#include "InternalCryptLib.h"
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#include <crypto/asn1.h>
#include <openssl/asn1.h>
#include <openssl/rsa.h>

Macros
#define	OID_EXT_KEY_USAGE { 0x55, 0x1D, 0x25 }

#define	OID_BASIC_CONSTRAINTS { 0x55, 0x1D, 0x13 }

#define	CRYPTO_ASN1_TAG_CLASS_MASK 0xC0

#define	CRYPTO_ASN1_TAG_PC_MASK 0x20

#define	CRYPTO_ASN1_TAG_VALUE_MASK 0x1F

Functions
BOOLEAN EFIAPI	X509ConstructCertificate (IN CONST UINT8 Cert, IN UINTN CertSize, OUT UINT8 *SingleX509Cert)

BOOLEAN EFIAPI	X509ConstructCertificateStackV (IN OUT UINT8 **X509Stack, IN VA_LIST Args)

BOOLEAN EFIAPI	X509ConstructCertificateStack (IN OUT UINT8 **X509Stack,...)

VOID EFIAPI	X509Free (IN VOID *X509Cert)

VOID EFIAPI	X509StackFree (IN VOID *X509Stack)

BOOLEAN EFIAPI	X509GetSubjectName (IN CONST UINT8 Cert, IN UINTN CertSize, OUT UINT8 CertSubject, IN OUT UINTN *SubjectSize)

STATIC RETURN_STATUS	InternalX509GetNIDName (IN CONST UINT8 Cert, IN UINTN CertSize, IN INT32 Request_NID, OUT CHAR8 CommonName OPTIONAL, IN OUT UINTN *CommonNameSize)

RETURN_STATUS EFIAPI	X509GetCommonName (IN CONST UINT8 Cert, IN UINTN CertSize, OUT CHAR8 CommonName OPTIONAL, IN OUT UINTN *CommonNameSize)

RETURN_STATUS EFIAPI	X509GetOrganizationName (IN CONST UINT8 Cert, IN UINTN CertSize, OUT CHAR8 NameBuffer OPTIONAL, IN OUT UINTN *NameBufferSize)

BOOLEAN EFIAPI	RsaGetPublicKeyFromX509 (IN CONST UINT8 Cert, IN UINTN CertSize, OUT VOID *RsaContext)

BOOLEAN EFIAPI	X509VerifyCert (IN CONST UINT8 Cert, IN UINTN CertSize, IN CONST UINT8 CACert, IN UINTN CACertSize)

BOOLEAN EFIAPI	X509GetTBSCert (IN CONST UINT8 Cert, IN UINTN CertSize, OUT UINT8 TBSCert, OUT UINTN TBSCertSize)

BOOLEAN EFIAPI	EcGetPublicKeyFromX509 (IN CONST UINT8 Cert, IN UINTN CertSize, OUT VOID *EcContext)

BOOLEAN EFIAPI	X509GetVersion (IN CONST UINT8 Cert, IN UINTN CertSize, OUT UINTN Version)

BOOLEAN EFIAPI	X509GetSerialNumber (IN CONST UINT8 Cert, IN UINTN CertSize, OUT UINT8 SerialNumber, OPTIONAL IN OUT UINTN *SerialNumberSize)

BOOLEAN EFIAPI	X509GetIssuerName (IN CONST UINT8 Cert, IN UINTN CertSize, OUT UINT8 CertIssuer, IN OUT UINTN *CertIssuerSize)

BOOLEAN EFIAPI	X509GetSignatureAlgorithm (IN CONST UINT8 Cert, IN UINTN CertSize, OUT UINT8 Oid, OPTIONAL IN OUT UINTN *OidSize)

BOOLEAN EFIAPI	X509GetExtensionData (IN CONST UINT8 Cert, IN UINTN CertSize, IN CONST UINT8 Oid, IN UINTN OidSize, OUT UINT8 ExtensionData, IN OUT UINTN ExtensionDataSize)

BOOLEAN EFIAPI	X509GetExtendedKeyUsage (IN CONST UINT8 Cert, IN UINTN CertSize, OUT UINT8 Usage, IN OUT UINTN *UsageSize)

BOOLEAN EFIAPI	X509GetValidity (IN CONST UINT8 Cert, IN UINTN CertSize, IN UINT8 From, IN OUT UINTN FromSize, IN UINT8 To, IN OUT UINTN *ToSize)

