2 X.509 Certificate Handler Wrapper Implementation over OpenSSL.
4 Copyright (c) 2010 - 2020, Intel Corporation. All rights reserved.<BR>
5 SPDX-License-Identifier: BSD-2-Clause-Patent
9 #include "InternalCryptLib.h"
10 #include <openssl/x509.h>
11 #include <openssl/x509v3.h>
12 #include <crypto/asn1.h>
13 #include <openssl/asn1.h>
14 #include <openssl/rsa.h>
17 #define OID_EXT_KEY_USAGE { 0x55, 0x1D, 0x25 }
18 #define OID_BASIC_CONSTRAINTS { 0x55, 0x1D, 0x13 }
20 static CONST UINT8 mOidExtKeyUsage
[] = OID_EXT_KEY_USAGE
;
21 static CONST UINT8 mOidBasicConstraints
[] = OID_BASIC_CONSTRAINTS
;
23 #define CRYPTO_ASN1_TAG_CLASS_MASK 0xC0
24 #define CRYPTO_ASN1_TAG_PC_MASK 0x20
25 #define CRYPTO_ASN1_TAG_VALUE_MASK 0x1F
28 Construct a X509 object from DER-encoded certificate data.
30 If Cert is NULL, then return FALSE.
31 If SingleX509Cert is NULL, then return FALSE.
33 @param[in] Cert Pointer to the DER-encoded certificate data.
34 @param[in] CertSize The size of certificate data in bytes.
35 @param[out] SingleX509Cert The generated X509 object.
37 @retval TRUE The X509 object generation succeeded.
38 @retval FALSE The operation failed.
43 X509ConstructCertificate (
46 OUT UINT8
**SingleX509Cert
53 // Check input parameters.
55 if ((Cert
== NULL
) || (SingleX509Cert
== NULL
) || (CertSize
> INT_MAX
)) {
60 // Read DER-encoded X509 Certificate and Construct X509 object.
63 X509Cert
= d2i_X509 (NULL
, &Temp
, (long)CertSize
);
64 if (X509Cert
== NULL
) {
68 *SingleX509Cert
= (UINT8
*)X509Cert
;
74 Construct a X509 stack object from a list of DER-encoded certificate data.
76 If X509Stack is NULL, then return FALSE.
77 If this interface is not supported, then return FALSE.
79 @param[in, out] X509Stack On input, pointer to an existing or NULL X509 stack object.
80 On output, pointer to the X509 stack object with new
81 inserted X509 certificate.
82 @param[in] Args VA_LIST marker for the variable argument list.
83 A list of DER-encoded single certificate data followed
84 by certificate size. A NULL terminates the list. The
85 pairs are the arguments to X509ConstructCertificate().
87 @retval TRUE The X509 stack construction succeeded.
88 @retval FALSE The construction operation failed.
89 @retval FALSE This interface is not supported.
94 X509ConstructCertificateStackV (
95 IN OUT UINT8
**X509Stack
,
103 STACK_OF (X509
) *CertStack
;
108 // Check input parameters.
110 if (X509Stack
== NULL
) {
117 // Initialize X509 stack object.
119 CertStack
= (STACK_OF (X509
) *)(*X509Stack
);
120 if (CertStack
== NULL
) {
121 CertStack
= sk_X509_new_null ();
122 if (CertStack
== NULL
) {
127 for (Index
= 0; ; Index
++) {
129 // If Cert is NULL, then it is the end of the list.
131 Cert
= VA_ARG (Args
, UINT8
*);
136 CertSize
= VA_ARG (Args
, UINTN
);
142 // Construct X509 Object from the given DER-encoded certificate data.
145 Status
= X509ConstructCertificate (
151 if (X509Cert
!= NULL
) {
152 X509_free (X509Cert
);
159 // Insert the new X509 object into X509 stack object.
