facil.io
API Reference

#./fio-stl/156 x509.h

57 public symbols.

#Macros

#FIO_X509_OID_SHA256_WITH_RSA

c
#define FIO_X509_OID_SHA256_WITH_RSA   \
  ((fio_u128){.u8 = {0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0B, [15] = 9}}) /* 1.2.840.113549.1.1.11 */

Symbol type: macro

#FIO_X509_OID_SHA384_WITH_RSA

c
#define FIO_X509_OID_SHA384_WITH_RSA   \
  ((fio_u128){.u8 = {0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0C, [15] = 9}}) /* 1.2.840.113549.1.1.12 */

Symbol type: macro

#FIO_X509_OID_SHA512_WITH_RSA

c
#define FIO_X509_OID_SHA512_WITH_RSA   \
  ((fio_u128){.u8 = {0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0D, [15] = 9}}) /* 1.2.840.113549.1.1.13 */

Symbol type: macro

#FIO_X509_OID_RSA_PSS

c
#define FIO_X509_OID_RSA_PSS   \
  ((fio_u128){.u8 = {0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0A, [15] = 9}}) /* 1.2.840.113549.1.1.10 */

Symbol type: macro

#FIO_X509_OID_ECDSA_WITH_SHA256

c
#define FIO_X509_OID_ECDSA_WITH_SHA256   \
  ((fio_u128){.u8 = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x02, [15] = 8}}) /* 1.2.840.10045.4.3.2 */

Symbol type: macro

#FIO_X509_OID_ECDSA_WITH_SHA384

c
#define FIO_X509_OID_ECDSA_WITH_SHA384   \
  ((fio_u128){.u8 = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x03, [15] = 8}}) /* 1.2.840.10045.4.3.3 */

Symbol type: macro

#FIO_X509_OID_ECDSA_WITH_SHA512

c
#define FIO_X509_OID_ECDSA_WITH_SHA512   \
  ((fio_u128){.u8 = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x04, [15] = 8}}) /* 1.2.840.10045.4.3.4 */

Symbol type: macro

#FIO_X509_OID_ED25519

c
#define FIO_X509_OID_ED25519   \
  ((fio_u128){.u8 = {0x2B, 0x65, 0x70, [15] = 3}}) /* 1.3.101.112 */

Symbol type: macro

#FIO_X509_OID_ED448

c
#define FIO_X509_OID_ED448   \
  ((fio_u128){.u8 = {0x2B, 0x65, 0x71, [15] = 3}}) /* 1.3.101.113 */

Symbol type: macro

#FIO_X509_OID_RSA_ENCRYPTION

c
#define FIO_X509_OID_RSA_ENCRYPTION   \
  ((fio_u128){.u8 = {0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01, [15] = 9}}) /* 1.2.840.113549.1.1.1 */

Symbol type: macro

#FIO_X509_OID_EC_PUBLIC_KEY

c
#define FIO_X509_OID_EC_PUBLIC_KEY   \
  ((fio_u128){.u8 = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01, [15] = 7}}) /* 1.2.840.10045.2.1 */

Symbol type: macro

#FIO_X509_OID_SECP256R1

c
#define FIO_X509_OID_SECP256R1   \
  ((fio_u128){.u8 = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07, [15] = 8}}) /* 1.2.840.10045.3.1.7 */

Symbol type: macro

#FIO_X509_OID_SECP384R1

c
#define FIO_X509_OID_SECP384R1   \
  ((fio_u128){.u8 = {0x2B, 0x81, 0x04, 0x00, 0x22, [15] = 5}}) /* 1.3.132.0.34 */

Symbol type: macro

#FIO_X509_OID_SECP521R1

c
#define FIO_X509_OID_SECP521R1   \
  ((fio_u128){.u8 = {0x2B, 0x81, 0x04, 0x00, 0x23, [15] = 5}}) /* 1.3.132.0.35 */

Symbol type: macro

#FIO_X509_OID_X25519

c
#define FIO_X509_OID_X25519   \
  ((fio_u128){.u8 = {0x2B, 0x65, 0x6E, [15] = 3}}) /* 1.3.101.110 */

Symbol type: macro

#FIO_X509_OID_X448

c
#define FIO_X509_OID_X448   \
  ((fio_u128){.u8 = {0x2B, 0x65, 0x6F, [15] = 3}}) /* 1.3.101.111 */