BOOLEAN EFIAPI	X509FormatDateTime (IN CONST CHAR8 DateTimeStr, OUT VOID DateTime, IN OUT UINTN *DateTimeSize)

INT32 EFIAPI	X509CompareDateTime (IN CONST VOID DateTime1, IN CONST VOID DateTime2)

BOOLEAN EFIAPI	X509GetKeyUsage (IN CONST UINT8 Cert, IN UINTN CertSize, OUT UINTN Usage)

BOOLEAN EFIAPI	X509VerifyCertChain (IN CONST UINT8 RootCert, IN UINTN RootCertLength, IN CONST UINT8 CertChain, IN UINTN CertChainLength)

BOOLEAN EFIAPI	X509GetCertFromCertChain (IN CONST UINT8 CertChain, IN UINTN CertChainLength, IN CONST INT32 CertIndex, OUT CONST UINT8 Cert, OUT UINTN CertLength)

BOOLEAN EFIAPI	Asn1GetTag (IN OUT UINT8 *Ptr, IN CONST UINT8 End, OUT UINTN *Length, IN UINT32 Tag)

BOOLEAN EFIAPI	X509GetExtendedBasicConstraints (CONST UINT8 Cert, UINTN CertSize, UINT8 BasicConstraints, UINTN *BasicConstraintsSize)

Detailed Description

X.509 Certificate Handler Wrapper Implementation over OpenSSL.

Copyright (c) 2010 - 2020, Intel Corporation. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent

Definition in file CryptX509.c.

Macro Definition Documentation

◆ CRYPTO_ASN1_TAG_CLASS_MASK

#define CRYPTO_ASN1_TAG_CLASS_MASK 0xC0

Definition at line 23 of file CryptX509.c.

◆ CRYPTO_ASN1_TAG_PC_MASK

#define CRYPTO_ASN1_TAG_PC_MASK 0x20

Definition at line 24 of file CryptX509.c.

◆ CRYPTO_ASN1_TAG_VALUE_MASK

#define CRYPTO_ASN1_TAG_VALUE_MASK 0x1F

Definition at line 25 of file CryptX509.c.

◆ OID_BASIC_CONSTRAINTS

#define OID_BASIC_CONSTRAINTS { 0x55, 0x1D, 0x13 }

Definition at line 18 of file CryptX509.c.

◆ OID_EXT_KEY_USAGE

#define OID_EXT_KEY_USAGE { 0x55, 0x1D, 0x25 }

Definition at line 17 of file CryptX509.c.

Function Documentation

◆ Asn1GetTag()

BOOLEAN EFIAPI Asn1GetTag	(	IN OUT UINT8 **	Ptr,
		IN CONST UINT8 *	End,
		OUT UINTN *	Length,
		IN UINT32	Tag
	)

Retrieve the tag and length of the tag.

Parameters

Ptr	The position in the ASN.1 data
End	End of data
Length	The variable that will receive the length
Tag	The expected tag

Return values

TRUE	Get tag successful
FALSe	Failed to get tag or tag not match

Definition at line 1884 of file CryptX509.c.

◆ EcGetPublicKeyFromX509()

BOOLEAN EFIAPI EcGetPublicKeyFromX509	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT VOID **	EcContext
	)

Retrieve the EC Public Key from one DER-encoded X509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	EcContext	Pointer to new-generated EC DSA context which contain the retrieved EC public key component. Use EcFree() function to free the resource.

If Cert is NULL, then return FALSE. If EcContext is NULL, then return FALSE.

Return values

TRUE	EC Public Key was retrieved successfully.
FALSE	Fail to retrieve EC public key from X509 certificate.

Definition at line 878 of file CryptX509.c.

◆ InternalX509GetNIDName()

STATIC RETURN_STATUS InternalX509GetNIDName	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		IN INT32	Request_NID,
		OUT CHAR8 *CommonName	OPTIONAL,
		IN OUT UINTN *	CommonNameSize
	)

Retrieve a string from one X.509 certificate base on the Request_NID.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[in]	Request_NID	NID of string to obtain
[out]	CommonName	Buffer to contain the retrieved certificate common name string (UTF8). At most CommonNameSize bytes will be written and the string will be null terminated. May be NULL in order to determine the size buffer needed.
[in,out]	CommonNameSize	The size in bytes of the CommonName buffer on input, and the size of buffer returned CommonName on output. If CommonName is NULL then the amount of space needed in buffer (including the final null) is returned.

