_SUCCESS){
…

See also

wolfSSL_SetMinRsaKey_Sz

wolfSSL_CTX_SetTmpDH()

int wolfSSL_CTX_SetTmpDH	(	WOLFSSL_CTX *	ctx,
		const unsigned char *	p,
		int	pSz,
		const unsigned char *	g,
		int	gSz
	)

Sets the parameters for the server CTX Diffie-Hellman.

Returns

SSL_SUCCESS returned if the function and all subroutines return without error.

BAD_FUNC_ARG returned if the CTX, p or g parameters are NULL.

DH_KEY_SIZE_E returned if the DH parameter's key size is less than the value of the minDhKeySz member of the WOLFSSL_CTX struct.

DH_KEY_SIZE_E returned if the DH parameter's key size is greater than the value of the maxDhKeySz member of the WOLFSSL_CTX struct.

MEMORY_E returned if the allocation of memory failed in this function or a subroutine.

Parameters

ctx	a pointer to a WOLFSSL_CTX structure, created using wolfSSL_CTX_new().
p	a constant unsigned char pointer loaded into the buffer member of the serverDH_P struct.
pSz	an int type representing the size of p, initialized to MAX_DH_SIZE.
g	a constant unsigned char pointer loaded into the buffer member of the serverDH_G struct.
gSz	an int type representing the size of g, initialized to MAX_DH_SIZE.

Exmaple

WOLFSSL_CTX* ctx =  WOLFSSL_CTX_new( protocol );
byte* p;
byte* g;
word32 pSz = (word32)sizeof(p)/sizeof(byte);
word32 gSz = (word32)sizeof(g)/sizeof(byte);
…
int ret =  wolfSSL_CTX_SetTmpDH(ctx, p, pSz, g, gSz);
 
if(ret != SSL_SUCCESS){
    // Failure case
}

See also

wolfSSL_SetTmpDH

wc_DhParamsLoad

wolfSSL_CTX_SetTmpDH_buffer()

int wolfSSL_CTX_SetTmpDH_buffer	(	WOLFSSL_CTX *	ctx,
		const unsigned char *	b,
		long	sz,
		int	format
	)

A wrapper function that calls wolfSSL_SetTmpDH_buffer_wrapper.

Returns

0 returned for a successful execution.

BAD_FUNC_ARG returned if the ctx or buf parameters are NULL.

MEMORY_E if there is a memory allocation error.

SSL_BAD_FILETYPE returned if format is not correct.

Parameters

ctx	a pointer to a WOLFSSL structure, created using wolfSSL_CTX_new().
buf	a pointer to a constant unsigned char type that is allocated as the buffer and passed through to wolfSSL_SetTmpDH_buffer_wrapper.
sz	a long integer type that is derived from the fname parameter in wolfSSL_SetTmpDH_file_wrapper().
format	an integer type passed through from wolfSSL_SetTmpDH_file_wrapper().

Example

static int wolfSSL_SetTmpDH_file_wrapper(WOLFSSL_CTX* ctx, WOLFSSL* ssl,
Const char* fname, int format);
#ifdef WOLFSSL_SMALL_STACK
byte staticBuffer[1]; // force heap usage
#else
byte* staticBuffer;
long sz = 0;
…
if(ssl){
    ret = wolfSSL_SetTmpDH_buffer(ssl, myBuffer, sz, format);
} else {
ret = wolfSSL_CTX_SetTmpDH_buffer(ctx, myBuffer, sz, format);
}

See also

wolfSSL_SetTmpDH_buffer_wrapper

wolfSSL_SetTMpDH_buffer

wolfSSL_SetTmpDH_file_wrapper

wolfSSL_CTX_SetTmpDH_file

wolfSSL_CTX_SetTmpDH_file()

int wolfSSL_CTX_SetTmpDH_file	(	WOLFSSL_CTX *	ctx,
		const char *	f,
		int	format
	)

The function calls wolfSSL_SetTmpDH_file_wrapper to set the server Diffie-Hellman parameters.

Returns

SSL_SUCCESS returned if the wolfSSL_SetTmpDH_file_wrapper or any of its subroutines return successfully.

MEMORY_E returned if an allocation of dynamic memory fails in a subroutine.

BAD_FUNC_ARG returned if the ctx or fname parameters are NULL or if a subroutine is passed a NULL argument.

SSL_BAD_FILE returned if the certificate file is unable to open or if the a set of checks on the file fail from wolfSSL_SetTmpDH_file_wrapper.

SSL_BAD_FILETYPE returned if the format is not PEM or ASN.1 from wolfSSL_SetTmpDH_buffer_wrapper().

DH_KEY_SIZE_E returned if the DH parameter's key size is less than the value of the minDhKeySz member of the WOLFSSL_CTX struct.

DH_KEY_SIZE_E returned if the DH parameter's key size is greater than the value of the maxDhKeySz member of the WOLFSSL_CTX struct.

SIDE_ERROR returned in wolfSSL_SetTmpDH() if the side is not the server end.

SSL_NO_PEM_HEADER returned from PemToDer if there is no PEM header.

SSL_FATAL_ERROR returned from PemToDer if there is a memory copy failure.

Parameters

ctx	a pointer to a WOLFSSL_CTX structure, created using wolfSSL_CTX_new().
fname	a constant character pointer to a certificate file.
format	an integer type passed through from wolfSSL_SetTmpDH_file_wrapper() that is a representation of the certificate format.

Example

#define dhParam     “certs/dh2048.pem”
#DEFINE aSSERTiNTne(x, y)     AssertInt(x, y, !=, ==)
WOLFSSL_CTX* ctx;
…
AssertNotNull(ctx = wolfSSL_CTX_new(wolfSSLv23_client_method()))
…
AssertIntNE(SSL_SUCCESS, wolfSSL_CTX_SetTmpDH_file(NULL, dhParam,
SSL_FILETYPE_PEM));

See also

wolfSSL_SetTmpDH_buffer_wrapper

wolfSSL_SetTmpDH

wolfSSL_CTX_SetTmpDH

wolfSSL_SetTmpDH_buffer

wolfSSL_CTX_SetTmpDH_buffer

wolfSSL_SetTmpDH_file_wrapper

AllocDer

PemToDer

wolfSSL_CTX_use_certificate_buffer()

int wolfSSL_CTX_use_certificate_buffer	(	WOLFSSL_CTX *	ctx,
		const unsigned char *	in,
		long	sz,
		int	format
	)

This function loads a certificate buffer into the WOLFSSL Context. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. Please see the examples for proper usage.

Returns

SSL_SUCCESS upon success

SSL_BAD_FILETYPE will be returned if the file is the wrong format.

SSL_BAD_FILE will be returned if the file doesn’t exist, can’t be read, or is corrupted.

MEMORY_E will be returned if an out of memory condition occurs.

ASN_INPUT_E will be returned if Base16 decoding fails on the file.

Parameters

ctx	pointer to the SSL context, created with wolfSSL_CTX_new().
in	the input buffer containing the certificate to be loaded.
sz	the size of the input buffer.
format	the format of the certificate located in the input buffer (in). Possible values are SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM.

Example

int ret = 0;
int sz = 0;
WOLFSSL_CTX* ctx;
byte certBuff[...];
...
ret = wolfSSL_CTX_use_certificate_buffer(ctx, certBuff, sz, SSL_FILETYPE_PEM);
if (ret != SSL_SUCCESS) {
    // error loading certificate from buffer
}
...

See also

wolfSSL_CTX_load_verify_buffer

wolfSSL_CTX_use_PrivateKey_buffer

wolfSSL_CTX_use_certificate_chain_buffer

wolfSSL_use_certificate_buffer

wolfSSL_use_PrivateKey_buffer

wolfSSL_use_certificate_chain_buffer

wolfSSL_CTX_use_certificate_chain_buffer()

int wolfSSL_CTX_use_certificate_chain_buffer	(	WOLFSSL_CTX *	ctx,
		const unsigned char *	in,
		long	sz
	)

This function loads a certificate chain buffer into the WOLFSSL Context. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. The buffer must be in PEM format and start with the subject’s certificate, ending with the root certificate. Please see the examples for proper usage.

Returns

SSL_SUCCESS upon success

SSL_BAD_FILETYPE will be returned if the file is the wrong format.

SSL_BAD_FILE will be returned if the file doesn’t exist, can’t be read, or is corrupted.

MEMORY_E will be returned if an out of memory condition occurs.

ASN_INPUT_E will be returned if Base16 decoding fails on the file.

BUFFER_E will be returned if a chain buffer is bigger than the receiving buffer.

Parameters

ctx	pointer to the SSL context, created with wolfSSL_CTX_new().
in	the input buffer containing the PEM-formatted certificate chain to be loaded.
sz	the size of the input buffer.

Example

int ret = 0;
int sz = 0;
WOLFSSL_CTX* ctx;
byte certChainBuff[...];
...
ret = wolfSSL_CTX_use_certificate_chain_buffer(ctx, certChainBuff, sz);
if (ret != SSL_SUCCESS) {
    // error loading certificate chain from buffer
}
...