Symbol type: macro

#FIO_X509_OID_SUBJECT_KEY_ID

c
#define FIO_X509_OID_SUBJECT_KEY_ID   \
  ((fio_u128){.u8 = {0x55, 0x1D, 0x0E, [15] = 3}}) /* 2.5.29.14 */

Symbol type: macro

#FIO_X509_OID_KEY_USAGE

c
#define FIO_X509_OID_KEY_USAGE   \
  ((fio_u128){.u8 = {0x55, 0x1D, 0x0F, [15] = 3}}) /* 2.5.29.15 */

Symbol type: macro

#FIO_X509_OID_SUBJECT_ALT_NAME

c
#define FIO_X509_OID_SUBJECT_ALT_NAME   \
  ((fio_u128){.u8 = {0x55, 0x1D, 0x11, [15] = 3}}) /* 2.5.29.17 */

Symbol type: macro

#FIO_X509_OID_BASIC_CONSTRAINTS

c
#define FIO_X509_OID_BASIC_CONSTRAINTS   \
  ((fio_u128){.u8 = {0x55, 0x1D, 0x13, [15] = 3}}) /* 2.5.29.19 */

Symbol type: macro

#FIO_X509_OID_CRL_DIST_POINTS

c
#define FIO_X509_OID_CRL_DIST_POINTS   \
  ((fio_u128){.u8 = {0x55, 0x1D, 0x1F, [15] = 3}}) /* 2.5.29.31 */

Symbol type: macro

#FIO_X509_OID_CERT_POLICIES

c
#define FIO_X509_OID_CERT_POLICIES   \
  ((fio_u128){.u8 = {0x55, 0x1D, 0x20, [15] = 3}}) /* 2.5.29.32 */

Symbol type: macro

#FIO_X509_OID_AUTH_KEY_ID

c
#define FIO_X509_OID_AUTH_KEY_ID   \
  ((fio_u128){.u8 = {0x55, 0x1D, 0x23, [15] = 3}}) /* 2.5.29.35 */

Symbol type: macro

#FIO_X509_OID_EXT_KEY_USAGE

c
#define FIO_X509_OID_EXT_KEY_USAGE   \
  ((fio_u128){.u8 = {0x55, 0x1D, 0x25, [15] = 3}}) /* 2.5.29.37 */

Symbol type: macro

#FIO_X509_OID_EKU_SERVER_AUTH

c
#define FIO_X509_OID_EKU_SERVER_AUTH   \
  ((fio_u128){.u8 = {0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x01, [15] = 8}}) /* 1.3.6.1.5.5.7.3.1 */

Symbol type: macro

#FIO_X509_OID_EKU_CLIENT_AUTH

c
#define FIO_X509_OID_EKU_CLIENT_AUTH   \
  ((fio_u128){.u8 = {0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x02, [15] = 8}}) /* 1.3.6.1.5.5.7.3.2 */

Symbol type: macro

#FIO_X509_OID_COMMON_NAME

c
#define FIO_X509_OID_COMMON_NAME   \
  ((fio_u128){.u8 = {0x55, 0x04, 0x03, [15] = 3}}) /* 2.5.4.3 */

Symbol type: macro

#FIO_X509_OID_COUNTRY

c
#define FIO_X509_OID_COUNTRY   \
  ((fio_u128){.u8 = {0x55, 0x04, 0x06, [15] = 3}}) /* 2.5.4.6 */

Symbol type: macro

#FIO_X509_OID_LOCALITY

c
#define FIO_X509_OID_LOCALITY   \
  ((fio_u128){.u8 = {0x55, 0x04, 0x07, [15] = 3}}) /* 2.5.4.7 */

Symbol type: macro

#FIO_X509_OID_STATE

c
#define FIO_X509_OID_STATE   \
  ((fio_u128){.u8 = {0x55, 0x04, 0x08, [15] = 3}}) /* 2.5.4.8 */

Symbol type: macro

#FIO_X509_OID_ORGANIZATION

c
#define FIO_X509_OID_ORGANIZATION   \
  ((fio_u128){.u8 = {0x55, 0x04, 0x0A, [15] = 3}}) /* 2.5.4.10 */

Symbol type: macro

#FIO_X509_OID_ORG_UNIT

c
#define FIO_X509_OID_ORG_UNIT   \
  ((fio_u128){.u8 = {0x55, 0x04, 0x0B, [15] = 3}}) /* 2.5.4.11 */