Return values

RETURN_SUCCESS	The certificate CommonName retrieved successfully.
RETURN_INVALID_PARAMETER	If Cert is NULL. If CommonNameSize is NULL. If CommonName is not NULL and *CommonNameSize is 0. If Certificate is invalid.
RETURN_NOT_FOUND	If no NID Name entry exists.
RETURN_BUFFER_TOO_SMALL	If the CommonName is NULL. The required buffer size (including the final null) is returned in the CommonNameSize parameter.
RETURN_UNSUPPORTED	The operation is not supported.

Definition at line 369 of file CryptX509.c.

◆ RsaGetPublicKeyFromX509()

BOOLEAN EFIAPI RsaGetPublicKeyFromX509	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT VOID **	RsaContext
	)

Retrieve the RSA Public Key from one DER-encoded X509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	RsaContext	Pointer to new-generated RSA context which contain the retrieved RSA public key component. Use RsaFree() function to free the resource.

If Cert is NULL, then return FALSE. If RsaContext is NULL, then return FALSE.

Return values

TRUE	RSA Public Key was retrieved successfully.
FALSE	Fail to retrieve RSA public key from X509 certificate.

Definition at line 580 of file CryptX509.c.

◆ X509CompareDateTime()

INT32 EFIAPI X509CompareDateTime	(	IN CONST VOID *	DateTime1,
		IN CONST VOID *	DateTime2
	)

Compare DateTime1 object and DateTime2 object.

If DateTime1 is NULL, then return -2. If DateTime2 is NULL, then return -2. If DateTime1 == DateTime2, then return 0 If DateTime1 > DateTime2, then return 1 If DateTime1 < DateTime2, then return -1

Parameters

[in]	DateTime1	Pointer to a DateTime Ojbect
[in]	DateTime2	Pointer to a DateTime Object

Return values

0	If DateTime1 == DateTime2
1	If DateTime1 > DateTime2
-1	If DateTime1 < DateTime2

Definition at line 1618 of file CryptX509.c.

◆ X509ConstructCertificate()

BOOLEAN EFIAPI X509ConstructCertificate	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT UINT8 **	SingleX509Cert
	)

Construct a X509 object from DER-encoded certificate data.

If Cert is NULL, then return FALSE. If SingleX509Cert is NULL, then return FALSE.

Parameters

[in]	Cert	Pointer to the DER-encoded certificate data.
[in]	CertSize	The size of certificate data in bytes.
[out]	SingleX509Cert	The generated X509 object.

Return values

TRUE	The X509 object generation succeeded.
FALSE	The operation failed.

Definition at line 43 of file CryptX509.c.

◆ X509ConstructCertificateStack()

BOOLEAN EFIAPI X509ConstructCertificateStack	(	IN OUT UINT8 **	X509Stack,
			...
	)

Construct a X509 stack object from a list of DER-encoded certificate data.

If X509Stack is NULL, then return FALSE.

Parameters

[in,out]	X509Stack	On input, pointer to an existing or NULL X509 stack object. On output, pointer to the X509 stack object with new inserted X509 certificate.
	...	A list of DER-encoded single certificate data followed by certificate size. A NULL terminates the list. The pairs are the arguments to X509ConstructCertificate().

Return values

TRUE	The X509 stack construction succeeded.
FALSE	The construction operation failed.

Definition at line 190 of file CryptX509.c.

◆ X509ConstructCertificateStackV()

BOOLEAN EFIAPI X509ConstructCertificateStackV	(	IN OUT UINT8 **	X509Stack,
		IN VA_LIST	Args
	)

Construct a X509 stack object from a list of DER-encoded certificate data.

If X509Stack is NULL, then return FALSE. If this interface is not supported, then return FALSE.

Parameters

[in,out]	X509Stack	On input, pointer to an existing or NULL X509 stack object. On output, pointer to the X509 stack object with new inserted X509 certificate.
[in]	Args	VA_LIST marker for the variable argument list. A list of DER-encoded single certificate data followed by certificate size. A NULL terminates the list. The pairs are the arguments to X509ConstructCertificate().

Return values

TRUE	The X509 stack construction succeeded.
FALSE	The construction operation failed.
FALSE	This interface is not supported.

Definition at line 94 of file CryptX509.c.