See also

wolfSSL_CTX_load_verify_buffer

wolfSSL_CTX_use_certificate_buffer

wolfSSL_CTX_use_PrivateKey_buffer

wolfSSL_use_certificate_buffer

wolfSSL_use_PrivateKey_buffer

wolfSSL_use_certificate_chain_buffer

wolfSSL_CTX_use_certificate_chain_file()

int wolfSSL_CTX_use_certificate_chain_file	(	WOLFSSL_CTX *	ctx,
		const char *	file
	)

This function loads a chain of certificates into the SSL context (WOLFSSL_CTX). The file containing the certificate chain is provided by the file argument, and must contain PEM-formatted certificates. This function will process up to MAX_CHAIN_DEPTH (default = 9, defined in internal.h) certificates, plus the subject cert.

Returns

SSL_SUCCESS upon success

SSL_FAILURE If the function call fails, possible causes might include the file is in the wrong format, or the wrong format has been given using the “format” argument, file doesn’t exist, can’t be read, or is corrupted, an out of memory condition occurs.

Parameters

ctx	a pointer to a WOLFSSL_CTX structure, created using wolfSSL_CTX_new()
file	a pointer to the name of the file containing the chain of certificates to be loaded into the wolfSSL SSL context. Certificates must be in PEM format.

Example

int ret = 0;
WOLFSSL_CTX* ctx;
...
ret = wolfSSL_CTX_use_certificate_chain_file(ctx, “./cert-chain.pem”);
if (ret != SSL_SUCCESS) {
    // error loading cert file
}
...

See also

wolfSSL_CTX_use_certificate_file

wolfSSL_CTX_use_certificate_buffer

wolfSSL_use_certificate_file

wolfSSL_use_certificate_buffer

wolfSSL_CTX_use_certificate_file()

int wolfSSL_CTX_use_certificate_file	(	WOLFSSL_CTX *	ctx,
		const char *	file,
		int	format
	)

This function loads a certificate file into the SSL context (WOLFSSL_CTX). The file is provided by the file argument. The format argument specifies the format type of the file, either SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. Please see the examples for proper usage.

Returns

SSL_SUCCESS upon success.

SSL_FAILURE If the function call fails, possible causes might include the file is in the wrong format, or the wrong format has been given using the “format” argument, file doesn’t exist, can’t be read, or is corrupted, an out of memory condition occurs, Base16 decoding fails on the file.

Parameters

ctx	a pointer to a WOLFSSL_CTX structure, created using wolfSSL_CTX_new()
file	a pointer to the name of the file containing the certificate to be loaded into the wolfSSL SSL context.
format	- format of the certificates pointed to by file. Possible options are SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM.

Example

int ret = 0;
WOLFSSL_CTX* ctx;
...
ret = wolfSSL_CTX_use_certificate_file(ctx, “./client-cert.pem”,
                                 SSL_FILETYPE_PEM);
if (ret != SSL_SUCCESS) {
    // error loading cert file
}
...

See also

wolfSSL_CTX_use_certificate_buffer

wolfSSL_use_certificate_file

wolfSSL_use_certificate_buffer

wolfSSL_CTX_use_PrivateKey_buffer()

int wolfSSL_CTX_use_PrivateKey_buffer	(	WOLFSSL_CTX *	ctx,
		const unsigned char *	in,
		long	sz,
		int	format
	)

This function loads a private key buffer into the SSL Context. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1or SSL_FILETYPE_PEM. Please see the examples for proper usage.

Returns

SSL_SUCCESS upon success

SSL_BAD_FILETYPE will be returned if the file is the wrong format.

SSL_BAD_FILE will be returned if the file doesn’t exist, can’t be read, or is corrupted.

MEMORY_E will be returned if an out of memory condition occurs.

ASN_INPUT_E will be returned if Base16 decoding fails on the file.

NO_PASSWORD will be returned if the key file is encrypted but no password is provided.

Parameters

ctx	pointer to the SSL context, created with wolfSSL_CTX_new().
in	the input buffer containing the private key to be loaded.
sz	the size of the input buffer.
format	the format of the private key located in the input buffer (in). Possible values are SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM.

Example

int ret = 0;
int sz = 0;
WOLFSSL_CTX* ctx;
byte keyBuff[...];
...
ret = wolfSSL_CTX_use_PrivateKey_buffer(ctx, keyBuff, sz, SSL_FILETYPE_PEM);
if (ret != SSL_SUCCESS) {
    // error loading private key from buffer
}
...

See also

wolfSSL_CTX_load_verify_buffer

wolfSSL_CTX_use_certificate_buffer

wolfSSL_CTX_use_certificate_chain_buffer

wolfSSL_use_certificate_buffer

wolfSSL_use_PrivateKey_buffer

wolfSSL_use_certificate_chain_buffer

wolfSSL_CTX_use_PrivateKey_file()

int wolfSSL_CTX_use_PrivateKey_file	(	WOLFSSL_CTX *	ctx,
		const char *	file,
		int	format
	)

This function loads a private key file into the SSL context (WOLFSSL_CTX). The file is provided by the file argument. The format argument specifies the format type of the file - SSL_FILETYPE_ASN1or SSL_FILETYPE_PEM. Please see the examples for proper usage.

If using an external key store and do not have the private key you can instead provide the public key and register the crypro callback to handle the signing. For this you can build with either build with crypto callbacks or PK callbacks. To enable crypto callbacks use –enable-cryptocb or WOLF_CRYPTO_CB and register a crypto callback using wc_CryptoCb_RegisterDevice and set the associated devId using wolfSSL_CTX_SetDevId.

Returns

SSL_SUCCESS upon success.

SSL_FAILURE The file is in the wrong format, or the wrong format has been given using the “format” argument. The file doesn’t exist, can’t be read, or is corrupted. An out of memory condition occurs. Base16 decoding fails on the file. The key file is encrypted but no password is provided.

Parameters

none	No parameters.

Example

int ret = 0;
WOLFSSL_CTX* ctx;
...
ret = wolfSSL_CTX_use_PrivateKey_file(ctx, “./server-key.pem”,
                                SSL_FILETYPE_PEM);
if (ret != SSL_SUCCESS) {
    // error loading key file
}
...

See also

wolfSSL_CTX_use_PrivateKey_buffer

wolfSSL_use_PrivateKey_file

wolfSSL_use_PrivateKey_buffer

wc_CryptoCb_RegisterDevice

wolfSSL_CTX_SetDevId

wolfSSL_CTX_use_psk_identity_hint()

int wolfSSL_CTX_use_psk_identity_hint	(	WOLFSSL_CTX *	ctx,
		const char *	hint
	)

This function stores the hint argument in the server_hint member of the WOLFSSL_CTX structure.

Returns

SSL_SUCCESS returned for successful execution of the function.

Parameters

ctx	a pointer to a WOLFSSL_CTX structure, created using wolfSSL_CTX_new().
hint	a constant char pointer that will be copied to the WOLFSSL_CTX structure.

Example

WOLFSSL_CTX* ctx = wolfSSL_CTX_new( protocol method );
const char* hint;
int ret;
…
ret = wolfSSL_CTX_use_psk_identity_hint(ctx, hint);
if(ret == SSL_SUCCESS){
    // Function was successful.
return ret;
} else {
    // Failure case.
}

See also

wolfSSL_use_psk_identity_hint

wolfSSL_d2i_X509_bio()

WOLFSSL_X509* wolfSSL_d2i_X509_bio	(	WOLFSSL_BIO *	bio,
		WOLFSSL_X509 **	x509
	)

This function get the DER buffer from bio and converts it to a WOLFSSL_X509 structure.

Returns

pointer returns a WOLFSSL_X509 structure pointer on success.

Null returns NULL on failure

Parameters

bio	pointer to the WOLFSSL_BIO structure that has the DER certificate buffer.
x509	pointer that get set to new WOLFSSL_X509 structure created.

Example

WOLFSSL_BIO* bio;
WOLFSSL_X509* x509;
// load DER into bio
x509 = wolfSSL_d2i_X509_bio(bio, NULL);
Or
wolfSSL_d2i_X509_bio(bio, &x509);
// use x509 returned (check for NULL)

See also

none

wolfSSL_DeriveTlsKeys()

int wolfSSL_DeriveTlsKeys	(	unsigned char *	key_data,
		word32	keyLen,
		const unsigned char *	ms,
		word32	msLen,
		const unsigned char *	sr,
		const unsigned char *	cr,
		int	tls1_2,
		int	hash_type
	)

An external facing wrapper to derive TLS Keys.

Returns

0 returned on success.

BUFFER_E returned if the sum of labLen and seedLen (computes total size) exceeds the maximum size.

MEMORY_E returned if the allocation of memory failed.