Symbol type: macro

#FIO_TLS_CERT_PARSE_ERROR

c
#define FIO_TLS_CERT_PARSE_ERROR ((size_t)-1)

Error value for fio_tls_parse_certificate_message

Symbol type: macro

#FIO_X509_MAX_CHAIN_DEPTH

c
#define FIO_X509_MAX_CHAIN_DEPTH 10

Symbol type: macro

#Types

#fio_x509_key_algo_e

c
typedef enum {
FIO_X509_KEY_UNKNOWN = 0,
FIO_X509_KEY_RSA = 1, /**< RSA (any key size) */
FIO_X509_KEY_ECDSA_P256 = 2, /**< ECDSA with P-256/secp256r1 */
FIO_X509_KEY_ECDSA_P384 = 3, /**< ECDSA with P-384/secp384r1 */
FIO_X509_KEY_ED25519 = 4, /**< Ed25519 (EdDSA) */
} fio_x509_key_algo_e

Public key algorithm types

Symbol type: type

#fio_x509_signature_algo_e

c
typedef enum {
FIO_X509_SIGNATURE_UNKNOWN = 0,
FIO_X509_SIGNATURE_RSA_PKCS1_SHA256 = 1, /**< sha256WithRSAEncryption */
FIO_X509_SIGNATURE_RSA_PKCS1_SHA384 = 2, /**< sha384WithRSAEncryption */
FIO_X509_SIGNATURE_RSA_PKCS1_SHA512 = 3, /**< sha512WithRSAEncryption */
FIO_X509_SIGNATURE_RSA_PSS_SHA256 = 4, /**< RSA-PSS with SHA-256 */
FIO_X509_SIGNATURE_RSA_PSS_SHA384 = 5, /**< RSA-PSS with SHA-384 */
FIO_X509_SIGNATURE_RSA_PSS_SHA512 = 6, /**< RSA-PSS with SHA-512 */
FIO_X509_SIGNATURE_ECDSA_SHA256 = 7, /**< ecdsa-with-SHA256 */
FIO_X509_SIGNATURE_ECDSA_SHA384 = 8, /**< ecdsa-with-SHA384 */
FIO_X509_SIGNATURE_ED25519 = 9, /**< Ed25519 */
} fio_x509_signature_algo_e

Signature algorithm types

Symbol type: type

#fio_x509_key_usage_e

c
typedef enum {
FIO_X509_KU_DIGITAL_SIGNATURE = 0x0080, /* bit 0 = MSB of byte 0 */
FIO_X509_KU_NON_REPUDIATION = 0x0040, /* bit 1 */
FIO_X509_KU_KEY_ENCIPHERMENT = 0x0020, /* bit 2 */
FIO_X509_KU_DATA_ENCIPHERMENT = 0x0010, /* bit 3 */
FIO_X509_KU_KEY_AGREEMENT = 0x0008, /* bit 4 */
FIO_X509_KU_KEY_CERT_SIGN = 0x0004, /* bit 5 */
FIO_X509_KU_CRL_SIGN = 0x0002, /* bit 6 */
FIO_X509_KU_ENCIPHER_ONLY = 0x0001, /* bit 7 */
FIO_X509_KU_DECIPHER_ONLY = 0x8000, /* bit 8 = MSB of byte 1 */
} fio_x509_key_usage_e

Key Usage bit flags (RFC 5280 Section 4.2.1.3)

ASN.1 BIT STRING uses MSB-first bit ordering:

  • Bit 0 = MSB of first byte (0x80)
  • Bit 1 = 0x40, Bit 2 = 0x20, etc.
  • Bits 8+ are in the second byte

Symbol type: type

#fio_x509_error_e

c
typedef enum {
FIO_X509_OK = 0, /**< Validation successful */
FIO_X509_ERR_PARSE = -1, /**< Failed to parse certificate */
FIO_X509_ERR_EXPIRED = -2, /**< Certificate expired */
FIO_X509_ERR_NOT_YET_VALID = -3, /**< Certificate not yet valid */
FIO_X509_ERR_SIGNATURE = -4, /**< Signature verification failed */
FIO_X509_ERR_ISSUER_MISMATCH = -5, /**< Issuer DN doesn't match subject DN */
FIO_X509_ERR_NOT_CA = -6, /**< Issuer is not a CA certificate */
FIO_X509_ERR_NO_TRUST_ANCHOR = -7, /**< Certificate not in trust store */
FIO_X509_ERR_HOSTNAME_MISMATCH = -8, /**< Hostname doesn't match cert */
FIO_X509_ERR_EMPTY_CHAIN = -9, /**< Empty certificate chain */
FIO_X509_ERR_CHAIN_TOO_LONG = -10, /**< Chain exceeds maximum depth */
} fio_x509_error_e