◆ X509FormatDateTime()

BOOLEAN EFIAPI X509FormatDateTime	(	IN CONST CHAR8 *	DateTimeStr,
		OUT VOID *	DateTime,
		IN OUT UINTN *	DateTimeSize
	)

Format a DateTimeStr to DataTime object in DataTime Buffer

If DateTimeStr is NULL, then return FALSE. If DateTimeSize is NULL, then return FALSE. If this interface is not supported, then return FALSE.

Parameters

[in]	DateTimeStr	DateTime string like YYYYMMDDhhmmssZ Ref: https://www.w3.org/TR/NOTE-datetime Z stand for UTC time
[out]	DateTime	Pointer to a DateTime object.
[in,out]	DateTimeSize	DateTime object buffer size.

Return values

TRUE	The DateTime object create successfully.
FALSE	If DateTimeStr is NULL. If DateTimeSize is NULL. If DateTime is not NULL and *DateTimeSize is 0. If Year Month Day Hour Minute Second combination is invalid datetime.
FALSE	If the DateTime is NULL. The required buffer size (including the final null) is returned in the DateTimeSize parameter.
FALSE	The operation is not supported.

Definition at line 1550 of file CryptX509.c.

◆ X509Free()

VOID EFIAPI X509Free ( IN VOID * X509Cert )

Release the specified X509 object.

If X509Cert is NULL, then return FALSE.

Parameters

[in] X509Cert Pointer to the X509 object to be released.

Definition at line 214 of file CryptX509.c.

◆ X509GetCertFromCertChain()

BOOLEAN EFIAPI X509GetCertFromCertChain	(	IN CONST UINT8 *	CertChain,
		IN UINTN	CertChainLength,
		IN CONST INT32	CertIndex,
		OUT CONST UINT8 **	Cert,
		OUT UINTN *	CertLength
	)

Get one X509 certificate from CertChain.

Parameters

[in]	CertChain	One or more ASN.1 DER-encoded X.509 certificates where the first certificate is signed by the Root Certificate or is the Root Certificate itself. and subsequent certificate is signed by the preceding certificate.
[in]	CertChainLength	Total length of the certificate chain, in bytes.
[in]	CertIndex	Index of certificate.
[out]	Cert	The certificate at the index of CertChain.
[out]	CertLength	The length certificate at the index of CertChain.

Return values

TRUE	Success.
FALSE	Failed to get certificate from certificate chain.

Definition at line 1792 of file CryptX509.c.

◆ X509GetCommonName()

RETURN_STATUS EFIAPI X509GetCommonName	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT CHAR8 *CommonName	OPTIONAL,
		IN OUT UINTN *	CommonNameSize
	)

Retrieve the common name (CN) string from one X.509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	CommonName	Buffer to contain the retrieved certificate common name string. At most CommonNameSize bytes will be written and the string will be null terminated. May be NULL in order to determine the size buffer needed.
[in,out]	CommonNameSize	The size in bytes of the CommonName buffer on input, and the size of buffer returned CommonName on output. If CommonName is NULL then the amount of space needed in buffer (including the final null) is returned.

Return values

RETURN_SUCCESS	The certificate CommonName retrieved successfully.
RETURN_INVALID_PARAMETER	If Cert is NULL. If CommonNameSize is NULL. If CommonName is not NULL and *CommonNameSize is 0. If Certificate is invalid.
RETURN_NOT_FOUND	If no CommonName entry exists.
RETURN_BUFFER_TOO_SMALL	If the CommonName is NULL. The required buffer size (including the final null) is returned in the CommonNameSize parameter.
RETURN_UNSUPPORTED	The operation is not supported.

Definition at line 514 of file CryptX509.c.

◆ X509GetExtendedBasicConstraints()

BOOLEAN EFIAPI X509GetExtendedBasicConstraints	(	CONST UINT8 *	Cert,
		UINTN	CertSize,
		UINT8 *	BasicConstraints,
		UINTN *	BasicConstraintsSize
	)

Retrieve the basic constraints from one X.509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	size of the X509 certificate in bytes.
[out]	BasicConstraints	basic constraints bytes.
[in,out]	BasicConstraintsSize	basic constraints buffer size in bytes.

