gnutls_pkcs12_init ()

int
gnutls_pkcs12_init (gnutls_pkcs12_t *pkcs12);

This function will initialize a PKCS12 type. PKCS12 structures usually contain lists of X.509 Certificates and X.509 Certificate revocation lists.

gnutls_pkcs12_deinit ()

void
gnutls_pkcs12_deinit (gnutls_pkcs12_t pkcs12);

This function will deinitialize a PKCS12 type.

gnutls_pkcs12_import ()

int
gnutls_pkcs12_import (gnutls_pkcs12_t pkcs12,
                      const gnutls_datum_t *data,
                      gnutls_x509_crt_fmt_t format,
                      unsigned int flags);

This function will convert the given DER or PEM encoded PKCS12 to the native gnutls_pkcs12_t format. The output will be stored in 'pkcs12'.

If the PKCS12 is PEM encoded it should have a header of "PKCS12".

gnutls_pkcs12_export ()

int
gnutls_pkcs12_export (gnutls_pkcs12_t pkcs12,
                      gnutls_x509_crt_fmt_t format,
                      void *output_data,
                      size_t *output_data_size);

This function will export the pkcs12 structure to DER or PEM format.

If the buffer provided is not long enough to hold the output, then *output_data_size will be updated and GNUTLS_E_SHORT_MEMORY_BUFFER will be returned.

If the structure is PEM encoded, it will have a header of "BEGIN PKCS12".

gnutls_pkcs12_export2 ()

int
gnutls_pkcs12_export2 (gnutls_pkcs12_t pkcs12,
                       gnutls_x509_crt_fmt_t format,
                       gnutls_datum_t *out);

This function will export the pkcs12 structure to DER or PEM format.

The output buffer is allocated using gnutls_malloc().

If the structure is PEM encoded, it will have a header of "BEGIN PKCS12".

Since: 3.1.3

gnutls_pkcs12_get_bag ()

int
gnutls_pkcs12_get_bag (gnutls_pkcs12_t pkcs12,
                       int indx,
                       gnutls_pkcs12_bag_t bag);

This function will return a Bag from the PKCS12 structure.

After the last Bag has been read GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.

gnutls_pkcs12_set_bag ()

int
gnutls_pkcs12_set_bag (gnutls_pkcs12_t pkcs12,
                       gnutls_pkcs12_bag_t bag);

This function will insert a Bag into the PKCS12 structure.

gnutls_pkcs12_generate_mac ()

int
gnutls_pkcs12_generate_mac (gnutls_pkcs12_t pkcs12,
                            const char *pass);

This function will generate a MAC for the PKCS12 structure.

gnutls_pkcs12_generate_mac2 ()

int
gnutls_pkcs12_generate_mac2 (gnutls_pkcs12_t pkcs12,
                             gnutls_mac_algorithm_t mac,
                             const char *pass);

This function will generate a MAC for the PKCS12 structure.

gnutls_pkcs12_verify_mac ()

int
gnutls_pkcs12_verify_mac (gnutls_pkcs12_t pkcs12,
                          const char *pass);

This function will verify the MAC for the PKCS12 structure.

gnutls_pkcs12_bag_decrypt ()

int
gnutls_pkcs12_bag_decrypt (gnutls_pkcs12_bag_t bag,
                           const char *pass);

This function will decrypt the given encrypted bag and return 0 on success.

gnutls_pkcs12_bag_encrypt ()

int
gnutls_pkcs12_bag_encrypt (gnutls_pkcs12_bag_t bag,
                           const char *pass,
                           unsigned int flags);

This function will encrypt the given bag.

gnutls_pkcs12_bag_enc_info ()

int
gnutls_pkcs12_bag_enc_info (gnutls_pkcs12_bag_t bag,
                            unsigned int *schema,
                            unsigned int *cipher,
                            void *salt,
                            unsigned int *salt_size,
                            unsigned int *iter_count,
                            char **oid);

This function will provide information on the encryption algorithms used in an encrypted bag. If the structure algorithms are unknown the code GNUTLS_E_UNKNOWN_CIPHER_TYPE will be returned, and only oid , will be set. That is, oid will be set on encrypted bags whether supported or not. It must be deinitialized using gnutls_free(). The other variables are only set on supported structures.

gnutls_pkcs12_mac_info ()

int
gnutls_pkcs12_mac_info (gnutls_pkcs12_t pkcs12,
                        unsigned int *mac,
                        void *salt,
                        unsigned int *salt_size,
                        unsigned int *iter_count,
                        char **oid);

This function will provide information on the MAC algorithm used in a PKCS 12 structure. If the structure algorithms are unknown the code GNUTLS_E_UNKNOWN_HASH_ALGORITHM will be returned, and only oid , will be set. That is, oid will be set on structures with a MAC whether supported or not. It must be deinitialized using gnutls_free(). The other variables are only set on supported structures.

gnutls_pkcs12_simple_parse ()

int
gnutls_pkcs12_simple_parse (gnutls_pkcs12_t p12,
                            const char *password,
                            gnutls_x509_privkey_t *key,
                            gnutls_x509_crt_t **chain,
                            unsigned int *chain_len,
                            gnutls_x509_crt_t **extra_certs,
                            unsigned int *extra_certs_len,
                            gnutls_x509_crl_t *crl,
                            unsigned int flags);

This function parses a PKCS12 structure in pkcs12 and extracts the private key, the corresponding certificate chain, any additional certificates and a CRL. The structures in key , chain crl , and extra_certs must not be initialized.