X.509 chain validation error codes

Symbol type: type

#fio_x509_trust_store_s

c
typedef struct {
const uint8_t **roots; /**< Array of root CA certificate DER data */
const size_t *root_lens; /**< Array of root CA certificate lengths */
size_t root_count; /**< Number of root CAs */
} fio_x509_trust_store_s

Trust store for root CA certificates

Symbol type: type

#fio_tls_cert_entry_s

c
typedef struct {
const uint8_t *cert; /**< DER-encoded certificate data */
size_t cert_len; /**< Certificate length */
} fio_tls_cert_entry_s

TLS certificate entry (parsed from Certificate message)

Symbol type: type

#fio_x509_cert_s

c
struct fio_x509_cert_s {
/* Buffer views (16 bytes each, 8-byte aligned — no padding) */
/** Raw DER data (points to the original input, NOT a copy) */
fio_ubuf_info_s der;
/** Certificate serial number (raw INTEGER contents, pointer into DER) */
fio_ubuf_info_s serial;
/** Subject Distinguished Name (raw DER for comparison) */
fio_ubuf_info_s subject;
/** Issuer Distinguished Name (raw DER for comparison) */
fio_ubuf_info_s issuer;
/** Subject Common Name (if present, pointer into DER data) */
fio_buf_info_s cn;
/** Public Key Data (union based on key_algo) */
union {
struct {
fio_ubuf_info_s n; /**< RSA modulus (big-endian) */
fio_ubuf_info_s e; /**< RSA exponent (big-endian) */
} rsa;
struct {
fio_ubuf_info_s point; /**< Uncompressed EC point (04 || x || y) */
} ecdsa;
struct {
fio_ubuf_info_s key; /**< 32-byte Ed25519 public key */
} ed25519;
} pubkey;
/** Signature value (pointer into DER data) */
fio_ubuf_info_s signature;
/** TBS Certificate (for signature verification) */
fio_ubuf_info_s tbs;
/** Subject Alternative Name: first DNS name (if present) */
fio_buf_info_s san_dns;
/** Subject Alternative Name extension raw data (for iterating all SANs) */
fio_ubuf_info_s san_ext;
/** Subject Alternative Name: first IP address (if present) */
fio_ubuf_info_s san_ip;
/** Validity period (Unix timestamps) */
int64_t not_before;
int64_t not_after;
/** SHA-256 fingerprint of the DER data (see fio_x509_fingerprint) */
uint8_t fingerprint[32];
/* Small fields grouped at the end (no bitfields — byte access is faster) */
/** Public Key Type */
fio_x509_key_algo_e key_algo;
/** Signature Algorithm */
fio_x509_signature_algo_e signature_algo;
/** Key Usage extension bits */
uint16_t key_usage;
/** Peer chain verification state: non-zero if a TLS backend verified this
* certificate's chain (see fio_io_peer_info_next). Always zero after
* fio_x509_parse — parsing does not verify anything. */
uint8_t verified;
/** Position in the peer certificate chain (0 = leaf certificate).
* Iteration is capped at 128 certificates (max value 127) as a
* deep-nesting / DoS guard. Set by fio_io_peer_info_next.
* Always zero after fio_x509_parse. */
uint8_t chain_index;
/** Certificate version (0=v1, 1=v2, 2=v3) */
uint8_t version;
/** Basic Constraints: is CA */
uint8_t is_ca;
/** Key Usage extension present */
uint8_t has_key_usage;
}

Parsed X.509 certificate structure.

All buffer fields are non-owning views (fio_buf_info_s / fio_ubuf_info_s) into the original DER data, which must remain valid while the certificate is in use.

When a certificate is obtained through fio_io_peer_info_next (TLS peer certificate inspection), the views point into memory owned by the TLS backend and remain valid until the next fio_io_peer_info_next call (on ANY connection) or until the connection is closed, whichever comes first.

