package x509

You can search for identifiers within the package.

in-package search v0.2.0

x509
- X509
  - Authenticator
  - CRL
  - Certificate
  - Distinguished_name
  - Extension
  - General_name
  - Host
    
    Set
  - Private_key
  - Public_key
  - Signing_request
    
    Ext
  - Validation

Legend:
Library
Module
Module type
Parameter
Class
Class type

X509 encoding, generation, and validation.

X509 is a module for handling X.509 certificates and supplementary material (such as public and private RSA keys), as described in RFC 5280. X.509 describes a hierarchical public key infrastructure, where all trust is delegated to certificate authorities (CA). The task of a CA is to sign certificate signing requests (CSR), which turns them into certificates, after verification that the requestor is eligible.

An X.509 certificate is an authentication token: a public key, a subject (e.g. server name), a validity period, optionally a purpose (usage), and various other optional Extensions.

The public keys of trusted CAs are distributed with the software, or configured manually. When an endpoint connects, it presents its certificate chain, which are pairwise signed certificates. This chain is verified: the signatures have to be valid, the last certificate must be signed by a trusted CA, the name has to match the expected name, all certificates must be valid at the current time, and the purpose of each certificate must match its usage. An alternative validator checks that the hash of the server certificate matches the given hash.

This module uses the result type for errors. No provided binging raises an exception. Provided submodules include decoders and encoders (ASN.1 DER and PEM encoding) of X.509v3 certificates, distinguished names, public keys and private keys (PKCS 8, RFC 5208), and certificate signing requests (PKCS 10, RFC 2986, both use parts of PKCS 9, RFC 2985), certificate validation by construction of authenticators. Name validation, as defined in RFC 6125, is also implemented.

Missing is the handling of online certificate status protocol. Some X.509v3 extensions are not handled, but only parsed, such as name constraints. If any extension is marked as critical in a certificate, but not handled, the validation will fail. The only supported key type is RSA.

v0.11.1 - homepage

module Host : sig ... end

module Public_key : sig ... end

RSA public key DER and PEM encoding and decoding

module Private_key : sig ... end

RSA private key pem encoding and decoding

module Distinguished_name : sig ... end

X.500 distinguished name

module General_name : sig ... end

A list of general_names is the value of both subjectAltName and IssuerAltName extension.

module Extension : sig ... end

X.509v3 extensions

module Certificate : sig ... end

X509v3 certificate

module Validation : sig ... end

Chain Validation.

Certificate Signing request

module Signing_request : sig ... end

A certificate authority (CA) deals with PKCS 10 certificate signing requests, their construction and encoding, and provisioning using a private key to generate a certificate with a signature thereof.

module CRL : sig ... end

X.509 Certificate Revocation Lists.

module Authenticator : sig ... end

Certificate chain authenticators