Return values

TRUE	The basic constraints retrieve successfully.
FALSE	If cert is NULL. If cert_size is NULL. If basic_constraints is not NULL and *basic_constraints_size is 0. If cert is invalid.
FALSE	The required buffer size is small. The return buffer size is basic_constraints_size parameter.
FALSE	If no Extension entry match oid.
FALSE	The operation is not supported.

Definition at line 1938 of file CryptX509.c.

◆ X509GetExtendedKeyUsage()

BOOLEAN EFIAPI X509GetExtendedKeyUsage	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT UINT8 *	Usage,
		IN OUT UINTN *	UsageSize
	)

Retrieve the Extended Key Usage from one X.509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	Usage	Key Usage bytes.
[in,out]	UsageSize	Key Usage buffer size in bytes.

Return values

TRUE	The Usage bytes retrieve successfully.
FALSE	If Cert is NULL. If CertSize is NULL. If Usage is not NULL and *UsageSize is 0. If Cert is invalid.
FALSE	If the Usage is NULL. The required buffer size is returned in the UsageSize parameter.
FALSE	The operation is not supported.

Definition at line 1406 of file CryptX509.c.

◆ X509GetExtensionData()

BOOLEAN EFIAPI X509GetExtensionData	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		IN CONST UINT8 *	Oid,
		IN UINTN	OidSize,
		OUT UINT8 *	ExtensionData,
		IN OUT UINTN *	ExtensionDataSize
	)

Retrieve Extension data from one X.509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[in]	Oid	Object identifier buffer
[in]	OidSize	Object identifier buffer size
[out]	ExtensionData	Extension bytes.
[in,out]	ExtensionDataSize	Extension bytes size.

Return values

TRUE	The certificate Extension data retrieved successfully.
FALSE	If Cert is NULL. If ExtensionDataSize is NULL. If ExtensionData is not NULL and *ExtensionDataSize is 0. If Certificate is invalid.
FALSE	If no Extension entry match Oid.
FALSE	If the ExtensionData is NULL. The required buffer size is returned in the ExtensionDataSize parameter.
FALSE	The operation is not supported.

Definition at line 1274 of file CryptX509.c.

◆ X509GetIssuerName()

BOOLEAN EFIAPI X509GetIssuerName	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT UINT8 *	CertIssuer,
		IN OUT UINTN *	CertIssuerSize
	)

Retrieve the issuer bytes from one X.509 certificate.

If Cert is NULL, then return FALSE. If CertIssuerSize is NULL, then return FALSE. If this interface is not supported, then return FALSE.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	CertIssuer	Pointer to the retrieved certificate subject bytes.
[in,out]	CertIssuerSize	The size in bytes of the CertIssuer buffer on input, and the size of buffer returned CertSubject on output.

Return values

TRUE	The certificate issuer retrieved successfully.
FALSE	Invalid certificate, or the CertIssuerSize is too small for the result. The CertIssuerSize will be updated with the required size.
FALSE	This interface is not supported.

Definition at line 1097 of file CryptX509.c.

◆ X509GetKeyUsage()

BOOLEAN EFIAPI X509GetKeyUsage	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT UINTN *	Usage
	)

Retrieve the Key Usage from one X.509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	Usage	Key Usage (CRYPTO_X509_KU_*)

Return values

TRUE	The certificate Key Usage retrieved successfully.
FALSE	Invalid certificate, or Usage is NULL
FALSE	This interface is not supported.

Definition at line 1639 of file CryptX509.c.

◆ X509GetOrganizationName()

RETURN_STATUS EFIAPI X509GetOrganizationName	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT CHAR8 *NameBuffer	OPTIONAL,
		IN OUT UINTN *	NameBufferSize
	)

Retrieve the organization name (O) string from one X.509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	NameBuffer	Buffer to contain the retrieved certificate organization name string. At most NameBufferSize bytes will be written and the string will be null terminated. May be NULL in order to determine the size buffer needed.
[in,out]	NameBufferSize	The size in bytes of the Name buffer on input, and the size of buffer returned Name on output. If NameBuffer is NULL then the amount of space needed in buffer (including the final null) is returned.

Return values

RETURN_SUCCESS	The certificate Organization Name retrieved successfully.
RETURN_INVALID_PARAMETER	If Cert is NULL. If NameBufferSize is NULL. If NameBuffer is not NULL and *CommonNameSize is 0. If Certificate is invalid.
RETURN_NOT_FOUND	If no Organization Name entry exists.
RETURN_BUFFER_TOO_SMALL	If the NameBuffer is NULL. The required buffer size (including the final null) is returned in the CommonNameSize parameter.
RETURN_UNSUPPORTED	The operation is not supported.