161 sk_X509_push (CertStack
, X509Cert
);
165 sk_X509_pop_free (CertStack
, X509_free
);
167 *X509Stack
= (UINT8
*)CertStack
;
174 Construct a X509 stack object from a list of DER-encoded certificate data.
176 If X509Stack is NULL, then return FALSE.
178 @param[in, out] X509Stack On input, pointer to an existing or NULL X509 stack object.
179 On output, pointer to the X509 stack object with new
180 inserted X509 certificate.
181 @param ... A list of DER-encoded single certificate data followed
182 by certificate size. A NULL terminates the list. The
183 pairs are the arguments to X509ConstructCertificate().
185 @retval TRUE The X509 stack construction succeeded.
186 @retval FALSE The construction operation failed.
191 X509ConstructCertificateStack (
192 IN OUT UINT8
**X509Stack
,
199 VA_START (Args
, X509Stack
);
200 Result
= X509ConstructCertificateStackV (X509Stack
, Args
);
206 Release the specified X509 object.
208 If X509Cert is NULL, then return FALSE.
210 @param[in] X509Cert Pointer to the X509 object to be released.
220 // Check input parameters.
222 if (X509Cert
== NULL
) {
227 // Free OpenSSL X509 object.
229 X509_free ((X509
*)X509Cert
);
233 Release the specified X509 stack object.
235 If X509Stack is NULL, then return FALSE.
237 @param[in] X509Stack Pointer to the X509 stack object to be released.
247 // Check input parameters.
249 if (X509Stack
== NULL
) {
254 // Free OpenSSL X509 stack object.
256 sk_X509_pop_free ((STACK_OF (X509
) *) X509Stack
, X509_free
);
260 Retrieve the subject bytes from one X.509 certificate.
262 @param[in] Cert Pointer to the DER-encoded X509 certificate.
263 @param[in] CertSize Size of the X509 certificate in bytes.
264 @param[out] CertSubject Pointer to the retrieved certificate subject bytes.
265 @param[in, out] SubjectSize The size in bytes of the CertSubject buffer on input,
266 and the size of buffer returned CertSubject on output.
268 If Cert is NULL, then return FALSE.
269 If SubjectSize is NULL, then return FALSE.
271 @retval TRUE The certificate subject retrieved successfully.
272 @retval FALSE Invalid certificate, or the SubjectSize is too small for the result.
273 The SubjectSize will be updated with the required size.
279 IN CONST UINT8
*Cert
,
281 OUT UINT8
*CertSubject
,
282 IN OUT UINTN
*SubjectSize
291 // Check input parameters.
293 if ((Cert
== NULL
) || (SubjectSize
== NULL
)) {
300 // Read DER-encoded X509 Certificate and Construct X509 object.
302 Status
= X509ConstructCertificate (Cert
, CertSize
, (UINT8
**)&X509Cert
);
303 if ((X509Cert
== NULL
) || (!Status
)) {
311 // Retrieve subject name from certificate object.
313 X509Name
= X509_get_subject_name (X509Cert
);
314 if (X509Name
== NULL
) {
318 X509NameSize
= i2d_X509_NAME (X509Name
, NULL
);
319 if (*SubjectSize
< X509NameSize
) {
320 *SubjectSize
= X509NameSize
;
324 *SubjectSize
= X509NameSize
;
325 if (CertSubject
!= NULL
) {
326 i2d_X509_NAME (X509Name
, &CertSubject
);
332 // Release Resources.
334 if (X509Cert
!= NULL
) {
335 X509_free (X509Cert
);
342 Retrieve a string from one X.509 certificate base on the Request_NID.
344 @param[in] Cert Pointer to the DER-encoded X509 certificate.
345 @param[in] CertSize Size of the X509 certificate in bytes.
346 @param[in] Request_NID NID of string to obtain
347 @param[out] CommonName Buffer to contain the retrieved certificate common
348 name string (UTF8). At most CommonNameSize bytes will be
349 written and the string will be null terminated. May be
350 NULL in order to determine the size buffer needed.
351 @param[in,out] CommonNameSize The size in bytes of the CommonName buffer on input,
352 and the size of buffer returned CommonName on output.
353 If CommonName is NULL then the amount of space needed
354 in buffer (including the final null) is returned.