Parameters

key_data	a byte pointer that is allocateded in DeriveTlsKeys and passed through to wc_PRF to hold the final hash.
keyLen	a word32 type that is derived in DeriveTlsKeys from the WOLFSSL structure’s specs member.
ms	a constant pointer type holding the master secret held in the arrays structure within the WOLFSSL structure.
msLen	a word32 type that holds the length of the master secret in an enumerated define, SECRET_LEN.
sr	a constant byte pointer to the serverRandom member of the arrays structure within the WOLFSSL structure.
cr	a constant byte pointer to the clientRandom member of the arrays structure within the WOLFSSL structure.
tls1_2	an integer type returned from IsAtLeastTLSv1_2().
hash_type	an integer type held in the WOLFSSL structure.

Example

int DeriveTlsKeys(WOLFSSL* ssl){
int ret;
…
ret = wolfSSL_DeriveTlsKeys(key_data, length, ssl->arrays->masterSecret,
SECRET_LEN, ssl->arrays->clientRandom,
IsAtLeastTLSv1_2(ssl), ssl->specs.mac_algorithm);
…
}

See also

wc_PRF

DeriveTlsKeys

IsAtLeastTLSv1_2

wolfSSL_DSA_dup_DH()

WOLFSSL_DH* wolfSSL_DSA_dup_DH

(

const WOLFSSL_DSA *

r

)

This function duplicates the parameters in dsa to a newly created WOLFSSL_DH structure.

Returns

WOLFSSL_DH If duplicated returns WOLFSSL_DH structure

NULL upon failure

Parameters

dsa	WOLFSSL_DSA structure to duplicate.

Example

WOLFSSL_DH* dh;
WOLFSSL_DSA* dsa;
// set up dsa
dh = wolfSSL_DSA_dup_DH(dsa);
 
// check dh is not null

See also

none

wolfSSL_FreeArrays()

void wolfSSL_FreeArrays

(

WOLFSSL *

)

Normally, at the end of the SSL handshake, wolfSSL frees temporary arrays. If wolfSSL_KeepArrays() has been called before the handshake, wolfSSL will not free temporary arrays. This function explicitly frees temporary arrays and should be called when the user is done with temporary arrays and does not want to wait for the SSL object to be freed to free these resources.

Returns

none No return.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().

Example

WOLFSSL* ssl;
...
wolfSSL_FreeArrays(ssl);

See also

wolfSSL_KeepArrays

wolfSSL_get_chain_X509()

WOLFSSL_X509* wolfSSL_get_chain_X509	(	WOLFSSL_X509_CHAIN *	chain,
		int	idx
	)

This function gets the peer’s wolfSSL_X509_certificate at index (idx) from the chain of certificates.

Returns

pointer returns a pointer to a WOLFSSL_X509 structure.

Parameters

chain	a pointer to the WOLFSSL_X509_CHAIN used for no dynamic memory SESSION_CACHE.
idx	the index of the WOLFSSL_X509 certificate.

Note that it is the user's responsibility to free the returned memory by calling wolfSSL_FreeX509().

Example

WOLFSSL_X509_CHAIN* chain = &session->chain;
int idx = 999; // set idx
...
WOLFSSL_X509_CHAIN ptr;
prt = wolfSSL_get_chain_X509(chain, idx);
 
if(ptr != NULL){
    // ptr contains the cert at the index specified
    wolfSSL_FreeX509(ptr);
} else {
    // ptr is NULL
}

See also

InitDecodedCert

ParseCertRelative

CopyDecodedToX509

wolfSSL_get_peer_certificate()

WOLFSSL_X509* wolfSSL_get_peer_certificate

(

WOLFSSL *

ssl

)

This function gets the peer’s certificate.

Returns

pointer a pointer to the peerCert member of the WOLFSSL_X509 structure if it exists.

0 returned if the peer certificate issuer size is not defined.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().

Example

WOLFSSL_CTX* ctx = wolfSSL_CTX_new( method );
WOLFSSL* ssl = wolfSSL_new(ctx);
...
WOLFSSL_X509* peerCert = wolfSSL_get_peer_certificate(ssl);
 
if(peerCert){
    // You have a pointer peerCert to the peer certification
}

See also

wolfSSL_X509_get_issuer_name

wolfSSL_X509_get_subject_name

wolfSSL_X509_get_isCA

wolfSSL_get_psk_identity()

const char* wolfSSL_get_psk_identity

(

const WOLFSSL *

)

The function returns a constant pointer to the client_identity member of the Arrays structure.

Returns

string the string value of the client_identity member of the Arrays structure.

NULL if the WOLFSSL structure is NULL or if the Arrays member of the WOLFSSL structure is NULL.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().

Example

WOLFSSL_CTX* ctx = wolfSSL_CTX_new( method );
WOLFSSL* ssl = wolfSSL_new(ctx);
const char* pskID;
...
pskID = wolfSSL_get_psk_identity(ssl);
 
if(pskID == NULL){
    // There is not a value in pskID
}

See also

wolfSSL_get_psk_identity_hint

wolfSSL_use_psk_identity_hint

wolfSSL_get_psk_identity_hint()

const char* wolfSSL_get_psk_identity_hint

(

const WOLFSSL *

)

This function returns the psk identity hint.

Returns

pointer a const char pointer to the value that was stored in the arrays member of the WOLFSSL structure is returned.

NULL returned if the WOLFSSL or Arrays structures are NULL.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().

Example

WOLFSSL* ssl = wolfSSL_new(ctx);
char* idHint;
...
idHint = wolfSSL_get_psk_identity_hint(ssl);
if(idHint){
    // The hint was retrieved
    return idHint;
} else {
    // Hint wasn’t successfully retrieved
}

See also

wolfSSL_get_psk_identity

wolfSSL_get_system_CA_dirs()

const char** wolfSSL_get_system_CA_dirs

(

word32 *

num

)

This function returns a pointer to an array of strings representing directories wolfSSL will search for system CA certs when wolfSSL_CTX_load_system_CA_certs is called. On systems that don't store certificates in an accessible system directory (such as Apple platforms), this function will always return NULL.

Returns

Valid pointer on success.

NULL pointer on failure.

Parameters

num	pointer to a word32 that will be populated with the length of the array of strings.

Example

WOLFSSL_CTX* ctx;
const char** dirs;
word32 numDirs;
 
dirs = wolfSSL_get_system_CA_dirs(&numDirs);
for (int i = 0; i < numDirs; ++i) {
    printf("Potential system CA dir: %s\n", dirs[i]);
}
...

See also

wolfSSL_CTX_load_system_CA_certs

wolfSSL_CTX_load_verify_locations

wolfSSL_CTX_load_verify_locations_ex

wolfSSL_GetDhKey_Sz()

int wolfSSL_GetDhKey_Sz

(

WOLFSSL *

)

Returns the value of dhKeySz (in bits) that is a member of the options structure. This value represents the Diffie-Hellman key size in bytes.

Returns

dhKeySz returns the value held in ssl->options.dhKeySz which is an integer value representing a size in bits.

BAD_FUNC_ARG returns if the WOLFSSL struct is NULL.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().

Example

WOLFSSL_CTX* ctx = wolfSSL_CTX_new( protocol method );
WOLFSSL* ssl = wolfSSL_new(ctx);
int dhKeySz;
...
dhKeySz = wolfSSL_GetDhKey_Sz(ssl);
 
if(dhKeySz == BAD_FUNC_ARG || dhKeySz <= 0){
    // Failure case
} else {
    // dhKeySz holds the size of the key.
}

See also

wolfSSL_SetMinDhKey_sz

wolfSSL_CTX_SetMinDhKey_Sz

wolfSSL_CTX_SetTmpDH

wolfSSL_SetTmpDH

wolfSSL_CTX_SetTmpDH_file

wolfSSL_GetIVSize()

int wolfSSL_GetIVSize

(

WOLFSSL *

)

Returns the iv_size member of the specs structure held in the WOLFSSL struct.

Returns

iv_size returns the value held in ssl->specs.iv_size.

BAD_FUNC_ARG returned if the WOLFSSL structure is NULL.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().

Example

WOLFSSL_CTX* ctx = wolfSSL_CTX_new( method );
WOLFSSL* ssl = wolfSSL_new(ctx);
int ivSize;
...
ivSize = wolfSSL_GetIVSize(ssl);
 
if(ivSize > 0){
    // ivSize holds the specs.iv_size value.
}

See also

wolfSSL_GetKeySize

wolfSSL_GetClientWriteIV

wolfSSL_GetServerWriteIV

wolfSSL_KeepArrays()

void wolfSSL_KeepArrays

(

WOLFSSL *

)

Normally, at the end of the SSL handshake, wolfSSL frees temporary arrays. Calling this function before the handshake begins will prevent wolfSSL from freeing temporary arrays. Temporary arrays may be needed for things such as wolfSSL_get_keys() or PSK hints. When the user is done with temporary arrays, either wolfSSL_FreeArrays() may be called to free the resources immediately, or alternatively the resources will be freed when the associated SSL object is freed.

Returns

none No return.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().