Definition at line 552 of file CryptX509.c.

◆ X509GetSerialNumber()

BOOLEAN EFIAPI X509GetSerialNumber	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT UINT8 *	SerialNumber,
		OPTIONAL IN OUT UINTN *	SerialNumberSize
	)

Retrieve the serialNumber from one X.509 certificate.

If Cert is NULL, then return FALSE. If CertSize is 0, then return FALSE. If this interface is not supported, then return FALSE.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	SerialNumber	Pointer to the retrieved certificate SerialNumber bytes.
[in,out]	SerialNumberSize	The size in bytes of the SerialNumber buffer on input, and the size of buffer returned SerialNumber on output.

Return values

TRUE	The certificate serialNumber retrieved successfully.
FALSE	If Cert is NULL or CertSize is Zero. If SerialNumberSize is NULL. If Certificate is invalid.
FALSE	If no SerialNumber exists.
FALSE	If the SerialNumber is NULL. The required buffer size (including the final null) is returned in the SerialNumberSize parameter.
FALSE	The operation is not supported.

Definition at line 1011 of file CryptX509.c.

◆ X509GetSignatureAlgorithm()

BOOLEAN EFIAPI X509GetSignatureAlgorithm	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT UINT8 *	Oid,
		OPTIONAL IN OUT UINTN *	OidSize
	)

Retrieve the Signature Algorithm from one X.509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	Oid	Signature Algorithm Object identifier buffer.
[in,out]	OidSize	Signature Algorithm Object identifier buffer size

Return values

TRUE	The certificate Extension data retrieved successfully.
FALSE	If Cert is NULL. If OidSize is NULL. If Oid is not NULL and *OidSize is 0. If Certificate is invalid.
FALSE	If no SignatureType.
FALSE	If the Oid is NULL. The required buffer size is returned in the OidSize.
FALSE	The operation is not supported.

Definition at line 1180 of file CryptX509.c.

◆ X509GetSubjectName()

BOOLEAN EFIAPI X509GetSubjectName	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT UINT8 *	CertSubject,
		IN OUT UINTN *	SubjectSize
	)

Retrieve the subject bytes from one X.509 certificate.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	CertSubject	Pointer to the retrieved certificate subject bytes.
[in,out]	SubjectSize	The size in bytes of the CertSubject buffer on input, and the size of buffer returned CertSubject on output.

If Cert is NULL, then return FALSE. If SubjectSize is NULL, then return FALSE.

Return values

TRUE	The certificate subject retrieved successfully.
FALSE	Invalid certificate, or the SubjectSize is too small for the result. The SubjectSize will be updated with the required size.

Definition at line 277 of file CryptX509.c.

◆ X509GetTBSCert()

BOOLEAN EFIAPI X509GetTBSCert	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT UINT8 **	TBSCert,
		OUT UINTN *	TBSCertSize
	)

Retrieve the TBSCertificate from one given X.509 certificate.

Parameters

[in]	Cert	Pointer to the given DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	TBSCert	DER-Encoded To-Be-Signed certificate.
[out]	TBSCertSize	Size of the TBS certificate in bytes.

If Cert is NULL, then return FALSE. If TBSCert is NULL, then return FALSE. If TBSCertSize is NULL, then return FALSE.

Return values

TRUE	The TBSCertificate was retrieved successfully.
FALSE	Invalid X.509 certificate.

Definition at line 798 of file CryptX509.c.

◆ X509GetValidity()

BOOLEAN EFIAPI X509GetValidity	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		IN UINT8 *	From,
		IN OUT UINTN *	FromSize,
		IN UINT8 *	To,
		IN OUT UINTN *	ToSize
	)

Retrieve the Validity from one X.509 certificate

If Cert is NULL, then return FALSE. If CertIssuerSize is NULL, then return FALSE. If this interface is not supported, then return FALSE.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	From	notBefore Pointer to DateTime object.
[in,out]	FromSize	notBefore DateTime object size.
[out]	To	notAfter Pointer to DateTime object.
[in,out]	ToSize	notAfter DateTime object size.

Note: X509CompareDateTime to compare DateTime oject x509SetDateTime to get a DateTime object from a DateTimeStr

Return values

TRUE	The certificate Validity retrieved successfully.
FALSE	Invalid certificate, or Validity retrieve failed.
FALSE	This interface is not supported.