Symbol type: type

#fio_x509_keypair_type_e

c
typedef enum {
FIO_X509_KEYPAIR_ED25519 = 1, /**< Ed25519 (preferred) */
FIO_X509_KEYPAIR_P256 = 2, /**< ECDSA P-256 */
} fio_x509_keypair_type_e

Key pair types for certificate generation

Symbol type: type

#fio_x509_keypair_s

c
typedef struct {
fio_x509_keypair_type_e type; /**< Key type */
uint8_t secret_key[64]; /**< Secret key (32 bytes for Ed25519, P-256) */
uint8_t public_key[65]; /**< Public key (32 for Ed25519, 65 for P-256) */
size_t secret_key_len; /**< Actual secret key length */
size_t public_key_len; /**< Actual public key length */
} fio_x509_keypair_s

Key pair structure for certificate generation

Symbol type: type

#fio_x509_cert_options_s

c
typedef struct {
fio_buf_info_s cn; /**< Subject Common Name (required) */
fio_buf_info_s org; /**< Subject Organization (optional) */
fio_buf_info_s ou; /**< Subject Organizational Unit (optional) */
fio_buf_info_s country; /**< Subject Country (optional, 2 chars) */
int64_t not_before; /**< Validity start (Unix timestamp, 0 = now) */
int64_t not_after; /**< Validity end (Unix timestamp, 0 = +1 year) */
const fio_buf_info_s *san_dns; /**< Subject Alternative Names (DNS) */
size_t san_dns_count; /**< Number of SAN DNS entries */
int is_ca; /**< Set CA:TRUE in BasicConstraints */
uint16_t key_usage; /**< Key Usage bits (0 = default for type) */
} fio_x509_cert_options_s

Certificate generation options.

All string fields are fio_buf_info_s views (non-owning) — a zero .len marks the field as absent. There is NO implicit strlen fallback: callers wrapping C strings should use FIO_BUF_INFO2((char *)s, FIO_STRLEN(s)).

Symbol type: type

#Functions

#fio_x509_parse

c
int fio_x509_parse(fio_x509_cert_s *cert, const uint8_t *der_data, size_t der_len)

Parse a DER-encoded X.509 certificate.

The cert structure will contain pointers into the original DER data, so the DER data must remain valid while the cert is in use.

Parameters:

  • cert - Output certificate structure (will be zeroed first)
  • der_data - Pointer to DER-encoded certificate
  • der_len - Length of DER data in bytes

Returns:

  • 0 on success, -1 on error

Symbol type: function

#fio_x509_fingerprint

c
void fio_x509_fingerprint(fio_x509_cert_s *cert)

Computes the SHA-256 fingerprint of the certificate's DER data, storing the raw 32-byte hash in cert->fingerprint.

Call after fio_x509_parse. This is a lazy (on-demand) operation so that parsing alone never pays the hashing cost.

Parameters:

  • cert - Parsed certificate (must have been filled by fio_x509_parse)

Symbol type: function

#fio_x509_verify_signature

c
int fio_x509_verify_signature(const fio_x509_cert_s *cert, const fio_x509_cert_s *issuer)

Verify certificate signature using issuer's public key.

This verifies that the certificate was signed by the issuer.

Parameters:

  • cert - Certificate to verify
  • issuer - Certificate of the issuer (contains the public key)

Returns:

  • 0 if valid, -1 if invalid or error

Symbol type: function

#fio_x509_check_validity

c
inline int fio_x509_check_validity(const fio_x509_cert_s *cert, int64_t current_time)

Check if certificate is currently valid (not expired, not yet valid).

Parameters:

  • cert - Certificate to check
  • current_time - Current Unix timestamp (seconds since epoch)

Returns:

  • 0 if valid, -1 if expired or not yet valid

Symbol type: function

#fio_x509_match_hostname

c
int fio_x509_match_hostname(const fio_x509_cert_s *cert, const char *hostname, size_t hostname_len)

Check if hostname matches certificate (CN or SAN).

Supports wildcard matching (*.example.com). Per RFC 6125, wildcards only match one label.

Parameters:

  • cert - Certificate to check
  • hostname - Hostname to match
  • hostname_len - Length of hostname

Returns:

  • 0 if match, -1 if no match

Symbol type: function

#fio_x509_verify_chain

c
int fio_x509_verify_chain(const fio_ubuf_info_s *certs, size_t cert_count, const char *hostname, int64_t current_time, fio_x509_trust_store_s *trust_store)

Validate a certificate chain for TLS 1.3.