Example

WOLFSSL* ssl;
...
wolfSSL_KeepArrays(ssl);

See also

wolfSSL_FreeArrays

wolfSSL_make_eap_keys()

int wolfSSL_make_eap_keys	(	WOLFSSL *	ssl,
		void *	key,
		unsigned int	len,
		const char *	label
	)

This function is used by EAP_TLS and EAP-TTLS to derive keying material from the master secret.

Returns

BUFFER_E returned if the actual size of the buffer exceeds the maximum size allowable.

MEMORY_E returned if there is an error with memory allocation.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().
msk	a void pointer variable that will hold the result of the p_hash function.
len	an unsigned integer that represents the length of the msk variable.
label	a constant char pointer that is copied from in wc_PRF().

Example

WOLFSSL* ssl = wolfSSL_new(ctx);;
void* msk;
unsigned int len;
const char* label;
…
return wolfSSL_make_eap_keys(ssl, msk, len, label);

See also

wc_PRF

wc_HmacFinal

wc_HmacUpdate

wolfSSL_PEM_read_bio_DSAparams()

WOLFSSL_DSA* wolfSSL_PEM_read_bio_DSAparams	(	WOLFSSL_BIO *	bp,
		WOLFSSL_DSA **	x,
		wc_pem_password_cb *	cb,
		void *	u
	)

This function get the DSA parameters from a PEM buffer in bio.

Returns

WOLFSSL_DSA on successfully parsing the PEM buffer a WOLFSSL_DSA structure is created and returned.

Null if failed to parse PEM buffer.

Parameters

bio	pointer to the WOLFSSL_BIO structure for getting PEM memory pointer.
x	pointer to be set to new WOLFSSL_DSA structure.
cb	password callback function.
u	null terminated password string.

Example

WOLFSSL_BIO* bio;
WOLFSSL_DSA* dsa;
// setup bio
dsa = wolfSSL_PEM_read_bio_DSAparams(bio, NULL, NULL, NULL);
 
// check dsa is not NULL and then use dsa

See also

none

wolfSSL_PEM_read_bio_X509_AUX()

WOLFSSL_X509* wolfSSL_PEM_read_bio_X509_AUX	(	WOLFSSL_BIO *	bp,
		WOLFSSL_X509 **	x,
		wc_pem_password_cb *	cb,
		void *	u
	)

This function behaves the same as wolfSSL_PEM_read_bio_X509. AUX signifies containing extra information such as trusted/rejected use cases and friendly name for human readability.

Returns

WOLFSSL_X509 on successfully parsing the PEM buffer a WOLFSSL_X509 structure is returned.

Null if failed to parse PEM buffer.

Parameters

bp	WOLFSSL_BIO structure to get PEM buffer from.
x	if setting WOLFSSL_X509 by function side effect.
cb	password callback.
u	NULL terminated user password.

Example

WOLFSSL_BIO* bio;
WOLFSSL_X509* x509;
// setup bio
X509 = wolfSSL_PEM_read_bio_X509_AUX(bio, NULL, NULL, NULL);
//check x509 is not null and then use it

See also

wolfSSL_PEM_read_bio_X509

wolfSSL_SetCertCbCtx()

void wolfSSL_SetCertCbCtx	(	WOLFSSL *	ssl,
		void *	ctx
	)

This function stores user CTX object information for verify callback.

Returns

none No return.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().
ctx	a void pointer that is set to WOLFSSL structure’s verifyCbCtx member’s value.

Example

WOLFSSL_CTX* ctx = wolfSSL_CTX_new( method );
WOLFSSL* ssl = wolfSSL_new(ctx);
(void*)ctx;
...
if(ssl != NULL){
wolfSSL_SetCertCbCtx(ssl, ctx);
} else {
    // Error case, the SSL is not initialized properly.
}

See also

wolfSSL_CTX_save_cert_cache

wolfSSL_CTX_restore_cert_cache

wolfSSL_CTX_set_verify

wolfSSL_SetMaxDhKey_Sz()

int wolfSSL_SetMaxDhKey_Sz	(	WOLFSSL *	ssl,
		word16	keySz_bits
	)

Sets the maximum size (in bits) for a Diffie-Hellman key in the WOLFSSL structure.

Returns

SSL_SUCCESS the maximum size was successfully set.

BAD_FUNC_ARG the WOLFSSL structure was NULL or the keySz parameter was greater than the allowable size or not divisible by 8.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().
keySz	a word16 type representing the bit size of the maximum DH key.

Example

WOLFSSL* ssl = wolfSSL_new(ctx);
word16 keySz;
...
if(wolfSSL_SetMaxDhKey(ssl, keySz) != SSL_SUCCESS){
    // Failed to set.
}

See also

wolfSSL_CTX_SetMaxDhKey_Sz

wolfSSL_GetDhKey_Sz

wolfSSL_SetMinDhKey_Sz()

int wolfSSL_SetMinDhKey_Sz	(	WOLFSSL *	ssl,
		word16	keySz_bits
	)

Sets the minimum size (in bits) for a Diffie-Hellman key in the WOLFSSL structure.

Returns

SSL_SUCCESS the minimum size was successfully set.

BAD_FUNC_ARG the WOLFSSL structure was NULL or if the keySz_bits is greater than 16,000 or not divisible by 8.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().
keySz_bits	a word16 type used to set the minimum DH key size in bits. The WOLFSSL_CTX struct holds this information in the minDhKeySz member.

Example

WOLFSSL* ssl = wolfSSL_new(ctx);
word16 keySz_bits;
...
if(wolfSSL_SetMinDhKey_Sz(ssl, keySz_bits) != SSL_SUCCESS){
    // Failed to set.
}

See also

wolfSSL_CTX_SetMinDhKey_Sz

wolfSSL_GetDhKey_Sz

wolfSSL_SetMinEccKey_Sz()

int wolfSSL_SetMinEccKey_Sz	(	WOLFSSL *	ssl,
		short	keySz
	)

Sets the value of the minEccKeySz member of the options structure. The options struct is a member of the WOLFSSL structure and is accessed through the ssl parameter.

Returns

SSL_SUCCESS if the function successfully set the minEccKeySz member of the options structure.

BAD_FUNC_ARG if the WOLFSSL_CTX structure is NULL or if the key size (keySz) is less than 0 (zero) or not divisible by 8.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().
keySz	value used to set the minimum ECC key size. Sets value in the options structure.

Example

WOLFSSL* ssl = wolfSSL_new(ctx); // New session
short keySz = 999; // should be set to min key size allowable
...
if(wolfSSL_SetMinEccKey_Sz(ssl, keySz) != SSL_SUCCESS){
    // Failure case.
}

See also

wolfSSL_CTX_SetMinEccKey_Sz

wolfSSL_CTX_SetMinRsaKey_Sz

wolfSSL_SetMinRsaKey_Sz

wolfSSL_SetMinRsaKey_Sz()

int wolfSSL_SetMinRsaKey_Sz	(	WOLFSSL *	ssl,
		short	keySz
	)

Sets the minimum allowable key size in bits for RSA located in the WOLFSSL structure.

Returns

SSL_SUCCESS the minimum was set successfully.

BAD_FUNC_ARG returned if the ssl structure is NULL or if the ksySz is less than zero or not divisible by 8.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().
keySz	a short integer value representing the the minimum key in bits.

Example

WOLFSSL* ssl = wolfSSL_new(ctx);
short keySz;
…
 
int isSet =  wolfSSL_SetMinRsaKey_Sz(ssl, keySz);
if(isSet != SSL_SUCCESS){
    Failed to set.
}

See also

wolfSSL_CTX_SetMinRsaKey_Sz

wolfSSL_SetTmpDH()

int wolfSSL_SetTmpDH	(	WOLFSSL *	ssl,
		const unsigned char *	p,
		int	pSz,
		const unsigned char *	g,
		int	gSz
	)

Server Diffie-Hellman Ephemeral parameters setting. This function sets up the group parameters to be used if the server negotiates a cipher suite that uses DHE.

Returns

SSL_SUCCESS upon success.

MEMORY_ERROR will be returned if a memory error was encountered.

SIDE_ERROR will be returned if this function is called on an SSL client instead of an SSL server.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().
p	Diffie-Hellman prime number parameter.
pSz	size of p.
g	Diffie-Hellman “generator” parameter.
gSz	size of g.

Example

WOLFSSL* ssl;
static unsigned char p[] = {...};
static unsigned char g[] = {...};
...
wolfSSL_SetTmpDH(ssl, p, sizeof(p), g, sizeof(g));

See also

SSL_accept

wolfSSL_SetTmpDH_buffer()

int wolfSSL_SetTmpDH_buffer	(	WOLFSSL *	ssl,
		const unsigned char *	b,
		long	sz,
		int	format
	)

The function calls the wolfSSL_SetTMpDH_buffer_wrapper, which is a wrapper for Diffie-Hellman parameters.

Returns

SSL_SUCCESS on successful execution.

SSL_BAD_FILETYPE if the file type is not PEM and is not ASN.1. It will also be returned if the wc_DhParamsLoad does not return normally.