356 @retval RETURN_SUCCESS The certificate CommonName retrieved successfully.
357 @retval RETURN_INVALID_PARAMETER If Cert is NULL.
358 If CommonNameSize is NULL.
359 If CommonName is not NULL and *CommonNameSize is 0.
360 If Certificate is invalid.
361 @retval RETURN_NOT_FOUND If no NID Name entry exists.
362 @retval RETURN_BUFFER_TOO_SMALL If the CommonName is NULL. The required buffer size
363 (including the final null) is returned in the
364 CommonNameSize parameter.
365 @retval RETURN_UNSUPPORTED The operation is not supported.
370 InternalX509GetNIDName (
371 IN CONST UINT8
*Cert
,
373 IN INT32 Request_NID
,
374 OUT CHAR8
*CommonName OPTIONAL
,
375 IN OUT UINTN
*CommonNameSize
378 RETURN_STATUS ReturnStatus
;
384 X509_NAME_ENTRY
*Entry
;
385 ASN1_STRING
*EntryData
;
388 ReturnStatus
= RETURN_INVALID_PARAMETER
;
392 // Check input parameters.
394 if ((Cert
== NULL
) || (CertSize
> INT_MAX
) || (CommonNameSize
== NULL
)) {
398 if ((CommonName
!= NULL
) && (*CommonNameSize
== 0)) {
404 // Read DER-encoded X509 Certificate and Construct X509 object.
406 Status
= X509ConstructCertificate (Cert
, CertSize
, (UINT8
**)&X509Cert
);
407 if ((X509Cert
== NULL
) || (!Status
)) {
409 // Invalid X.509 Certificate
417 // Retrieve subject name from certificate object.
419 X509Name
= X509_get_subject_name (X509Cert
);
420 if (X509Name
== NULL
) {
422 // Fail to retrieve subject name content
428 // Retrive the string from X.509 Subject base on the Request_NID
430 Index
= X509_NAME_get_index_by_NID (X509Name
, Request_NID
, -1);
433 // No Request_NID name entry exists in X509_NAME object
436 ReturnStatus
= RETURN_NOT_FOUND
;
440 Entry
= X509_NAME_get_entry (X509Name
, Index
);
443 // Fail to retrieve name entry data
446 ReturnStatus
= RETURN_NOT_FOUND
;
450 EntryData
= X509_NAME_ENTRY_get_data (Entry
);
452 Length
= ASN1_STRING_to_UTF8 (&UTF8Name
, EntryData
);
455 // Fail to convert the Name string
458 ReturnStatus
= RETURN_INVALID_PARAMETER
;
462 if (CommonName
== NULL
) {
463 *CommonNameSize
= Length
+ 1;
464 ReturnStatus
= RETURN_BUFFER_TOO_SMALL
;
466 *CommonNameSize
= MIN ((UINTN
)Length
, *CommonNameSize
- 1) + 1;
467 CopyMem (CommonName
, UTF8Name
, *CommonNameSize
- 1);
468 CommonName
[*CommonNameSize
- 1] = '\0';
469 ReturnStatus
= RETURN_SUCCESS
;
474 // Release Resources.
476 if (X509Cert
!= NULL
) {
477 X509_free (X509Cert
);
480 if (UTF8Name
!= NULL
) {
481 OPENSSL_free (UTF8Name
);
488 Retrieve the common name (CN) string from one X.509 certificate.
490 @param[in] Cert Pointer to the DER-encoded X509 certificate.
491 @param[in] CertSize Size of the X509 certificate in bytes.
492 @param[out] CommonName Buffer to contain the retrieved certificate common
493 name string. At most CommonNameSize bytes will be
494 written and the string will be null terminated. May be
495 NULL in order to determine the size buffer needed.
496 @param[in,out] CommonNameSize The size in bytes of the CommonName buffer on input,
497 and the size of buffer returned CommonName on output.
498 If CommonName is NULL then the amount of space needed
499 in buffer (including the final null) is returned.