Definition at line 1442 of file CryptX509.c.

◆ X509GetVersion()

BOOLEAN EFIAPI X509GetVersion	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		OUT UINTN *	Version
	)

Retrieve the version from one X.509 certificate.

If Cert is NULL, then return FALSE. If CertSize is 0, then return FALSE. If this interface is not supported, then return FALSE.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate.
[in]	CertSize	Size of the X509 certificate in bytes.
[out]	Version	Pointer to the retrieved version integer.

Return values

TRUE	The certificate version retrieved successfully.
FALSE	If Cert is NULL or CertSize is Zero.
FALSE	The operation is not supported.

Definition at line 957 of file CryptX509.c.

◆ X509StackFree()

VOID EFIAPI X509StackFree ( IN VOID * X509Stack )

Release the specified X509 stack object.

If X509Stack is NULL, then return FALSE.

Parameters

[in] X509Stack Pointer to the X509 stack object to be released.

Definition at line 241 of file CryptX509.c.

◆ X509VerifyCert()

BOOLEAN EFIAPI X509VerifyCert	(	IN CONST UINT8 *	Cert,
		IN UINTN	CertSize,
		IN CONST UINT8 *	CACert,
		IN UINTN	CACertSize
	)

Verify one X509 certificate was issued by the trusted CA.

Parameters

[in]	Cert	Pointer to the DER-encoded X509 certificate to be verified.
[in]	CertSize	Size of the X509 certificate in bytes.
[in]	CACert	Pointer to the DER-encoded trusted CA certificate.
[in]	CACertSize	Size of the CA Certificate in bytes.

If Cert is NULL, then return FALSE. If CACert is NULL, then return FALSE.

Return values

TRUE	The certificate was issued by the trusted CA.
FALSE	Invalid certificate or the certificate was not issued by the given trusted CA.

Definition at line 659 of file CryptX509.c.

◆ X509VerifyCertChain()

BOOLEAN EFIAPI X509VerifyCertChain	(	IN CONST UINT8 *	RootCert,
		IN UINTN	RootCertLength,
		IN CONST UINT8 *	CertChain,
		IN UINTN	CertChainLength
	)

Verify one X509 certificate was issued by the trusted CA.

Parameters

[in]	RootCert	Trusted Root Certificate buffer
[in]	RootCertLength	Trusted Root Certificate buffer length
[in]	CertChain	One or more ASN.1 DER-encoded X.509 certificates where the first certificate is signed by the Root Certificate or is the Root Certificate itself. and subsequent certificate is signed by the preceding certificate.
[in]	CertChainLength	Total length of the certificate chain, in bytes.

Return values

TRUE	All certificates was issued by the first certificate in X509Certchain.
FALSE	Invalid certificate or the certificate was not issued by the given trusted CA.

Definition at line 1705 of file CryptX509.c.

Macros

Functions

Detailed Description

Macro Definition Documentation

◆ CRYPTO_ASN1_TAG_CLASS_MASK

◆ CRYPTO_ASN1_TAG_PC_MASK

◆ CRYPTO_ASN1_TAG_VALUE_MASK

◆ OID_BASIC_CONSTRAINTS

◆ OID_EXT_KEY_USAGE

Function Documentation

◆ Asn1GetTag()

◆ EcGetPublicKeyFromX509()

◆ InternalX509GetNIDName()

◆ RsaGetPublicKeyFromX509()

◆ X509CompareDateTime()

◆ X509ConstructCertificate()

◆ X509ConstructCertificateStack()

◆ X509ConstructCertificateStackV()

◆ X509FormatDateTime()

◆ X509Free()

◆ X509GetCertFromCertChain()

◆ X509GetCommonName()

◆ X509GetExtendedBasicConstraints()

◆ X509GetExtendedKeyUsage()

◆ X509GetExtensionData()

◆ X509GetIssuerName()

◆ X509GetKeyUsage()

◆ X509GetOrganizationName()

◆ X509GetSerialNumber()

◆ X509GetSignatureAlgorithm()

◆ X509GetSubjectName()

◆ X509GetTBSCert()

◆ X509GetValidity()

◆ X509GetVersion()

◆ X509StackFree()

◆ X509VerifyCert()

◆ X509VerifyCertChain()