SSL_NO_PEM_HEADER returns from PemToDer if there is not a PEM header.

SSL_BAD_FILE returned if there is a file error in PemToDer.

SSL_FATAL_ERROR returned from PemToDer if there was a copy error.

MEMORY_E - if there was a memory allocation error.

BAD_FUNC_ARG returned if the WOLFSSL struct is NULL or if there was otherwise a NULL argument passed to a subroutine.

DH_KEY_SIZE_E is returned if their is a key size error in wolfSSL_SetTmpDH() or in wolfSSL_CTX_SetTmpDH().

SIDE_ERROR returned if it is not the server side in wolfSSL_SetTmpDH.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().
buf	allocated buffer passed in from wolfSSL_SetTMpDH_file_wrapper.
sz	a long int that holds the size of the file (fname within wolfSSL_SetTmpDH_file_wrapper).
format	an integer type passed through from wolfSSL_SetTmpDH_file_wrapper() that is a representation of the certificate format.

Example

Static int wolfSSL_SetTmpDH_file_wrapper(WOLFSSL_CTX* ctx, WOLFSSL* ssl,
Const char* fname, int format);
long sz = 0;
byte* myBuffer = staticBuffer[FILE_BUFFER_SIZE];
…
if(ssl)
ret = wolfSSL_SetTmpDH_buffer(ssl, myBuffer, sz, format);

See also

wolfSSL_SetTmpDH_buffer_wrapper

wc_DhParamsLoad

wolfSSL_SetTmpDH

PemToDer

wolfSSL_CTX_SetTmpDH

wolfSSL_CTX_SetTmpDH_file

wolfSSL_SetTmpDH_file()

int wolfSSL_SetTmpDH_file	(	WOLFSSL *	ssl,
		const char *	f,
		int	format
	)

This function calls wolfSSL_SetTmpDH_file_wrapper to set server Diffie-Hellman parameters.

Returns

SSL_SUCCESS returned on successful completion of this function and its subroutines.

MEMORY_E returned if a memory allocation failed in this function or a subroutine.

SIDE_ERROR if the side member of the Options structure found in the WOLFSSL struct is not the server side.

SSL_BAD_FILETYPE returns if the certificate fails a set of checks.

DH_KEY_SIZE_E returned if the DH parameter's key size is less than the value of the minDhKeySz member in the WOLFSSL struct.

DH_KEY_SIZE_E returned if the DH parameter's key size is greater than the value of the maxDhKeySz member in the WOLFSSL struct.

BAD_FUNC_ARG returns if an argument value is NULL that is not permitted such as, the WOLFSSL structure.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().
fname	a constant char pointer holding the certificate.
format	an integer type that holds the format of the certification.

Example

WOLFSSL* ssl = wolfSSL_new(ctx);
const char* dhParam;
…
AssertIntNE(SSL_SUCCESS,
wolfSSL_SetTmpDH_file(ssl, dhParam, SSL_FILETYPE_PEM));

See also

wolfSSL_CTX_SetTmpDH_file

wolfSSL_SetTmpDH_file_wrapper

wolfSSL_SetTmpDH_buffer

wolfSSL_CTX_SetTmpDH_buffer

wolfSSL_SetTmpDH_buffer_wrapper

wolfSSL_SetTmpDH

wolfSSL_CTX_SetTmpDH

wolfSSL_UnloadCertsKeys()

int wolfSSL_UnloadCertsKeys

(

WOLFSSL *

)

This function unloads any certificates or keys that SSL owns.

Returns

SSL_SUCCESS - returned if the function executed successfully.

BAD_FUNC_ARG - returned if the WOLFSSL object is NULL.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().

Example

WOLFSSL* ssl = wolfSSL_new(ctx);
...
int unloadKeys = wolfSSL_UnloadCertsKeys(ssl);
if(unloadKeys != SSL_SUCCESS){
    // Failure case.
}

See also

wolfSSL_CTX_UnloadCAs

wolfSSL_use_certificate_buffer()

int wolfSSL_use_certificate_buffer	(	WOLFSSL *	ssl,
		const unsigned char *	in,
		long	sz,
		int	format
	)

This function loads a certificate buffer into the WOLFSSL object. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. Please see the examples for proper usage.

Returns

SSL_SUCCESS upon success.

SSL_BAD_FILETYPE will be returned if the file is the wrong format.

SSL_BAD_FILE will be returned if the file doesn’t exist, can’t be read, or is corrupted.

MEMORY_E will be returned if an out of memory condition occurs.

ASN_INPUT_E will be returned if Base16 decoding fails on the file.

Parameters

ssl	pointer to the SSL session, created with wolfSSL_new().
in	buffer containing certificate to load.
sz	size of the certificate located in buffer.
format	format of the certificate to be loaded. Possible values are SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM.

Example

int buffSz;
int ret;
byte certBuff[...];
WOLFSSL* ssl = 0;
...
 
ret = wolfSSL_use_certificate_buffer(ssl, certBuff, buffSz, SSL_FILETYPE_PEM);
if (ret != SSL_SUCCESS) {
    // failed to load certificate from buffer
}

See also

wolfSSL_CTX_load_verify_buffer

wolfSSL_CTX_use_certificate_buffer

wolfSSL_CTX_use_PrivateKey_buffer

wolfSSL_CTX_use_certificate_chain_buffer

wolfSSL_use_PrivateKey_buffer

wolfSSL_use_certificate_chain_buffer

wolfSSL_use_certificate_chain_buffer()

int wolfSSL_use_certificate_chain_buffer	(	WOLFSSL *	ssl,
		const unsigned char *	in,
		long	sz
	)

This function loads a certificate chain buffer into the WOLFSSL object. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. The buffer must be in PEM format and start with the subject’s certificate, ending with the root certificate. Please see the examples for proper usage.

Returns

SSL_SUCCES upon success.

SSL_BAD_FILETYPE will be returned if the file is the wrong format.

SSL_BAD_FILE will be returned if the file doesn’t exist, can’t be read, or is corrupted.

MEMORY_E will be returned if an out of memory condition occurs.

ASN_INPUT_E will be returned if Base16 decoding fails on the file.

BUFFER_E will be returned if a chain buffer is bigger than the receiving buffer.

Parameters

ssl	pointer to the SSL session, created with wolfSSL_new().
in	buffer containing certificate to load.
sz	size of the certificate located in buffer.

Example

int buffSz;
int ret;
byte certChainBuff[...];
WOLFSSL* ssl = 0;
...
ret = wolfSSL_use_certificate_chain_buffer(ssl, certChainBuff, buffSz);
if (ret != SSL_SUCCESS) {
    // failed to load certificate chain from buffer
}

See also

wolfSSL_CTX_load_verify_buffer

wolfSSL_CTX_use_certificate_buffer

wolfSSL_CTX_use_PrivateKey_buffer

wolfSSL_CTX_use_certificate_chain_buffer

wolfSSL_use_certificate_buffer

wolfSSL_use_PrivateKey_buffer

wolfSSL_use_PrivateKey()

int wolfSSL_use_PrivateKey	(	WOLFSSL *	ssl,
		WOLFSSL_EVP_PKEY *	pkey
	)

This is used to set the private key for the WOLFSSL structure.

Returns

SSL_SUCCESS On successful setting argument.

SSL_FAILURE If a NULL ssl passed in. All error cases will be negative values.

Parameters

ssl	WOLFSSL structure to set argument in.
pkey	private key to use.

Example

WOLFSSL* ssl;
WOLFSSL_EVP_PKEY* pkey;
int ret;
// create ssl object and set up private key
ret  = wolfSSL_use_PrivateKey(ssl, pkey);
// check ret value

See also

wolfSSL_new

wolfSSL_free

wolfSSL_use_PrivateKey_ASN1()

int wolfSSL_use_PrivateKey_ASN1	(	int	pri,
		WOLFSSL *	ssl,
		unsigned char *	der,
		long	derSz
	)

This is used to set the private key for the WOLFSSL structure. A DER formatted key buffer is expected.

Returns

SSL_SUCCESS On successful setting parsing and setting the private key.

SSL_FAILURE If an NULL ssl passed in. All error cases will be negative values.

Parameters

pri	type of private key.
ssl	WOLFSSL structure to set argument in.
der	buffer holding DER key.
derSz	size of der buffer.

Example

WOLFSSL* ssl;
unsigned char* pkey;
long pkeySz;
int ret;
// create ssl object and set up private key
ret  = wolfSSL_use_PrivateKey_ASN1(1, ssl, pkey, pkeySz);
// check ret value

See also

wolfSSL_new

wolfSSL_free

wolfSSL_use_PrivateKey

wolfSSL_use_PrivateKey_buffer()

int wolfSSL_use_PrivateKey_buffer	(	WOLFSSL *	ssl,
		const unsigned char *	in,
		long	sz,
		int	format
	)

This function loads a private key buffer into the WOLFSSL object. It behaves like the non-buffered version, only differing in its ability to be called with a buffer as input instead of a file. The buffer is provided by the in argument of size sz. format specifies the format type of the buffer; SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM. Please see the examples for proper usage.