The extra_certs and extra_certs_len parameters are optional and both may be set to NULL. If either is non-NULL, then both must be set. The value for extra_certs is allocated using gnutls_malloc().

Encrypted PKCS12 bags and PKCS8 private keys are supported, but only with password based security and the same password for all operations.

Note that a PKCS12 structure may contain many keys and/or certificates, and there is no way to identify which key/certificate pair you want. For this reason this function is useful for PKCS12 files that contain only one key/certificate pair and/or one CRL.

If the provided structure has encrypted fields but no password is provided then this function returns GNUTLS_E_DECRYPTION_FAILED.

Note that normally the chain constructed does not include self signed certificates, to comply with TLS' requirements. If, however, the flag GNUTLS_PKCS12_SP_INCLUDE_SELF_SIGNED is specified then self signed certificates will be included in the chain.

Prior to using this function the PKCS 12 structure integrity must be verified using gnutls_pkcs12_verify_mac().

Since: 3.1.0

gnutls_pkcs12_bag_get_data ()

int
gnutls_pkcs12_bag_get_data (gnutls_pkcs12_bag_t bag,
                            unsigned  indx,
                            gnutls_datum_t *data);

This function will return the bag's data. The data is a constant that is stored into the bag. Should not be accessed after the bag is deleted.

gnutls_pkcs12_bag_set_data ()

int
gnutls_pkcs12_bag_set_data (gnutls_pkcs12_bag_t bag,
                            gnutls_pkcs12_bag_type_t type,
                            const gnutls_datum_t *data);

This function will insert the given data of the given type into the bag.

gnutls_pkcs12_bag_set_crl ()

int
gnutls_pkcs12_bag_set_crl (gnutls_pkcs12_bag_t bag,
                           gnutls_x509_crl_t crl);

This function will insert the given CRL into the bag. This is just a wrapper over gnutls_pkcs12_bag_set_data().

gnutls_pkcs12_bag_set_crt ()

int
gnutls_pkcs12_bag_set_crt (gnutls_pkcs12_bag_t bag,
                           gnutls_x509_crt_t crt);

This function will insert the given certificate into the bag. This is just a wrapper over gnutls_pkcs12_bag_set_data().

gnutls_pkcs12_bag_set_privkey ()

int
gnutls_pkcs12_bag_set_privkey (gnutls_pkcs12_bag_t bag,
                               gnutls_x509_privkey_t privkey,
                               const char *password,
                               unsigned  flags);

This function will insert the given private key into the bag. This is just a wrapper over gnutls_pkcs12_bag_set_data().

gnutls_pkcs12_bag_init ()

int
gnutls_pkcs12_bag_init (gnutls_pkcs12_bag_t *bag);

This function will initialize a PKCS12 bag structure. PKCS12 Bags usually contain private keys, lists of X.509 Certificates and X.509 Certificate revocation lists.

gnutls_pkcs12_bag_deinit ()

void
gnutls_pkcs12_bag_deinit (gnutls_pkcs12_bag_t bag);

This function will deinitialize a PKCS12 Bag structure.

gnutls_pkcs12_bag_get_count ()

int
gnutls_pkcs12_bag_get_count (gnutls_pkcs12_bag_t bag);

This function will return the number of the elements within the bag.

gnutls_pkcs12_bag_get_key_id ()

int
gnutls_pkcs12_bag_get_key_id (gnutls_pkcs12_bag_t bag,
                              unsigned  indx,
                              gnutls_datum_t *id);

This function will return the key ID, of the specified bag element. The key ID is usually used to distinguish the local private key and the certificate pair.

gnutls_pkcs12_bag_set_key_id ()

int
gnutls_pkcs12_bag_set_key_id (gnutls_pkcs12_bag_t bag,
                              unsigned  indx,
                              const gnutls_datum_t *id);

This function will add the given key ID, to the specified, by the index, bag element. The key ID will be encoded as a 'Local key identifier' bag attribute, which is usually used to distinguish the local private key and the certificate pair.

gnutls_pkcs12_bag_get_friendly_name ()

int
gnutls_pkcs12_bag_get_friendly_name (gnutls_pkcs12_bag_t bag,
                                     unsigned  indx,
                                     char **name);

This function will return the friendly name, of the specified bag element. The key ID is usually used to distinguish the local private key and the certificate pair.

gnutls_pkcs12_bag_set_friendly_name ()

int
gnutls_pkcs12_bag_set_friendly_name (gnutls_pkcs12_bag_t bag,
                                     unsigned  indx,
                                     const char *name);

This function will add the given key friendly name, to the specified, by the index, bag element. The name will be encoded as a 'Friendly name' bag attribute, which is usually used to set a user name to the local private key and the certificate pair.

gnutls_pkcs12_t

typedef struct gnutls_pkcs12_int *gnutls_pkcs12_t;

gnutls_pkcs12_bag_t

typedef struct gnutls_pkcs12_bag_int *gnutls_pkcs12_bag_t;

GNUTLS_PKCS12_SP_INCLUDE_SELF_SIGNED

#define GNUTLS_PKCS12_SP_INCLUDE_SELF_SIGNED 1

enum gnutls_pkcs12_bag_type_t

Enumeration of different PKCS 12 bag types.

gnutls_pkcs12_bag_int

typedef struct {
	struct bag_element element[MAX_BAG_ELEMENTS];
	unsigned bag_elements;
} gnutls_pkcs12_bag_int;

gnutls_pkcs12_int

typedef struct {
	asn1_node pkcs12;
	unsigned expanded;
} gnutls_pkcs12_int;