The chain should be ordered from end-entity to closest-to-root:

  • certs[0] = server's certificate (end-entity)
  • certs[1] = intermediate CA (signed certs[0])
  • certs[n-1] = closest to root (may be root or intermediate)

Validation performs:

  1. Parse all certificates
  2. Check validity period for all certificates
  3. Verify hostname matches end-entity certificate (if hostname provided)
  4. Verify each certificate's signature using the next certificate's key
  5. Verify issuer DNs match subject DNs in the chain
  6. Verify intermediate/root certificates have CA:TRUE
  7. Verify the chain terminates at a trusted root (if trust store provided)

Parameters:

  • certs - Array of DER-encoded certificate views
  • cert_count - Number of certificates in chain
  • hostname - Expected hostname for end-entity (NULL to skip check)
  • current_time - Current Unix timestamp for validity checking
  • trust_store - Root CA certificates (NULL to skip trust check)

Returns:

  • FIO_X509_OK (0) on success, or error code on failure

Symbol type: function

#fio_x509_is_trusted

c
int fio_x509_is_trusted(const fio_x509_cert_s *cert, fio_x509_trust_store_s *trust_store)

Check if a certificate is in the trust store.

Comparison is done by matching subject DN.

Parameters:

  • cert - Certificate to check
  • trust_store - Trust store to search

Returns:

  • 0 if trusted, -1 if not found

Symbol type: function

#fio_tls_parse_certificate_message

c
size_t fio_tls_parse_certificate_message(fio_tls_cert_entry_s *entries, size_t max_entries, const uint8_t *data, size_t data_len)

Parse TLS 1.3 Certificate message into individual certificates.

TLS 1.3 Certificate message format (RFC 8446): certificate_request_context<0..2^8-1> certificate_list<0..2^24-1>: CertificateEntry: cert_data<1..2^24-1> extensions<0..2^16-1>

Parameters:

  • entries - Output array for certificate entries
  • max_entries - Maximum entries to parse
  • data - Raw Certificate message data (after handshake header)
  • data_len - Length of Certificate message data

Returns:

  • Number of certificates parsed, or FIO_TLS_CERT_PARSE_ERROR on error

Symbol type: function

#fio_x509_error_str

c
inline const char *fio_x509_error_str(int error)

Get human-readable error string for X.509 validation error code.

Parameters:

  • error - Error code from fio_x509_verify_chain

Returns:

  • Static string describing the error

Symbol type: function

#fio_x509_keypair_ed25519

c
int fio_x509_keypair_ed25519(fio_x509_keypair_s *keypair)

Generate an Ed25519 key pair for certificate signing.

Parameters:

  • keypair - Output key pair structure

Returns:

  • 0 on success, -1 on error

Symbol type: function

#fio_x509_keypair_p256

c
int fio_x509_keypair_p256(fio_x509_keypair_s *keypair)

Generate a P-256 key pair for certificate signing.

Parameters:

  • keypair - Output key pair structure

Returns:

  • 0 on success, -1 on error

Symbol type: function

#fio_x509_self_signed_cert

c
size_t fio_x509_self_signed_cert(uint8_t *buf, size_t buf_len, const fio_x509_keypair_s *keypair, const fio_x509_cert_options_s *options)

Generate a self-signed X.509v3 certificate.

The certificate is DER-encoded and written to the output buffer. Call with buf=NULL to get the maximum possible certificate size. This returns a worst-case size that accounts for variable-length DER encoding (e.g., serial numbers with varying leading zeros), ensuring that a buffer of this size will always be sufficient for the actual generation call.

Parameters:

  • buf - Output buffer (can be NULL to calculate max size)
  • buf_len - Buffer size (ignored if buf is NULL)
  • keypair - Key pair to use for signing
  • options - Certificate options

Returns:

  • Number of bytes written (if buf!=NULL) or max needed (if buf==NULL),

or 0 on error

Symbol type: function

#fio_x509_keypair_clear

c
inline void fio_x509_keypair_clear(fio_x509_keypair_s *keypair)

Securely clear a key pair structure.

Parameters:

  • keypair - Key pair to clear

Symbol type: function