Returns

SSL_SUCCESS upon success.

SSL_BAD_FILETYPE will be returned if the file is the wrong format.

SSL_BAD_FILE will be returned if the file doesn’t exist, can’t be read, or is corrupted.

MEMORY_E will be returned if an out of memory condition occurs.

ASN_INPUT_E will be returned if Base16 decoding fails on the file.

NO_PASSWORD will be returned if the key file is encrypted but no password is provided.

Parameters

ssl	pointer to the SSL session, created with wolfSSL_new().
in	buffer containing private key to load.
sz	size of the private key located in buffer.
format	format of the private key to be loaded. Possible values are SSL_FILETYPE_ASN1 or SSL_FILETYPE_PEM.

Example

int buffSz;
int ret;
byte keyBuff[...];
WOLFSSL* ssl = 0;
...
ret = wolfSSL_use_PrivateKey_buffer(ssl, keyBuff, buffSz, SSL_FILETYPE_PEM);
if (ret != SSL_SUCCESS) {
    // failed to load private key from buffer
}

See also

wolfSSL_use_PrivateKey

wolfSSL_CTX_load_verify_buffer

wolfSSL_CTX_use_certificate_buffer

wolfSSL_CTX_use_PrivateKey_buffer

wolfSSL_CTX_use_certificate_chain_buffer

wolfSSL_use_certificate_buffer

wolfSSL_use_certificate_chain_buffer

wolfSSL_use_psk_identity_hint()

int wolfSSL_use_psk_identity_hint	(	WOLFSSL *	ssl,
		const char *	hint
	)

This function stores the hint argument in the server_hint member of the Arrays structure within the WOLFSSL structure.

Returns

SSL_SUCCESS returned if the hint was successfully stored in the WOLFSSL structure.

SSL_FAILURE returned if the WOLFSSL or Arrays structures are NULL.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().
hint	a constant character pointer that holds the hint to be saved in memory.

Example

WOLFSSL* ssl = wolfSSL_new(ctx);
const char* hint;
...
if(wolfSSL_use_psk_identity_hint(ssl, hint) != SSL_SUCCESS){
    // Handle failure case.
}

See also

wolfSSL_CTX_use_psk_identity_hint

wolfSSL_use_RSAPrivateKey_ASN1()

int wolfSSL_use_RSAPrivateKey_ASN1	(	WOLFSSL *	ssl,
		unsigned char *	der,
		long	derSz
	)

This is used to set the private key for the WOLFSSL structure. A DER formatted RSA key buffer is expected.

Returns

SSL_SUCCESS On successful setting parsing and setting the private key.

SSL_FAILURE If an NULL ssl passed in. All error cases will be negative values.

Parameters

ssl	WOLFSSL structure to set argument in.
der	buffer holding DER key.
derSz	size of der buffer.

Example

WOLFSSL* ssl;
unsigned char* pkey;
long pkeySz;
int ret;
// create ssl object and set up RSA private key
ret  = wolfSSL_use_RSAPrivateKey_ASN1(ssl, pkey, pkeySz);
// check ret value

See also

wolfSSL_new

wolfSSL_free

wolfSSL_use_PrivateKey

wolfSSL_X509_d2i_fp()

WOLFSSL_X509* wolfSSL_X509_d2i_fp	(	WOLFSSL_X509 **	x509,
		FILE *	file
	)

If NO_STDIO_FILESYSTEM is defined this function will allocate heap memory, initialize a WOLFSSL_X509 structure and return a pointer to it.

Returns

*WOLFSSL_X509 WOLFSSL_X509 structure pointer is returned if the function executes successfully.

NULL if the call to XFTELL macro returns a negative value.

Parameters

x509	a pointer to a WOLFSSL_X509 pointer.
file	a defined type that is a pointer to a FILE.

Example

WOLFSSL_X509* x509a = (WOLFSSL_X509*)XMALLOC(sizeof(WOLFSSL_X509), NULL,
DYNAMIC_TYPE_X509);
WOLFSSL_X509** x509 = x509a;
XFILE file;  (mapped to struct fs_file*)
...
WOLFSSL_X509* newX509 = wolfSSL_X509_d2i_fp(x509, file);
if(newX509 == NULL){
    // The function returned NULL
}

See also

wolfSSL_X509_d2i

XFTELL

XREWIND

XFSEEK

wolfSSL_X509_digest()

int wolfSSL_X509_digest	(	const WOLFSSL_X509 *	x509,
		const WOLFSSL_EVP_MD *	digest,
		unsigned char *	buf,
		unsigned int *	len
	)

This function returns the hash of the DER certificate.

Returns

SSL_SUCCESS On successfully creating a hash.

SSL_FAILURE Returned on bad input or unsuccessful hash.

Parameters

x509	certificate to get the hash of.
digest	the hash algorithm to use.
buf	buffer to hold hash.
len	length of buffer.

Example

WOLFSSL_X509* x509;
unsigned char buffer[64];
unsigned int bufferSz;
int ret;
 
ret = wolfSSL_X509_digest(x509, wolfSSL_EVP_sha256(), buffer, &bufferSz);
//check ret value

See also

none

wolfSSL_X509_get_der()

const unsigned char* wolfSSL_X509_get_der	(	WOLFSSL_X509 *	x509,
		int *	outSz
	)

This function gets the DER encoded certificate in the WOLFSSL_X509 struct.

Returns

buffer This function returns the DerBuffer structure’s buffer member, which is of type byte.

NULL returned if the x509 or outSz parameter is NULL.

Parameters

x509	a pointer to a WOLFSSL_X509 structure containing certificate information.
outSz	length of the derBuffer member of the WOLFSSL_X509 struct.

Example

WOLFSSL_X509 x509 = (WOLFSSL_X509*)XMALLOC(sizeof(WOLFSSL_X509), NULL,
                        DYNAMIC_TYPE_X509);
int* outSz; // initialize
...
byte* x509Der = wolfSSL_X509_get_der(x509, outSz);
if(x509Der == NULL){
    // Failure case one of the parameters was NULL
}

See also

wolfSSL_X509_version

wolfSSL_X509_Name_get_entry

wolfSSL_X509_get_next_altname

wolfSSL_X509_get_issuer_name

wolfSSL_X509_get_subject_name

wolfSSL_X509_get_device_type()

unsigned char* wolfSSL_X509_get_device_type	(	WOLFSSL_X509 *	x509,
		unsigned char *	in,
		int *	inOutSz
	)

This function copies the device type from the x509 structure to the buffer.

Returns

pointer returns a byte pointer holding the device type from the x509 structure.

NULL returned if the buffer size is NULL.

Parameters

x509	pointer to a WOLFSSL_X509 structure, created with WOLFSSL_X509_new().
in	a pointer to a byte type that will hold the device type (the buffer).
inOutSz	the minimum of either the parameter inOutSz or the deviceTypeSz member of the x509 structure.

Example

WOLFSSL_X509* x509 = (WOLFSSL_X509)XMALOC(sizeof(WOLFSSL_X509), NULL,
DYNAMIC_TYPE_X509);
byte* in;
int* inOutSz;
...
byte* deviceType = wolfSSL_X509_get_device_type(x509, in, inOutSz);
 
if(!deviceType){
    // Failure case, NULL was returned.
}

See also

wolfSSL_X509_get_hw_type

wolfSSL_X509_get_hw_serial_number

wolfSSL_X509_d2i

wolfSSL_X509_get_ext_by_NID()

int wolfSSL_X509_get_ext_by_NID	(	const WOLFSSL_X509 *	x509,
		int	nid,
		int	lastPos
	)

This function looks for and returns the extension index matching the passed in NID value.

Returns

>= 0 If successful the extension index is returned.

-1 If extension is not found or error is encountered.

Parameters

x509	certificate to get parse through for extension.
nid	extension OID to be found.
lastPos	start search from extension after lastPos. Set to -1 initially.

Example

const WOLFSSL_X509* x509;
int lastPos = -1;
int idx;
 
idx = wolfSSL_X509_get_ext_by_NID(x509, NID_basic_constraints, lastPos);

wolfSSL_X509_get_ext_d2i()

void* wolfSSL_X509_get_ext_d2i	(	const WOLFSSL_X509 *	x509,
		int	nid,
		int *	c,
		int *	idx
	)

This function looks for and returns the extension matching the passed in NID value.

Returns

pointer If successful a STACK_OF(WOLFSSL_ASN1_OBJECT) pointer is returned.

NULL If extension is not found or error is encountered.

Parameters

x509	certificate to get parse through for extension.
nid	extension OID to be found.
c	if not NULL is set to -2 for multiple extensions found -1 if not found, 0 if found and not critical and 1 if found and critical.
idx	if NULL return first extension matched otherwise if not stored in x509 start at idx.

Example

const WOLFSSL_X509* x509;
int c;
int idx = 0;
STACK_OF(WOLFSSL_ASN1_OBJECT)* sk;
 
sk = wolfSSL_X509_get_ext_d2i(x509, NID_basic_constraints, &c, &idx);
//check sk for NULL and then use it. sk needs freed after done.

See also

wolfSSL_sk_ASN1_OBJECT_free

wolfSSL_X509_get_hw_serial_number()

unsigned char* wolfSSL_X509_get_hw_serial_number	(	WOLFSSL_X509 *	x509,
		unsigned char *	in,
		int *	inOutSz
	)

This function returns the hwSerialNum member of the x509 object.

Returns

pointer the function returns a byte pointer to the in buffer that will contain the serial number loaded from the x509 object.

Parameters

x509	pointer to a WOLFSSL_X509 structure containing certificate information.
in	a pointer to the buffer that will be copied to.
inOutSz	a pointer to the size of the buffer.

Example

char* serial;
byte* in;
int* inOutSz;
WOLFSSL_X509 x509;
...
serial = wolfSSL_X509_get_hw_serial_number(x509, in, inOutSz);
 
if(serial == NULL || serial <= 0){
    // Failure case
}

See also

wolfSSL_X509_get_subject_name

wolfSSL_X509_get_issuer_name

wolfSSL_X509_get_isCA

wolfSSL_get_peer_certificate

wolfSSL_X509_version

wolfSSL_X509_get_hw_type()

unsigned char* wolfSSL_X509_get_hw_type	(	WOLFSSL_X509 *	x509,
		unsigned char *	in,
		int *	inOutSz
	)

The function copies the hwType member of the WOLFSSL_X509 structure to the buffer.

Returns

byte The function returns a byte type of the data previously held in the hwType member of the WOLFSSL_X509 structure.

NULL returned if inOutSz is NULL.

Parameters

x509	a pointer to a WOLFSSL_X509 structure containing certificate information.
in	pointer to type byte that represents the buffer.
inOutSz	pointer to type int that represents the size of the buffer.

Example

WOLFSSL_X509* x509;  // X509 certificate
byte* in;  // initialize the buffer
int* inOutSz;  // holds the size of the buffer
...
byte* hwType = wolfSSL_X509_get_hw_type(x509, in, inOutSz);
 
if(hwType == NULL){
    // Failure case function returned NULL.
}

See also

wolfSSL_X509_get_hw_serial_number

wolfSSL_X509_get_device_type

wolfSSL_X509_get_isCA()

int wolfSSL_X509_get_isCA

(

WOLFSSL_X509 *

cert

)

Checks the isCa member of the WOLFSSL_X509 structure and returns the value.

Returns

isCA returns the value in the isCA member of the WOLFSSL_X509 structure is returned.

0 returned if there is not a valid x509 structure passed in.

Parameters

cert	a pointer to a WOLFSSL_X509 structure.

Example

WOLFSSL* ssl;
...
WOLFSSL_CTX* ctx = wolfSSL_CTX_new( method );
WOLFSSL* ssl = wolfSSL_new(ctx);
...
if(wolfSSL_X509_get_isCA(ssl)){
    // This is the CA
}else {
    // Failure case
}

See also

wolfSSL_X509_get_issuer_name

wolfSSL_X509_get_isCA

wolfSSL_X509_get_issuer_name()

WOLFSSL_X509_NAME* wolfSSL_X509_get_issuer_name

(

WOLFSSL_X509 *

cert

)

This function returns the name of the certificate issuer.

Returns

point a pointer to the WOLFSSL_X509 struct’s issuer member is returned.

NULL if the cert passed in is NULL.

Parameters

cert	a pointer to a WOLFSSL_X509 structure.

Example

WOLFSSL_X509* x509;
WOLFSSL_X509_NAME issuer;
...
issuer = wolfSSL_X509_NAME_oneline(wolfSSL_X509_get_issuer_name(x509), 0, 0);
 
if(!issuer){
    // NULL was returned
} else {
    // issuer hods the name of the certificate issuer.
}

See also

wolfSSL_X509_get_subject_name

wolfSSL_X509_get_isCA

wolfSSL_get_peer_certificate

wolfSSL_X509_NAME_oneline

wolfSSL_X509_get_next_altname()

char* wolfSSL_X509_get_next_altname

(

WOLFSSL_X509 *

)

This function returns the next, if any, altname from the peer certificate.

Returns

NULL if there is not a next altname.

cert->altNamesNext->name from the WOLFSSL_X509 structure that is a string value from the altName list is returned if it exists.

Parameters

cert	a pointer to the wolfSSL_X509 structure.

Example

WOLFSSL_X509 x509 = (WOLFSSL_X509*)XMALLOC(sizeof(WOLFSSL_X509), NULL,
                                                    DYNAMIC_TYPE_X509);
…
int x509NextAltName = wolfSSL_X509_get_next_altname(x509);
if(x509NextAltName == NULL){
        //There isn’t another alt name
}

See also

wolfSSL_X509_get_issuer_name

wolfSSL_X509_get_subject_name

wolfSSL_X509_get_notAfter()

WOLFSSL_ASN1_TIME* wolfSSL_X509_get_notAfter

(

WOLFSSL_X509 *

)

This function checks to see if x509 is NULL and if it’s not, it returns the notAfter member of the x509 struct.

Returns

pointer to struct with ASN1_TIME to the notAfter member of the x509 struct.

NULL returned if the x509 object is NULL.

Parameters

x509	a pointer to the WOLFSSL_X509 struct.

Example

WOLFSSL_X509* x509 = (WOLFSSL_X509)XMALOC(sizeof(WOLFSSL_X509), NULL,
DYNAMIC_TYPE_X509) ;
...
const WOLFSSL_ASN1_TIME* notAfter = wolfSSL_X509_get_notAfter(x509);
if(notAfter == NULL){
    // Failure case, the x509 object is null.
}

See also

wolfSSL_X509_get_notBefore

wolfSSL_X509_get_notBefore()

WOLFSSL_ASN1_TIME* wolfSSL_X509_get_notBefore

(

WOLFSSL_X509 *

)

The function checks to see if x509 is NULL and if it’s not, it returns the notBefore member of the x509 struct.

Returns

pointer to struct with ASN1_TIME to the notBefore member of the x509 struct.

NULL the function returns NULL if the x509 structure is NULL.

Parameters

x509	a pointer to the WOLFSSL_X509 struct.

Example

WOLFSSL_X509* x509 = (WOLFSSL_X509)XMALLOC(sizeof(WOLFSSL_X509), NULL,
DYNAMIC_TYPE_X509) ;
…
const WOLFSSL_ASN1_TIME* notAfter = wolfSSL_X509_get_notBefore(x509);
if(notAfter == NULL){
        //The x509 object was NULL
}

See also

wolfSSL_X509_get_notAfter

wolfSSL_X509_get_signature()

int wolfSSL_X509_get_signature	(	WOLFSSL_X509 *	x509,
		unsigned char *	buf,
		int *	bufSz
	)

Gets the X509 signature and stores it in the buffer.

Returns

SSL_SUCCESS returned if the function successfully executes. The signature is loaded into the buffer.

SSL_FATAL_ERRROR returns if the x509 struct or the bufSz member is NULL. There is also a check for the length member of the sig structure (sig is a member of x509).

Parameters

x509	pointer to a WOLFSSL_X509 structure.
buf	a char pointer to the buffer.
bufSz	an integer pointer to the size of the buffer.

Example

WOLFSSL_X509* x509 = (WOLFSSL_X509)XMALOC(sizeof(WOLFSSL_X509), NULL,
DYNAMIC_TYPE_X509);
unsigned char* buf; // Initialize
int* bufSz = sizeof(buf)/sizeof(unsigned char);
...
if(wolfSSL_X509_get_signature(x509, buf, bufSz) != SSL_SUCCESS){
    // The function did not execute successfully.
} else{
    // The buffer was written to correctly.
}

See also

wolfSSL_X509_get_serial_number

wolfSSL_X509_get_signature_type

wolfSSL_X509_get_device_type

wolfSSL_X509_get_signature_type()

int wolfSSL_X509_get_signature_type

(

WOLFSSL_X509 *

cert

)

This function returns the value stored in the sigOID member of the WOLFSSL_X509 structure.

Returns

0 returned if the WOLFSSL_X509 structure is NULL.

int an integer value is returned which was retrieved from the x509 object.

Parameters

cert	a pointer to a WOLFSSL_X509 structure.

Example

WOLFSSL_X509 x509 = (WOLFSSL_X509*)XMALLOC(sizeof(WOLFSSL_X509), NULL,
                        DYNAMIC_TYPE_X509);
...
int x509SigType = wolfSSL_X509_get_signature_type(x509);
 
if(x509SigType != EXPECTED){
// Deal with an unexpected value
}

See also

wolfSSL_X509_get_signature

wolfSSL_X509_version

wolfSSL_X509_get_der

wolfSSL_X509_get_serial_number

wolfSSL_X509_notBefore

wolfSSL_X509_notAfter

wolfSSL_X509_free

wolfSSL_X509_get_subject_name()

WOLFSSL_X509_NAME* wolfSSL_X509_get_subject_name

(

WOLFSSL_X509 *

cert

)

This function returns the subject member of the WOLFSSL_X509 structure.

Returns

pointer a pointer to the WOLFSSL_X509_NAME structure. The pointer may be NULL if the WOLFSSL_X509 struct is NULL or if the subject member of the structure is NULL.

Parameters

cert	a pointer to a WOLFSSL_X509 structure.

Example

WOLFSSL_X509* cert;
WOLFSSL_X509_NAME name;
…
name = wolfSSL_X509_get_subject_name(cert);
if(name == NULL){
    // Deal with the NULL cacse
}

See also

wolfSSL_X509_get_issuer_name

wolfSSL_X509_get_isCA

wolfSSL_get_peer_certificate

wolfSSL_X509_get_subjectCN()

char* wolfSSL_X509_get_subjectCN

(

WOLFSSL_X509 *

)

Returns the common name of the subject from the certificate.

Returns

NULL returned if the x509 structure is null

string a string representation of the subject's common name is returned upon success

Parameters

x509	a pointer to a WOLFSSL_X509 structure containing certificate information.

Example

WOLFSSL_X509 x509 = (WOLFSSL_X509*)XMALLOC(sizeof(WOLFSSL_X509), NULL,
                        DYNAMIC_TYPE_X509);
...
int x509Cn = wolfSSL_X509_get_subjectCN(x509);
if(x509Cn == NULL){
    // Deal with NULL case
} else {
    // x509Cn contains the common name
}

See also

wolfSSL_X509_Name_get_entry

wolfSSL_X509_get_next_altname

wolfSSL_X509_get_issuer_name

wolfSSL_X509_get_subject_name

wolfSSL_X509_load_certificate_file()

WOLFSSL_X509* wolfSSL_X509_load_certificate_file	(	const char *	fname,
		int	format
	)

The function loads the x509 certificate into memory.

Returns

pointer a successful execution returns pointer to a WOLFSSL_X509 structure.

NULL returned if the certificate was not able to be written.

Parameters

fname	the certificate file to be loaded.
format	the format of the certificate.

Example

#define cliCert    “certs/client-cert.pem”
…
X509* x509;
…
x509 = wolfSSL_X509_load_certificate_file(cliCert, SSL_FILETYPE_PEM);
AssertNotNull(x509);

See also

InitDecodedCert

PemToDer

wolfSSL_get_certificate

AssertNotNull

wolfSSL_X509_NAME_get_text_by_NID()

int wolfSSL_X509_NAME_get_text_by_NID	(	WOLFSSL_X509_NAME *	name,
		int	nid,
		char *	buf,
		int	len
	)

This function gets the text related to the passed in NID value.

Returns

int returns the size of the text buffer.

Parameters

name	WOLFSSL_X509_NAME to search for text.
nid	NID to search for.
buf	buffer to hold text when found.
len	length of buffer.

Example

WOLFSSL_X509_NAME* name;
char buffer[100];
int bufferSz;
int ret;
// get WOLFSSL_X509_NAME
ret = wolfSSL_X509_NAME_get_text_by_NID(name, NID_commonName,
buffer, bufferSz);
 
//check ret value

See also

none

wolfSSL_X509_NAME_oneline()

char* wolfSSL_X509_NAME_oneline	(	WOLFSSL_X509_NAME *	name,
		char *	in,
		int	sz
	)

This function copies the name of the x509 into a buffer.

Returns

A char pointer to the buffer with the WOLFSSL_X509_NAME structures name member’s data is returned if the function executed normally.

Parameters

name	a pointer to a WOLFSSL_X509 structure.
in	a buffer to hold the name copied from the WOLFSSL_X509_NAME structure.
sz	the maximum size of the buffer.

Example

WOLFSSL_X509 x509;
char* name;
...
name = wolfSSL_X509_NAME_oneline(wolfSSL_X509_get_issuer_name(x509), 0, 0);
 
if(name <= 0){
    // There’s nothing in the buffer.
}

See also

wolfSSL_X509_get_subject_name

wolfSSL_X509_get_issuer_name

wolfSSL_X509_get_isCA

wolfSSL_get_peer_certificate

wolfSSL_X509_version

wolfSSL_X509_notAfter()

const byte* wolfSSL_X509_notAfter

(

WOLFSSL_X509 *

x509

)

This function the certificate "not after" validity encoded as a byte array.

Returns

NULL returned if the WOLFSSL_X509 structure is NULL.

byte is returned that contains the notAfterData.

Parameters

x509	pointer to a WOLFSSL_X509 structure.

Example

WOLFSSL_X509* x509 = (WOLFSSL_X509*)XMALLOC(sizeof(WOLFSSL_X509), NULL,
                        DYNAMIC_TYPE_X509);
...
byte* notAfterData = wolfSSL_X509_notAfter(x509);

See also

wolfSSL_X509_get_signature

wolfSSL_X509_version

wolfSSL_X509_get_der

wolfSSL_X509_get_serial_number

wolfSSL_X509_notBefore

wolfSSL_X509_free

wolfSSL_X509_notBefore()

const byte* wolfSSL_X509_notBefore

(

WOLFSSL_X509 *

x509

)

This function the certificate "not before" validity encoded as a byte array.

Returns

NULL returned if the WOLFSSL_X509 structure is NULL.

byte is returned that contains the notBeforeData.

Parameters

x509	pointer to a WOLFSSL_X509 structure.

Example

WOLFSSL_X509* x509 = (WOLFSSL_X509*)XMALLOC(sizeof(WOLFSSL_X509), NULL,
                        DYNAMIC_TYPE_X509);
...
byte* notBeforeData = wolfSSL_X509_notBefore(x509);

See also

wolfSSL_X509_get_signature

wolfSSL_X509_version

wolfSSL_X509_get_der

wolfSSL_X509_get_serial_number

wolfSSL_X509_notAfter

wolfSSL_X509_free

wolfSSL_X509_STORE_add_cert()

int wolfSSL_X509_STORE_add_cert	(	WOLFSSL_X509_STORE *	store,
		WOLFSSL_X509 *	x509
	)

This function adds a certificate to the WOLFSSL_X509_STRE structure.

Returns

SSL_SUCCESS If certificate is added successfully.

SSL_FATAL_ERROR: If certificate is not added successfully.

Parameters

str	certificate store to add the certificate to.
x509	certificate to add.

Example

WOLFSSL_X509_STORE* str;
WOLFSSL_X509* x509;
int ret;
ret = wolfSSL_X509_STORE_add_cert(str, x509);
//check ret value

See also

wolfSSL_X509_free

wolfSSL_X509_STORE_CTX_get_chain()

WOLFSSL_STACK* wolfSSL_X509_STORE_CTX_get_chain

(

WOLFSSL_X509_STORE_CTX *

ctx

)

This function is a getter function for chain variable in WOLFSSL_X509_STORE_CTX structure. Currently chain is not populated.

Returns

pointer if successful returns WOLFSSL_STACK (same as STACK_OF(WOLFSSL_X509)) pointer

Null upon failure

Parameters

ctx	certificate store ctx to get parse chain from.

Example

WOLFSSL_STACK* sk;
WOLFSSL_X509_STORE_CTX* ctx;
sk = wolfSSL_X509_STORE_CTX_get_chain(ctx);
//check sk for NULL and then use it. sk needs freed after done.

See also

wolfSSL_sk_X509_free

wolfSSL_X509_STORE_set_flags()

int wolfSSL_X509_STORE_set_flags	(	WOLFSSL_X509_STORE *	store,
		unsigned long	flag
	)

This function takes in a flag to change the behavior of the WOLFSSL_X509_STORE structure passed in. An example of a flag used is WOLFSSL_CRL_CHECK.

Returns

SSL_SUCCESS If no errors were encountered when setting the flag.

<0 a negative value will be returned upon failure.

Parameters

str	certificate store to set flag in.
flag	flag for behavior.

Example

WOLFSSL_X509_STORE* str;
int ret;
// create and set up str
ret = wolfSSL_X509_STORE_set_flags(str, WOLFSSL_CRL_CHECKALL);
If (ret != SSL_SUCCESS) {
    //check ret value and handle error case
}

See also

wolfSSL_X509_STORE_new

wolfSSL_X509_STORE_free

wolfSSL_X509_version()

int wolfSSL_X509_version

(

WOLFSSL_X509 *

)

This function retrieves the version of the X509 certificate.

Returns

0 returned if the x509 structure is NULL.

version the version stored in the x509 structure will be returned.

Parameters

ssl	a pointer to a WOLFSSL structure, created using wolfSSL_new().

Example

WOLFSSL_X509* x509;
int version;
...
version = wolfSSL_X509_version(x509);
if(!version){
    // The function returned 0, failure case.
}

See also

wolfSSL_X509_get_subject_name

wolfSSL_X509_get_issuer_name

wolfSSL_X509_get_isCA

wolfSSL_get_peer_certificate