501 @retval RETURN_SUCCESS The certificate CommonName retrieved successfully.
502 @retval RETURN_INVALID_PARAMETER If Cert is NULL.
503 If CommonNameSize is NULL.
504 If CommonName is not NULL and *CommonNameSize is 0.
505 If Certificate is invalid.
506 @retval RETURN_NOT_FOUND If no CommonName entry exists.
507 @retval RETURN_BUFFER_TOO_SMALL If the CommonName is NULL. The required buffer size
508 (including the final null) is returned in the
509 CommonNameSize parameter.
510 @retval RETURN_UNSUPPORTED The operation is not supported.
516 IN CONST UINT8
*Cert
,
518 OUT CHAR8
*CommonName OPTIONAL
,
519 IN OUT UINTN
*CommonNameSize
522 return InternalX509GetNIDName (Cert
, CertSize
, NID_commonName
, CommonName
, CommonNameSize
);
526 Retrieve the organization name (O) string from one X.509 certificate.
528 @param[in] Cert Pointer to the DER-encoded X509 certificate.
529 @param[in] CertSize Size of the X509 certificate in bytes.
530 @param[out] NameBuffer Buffer to contain the retrieved certificate organization
531 name string. At most NameBufferSize bytes will be
532 written and the string will be null terminated. May be
533 NULL in order to determine the size buffer needed.
534 @param[in,out] NameBufferSize The size in bytes of the Name buffer on input,
535 and the size of buffer returned Name on output.
536 If NameBuffer is NULL then the amount of space needed
537 in buffer (including the final null) is returned.
539 @retval RETURN_SUCCESS The certificate Organization Name retrieved successfully.
540 @retval RETURN_INVALID_PARAMETER If Cert is NULL.
541 If NameBufferSize is NULL.
542 If NameBuffer is not NULL and *CommonNameSize is 0.
543 If Certificate is invalid.
544 @retval RETURN_NOT_FOUND If no Organization Name entry exists.
545 @retval RETURN_BUFFER_TOO_SMALL If the NameBuffer is NULL. The required buffer size
546 (including the final null) is returned in the
547 CommonNameSize parameter.
548 @retval RETURN_UNSUPPORTED The operation is not supported.
553 X509GetOrganizationName (
554 IN CONST UINT8
*Cert
,
556 OUT CHAR8
*NameBuffer OPTIONAL
,
557 IN OUT UINTN
*NameBufferSize
560 return InternalX509GetNIDName (Cert
, CertSize
, NID_organizationName
, NameBuffer
, NameBufferSize
);
564 Retrieve the RSA Public Key from one DER-encoded X509 certificate.
566 @param[in] Cert Pointer to the DER-encoded X509 certificate.
567 @param[in] CertSize Size of the X509 certificate in bytes.
568 @param[out] RsaContext Pointer to new-generated RSA context which contain the retrieved
569 RSA public key component. Use RsaFree() function to free the
572 If Cert is NULL, then return FALSE.
573 If RsaContext is NULL, then return FALSE.
575 @retval TRUE RSA Public Key was retrieved successfully.
576 @retval FALSE Fail to retrieve RSA public key from X509 certificate.
581 RsaGetPublicKeyFromX509 (
582 IN CONST UINT8
*Cert
,
584 OUT VOID
**RsaContext
592 // Check input parameters.
594 if ((Cert
== NULL
) || (RsaContext
== NULL
)) {
602 // Read DER-encoded X509 Certificate and Construct X509 object.
604 Status
= X509ConstructCertificate (Cert
, CertSize
, (UINT8
**)&X509Cert
);
605 if ((X509Cert
== NULL
) || (!Status
)) {
613 // Retrieve and check EVP_PKEY data from X509 Certificate.
615 Pkey
= X509_get_pubkey (X509Cert
);
616 if ((Pkey
== NULL
) || (EVP_PKEY_id (Pkey
) != EVP_PKEY_RSA
)) {
621 // Duplicate RSA Context from the retrieved EVP_PKEY.
623 if ((*RsaContext
= RSAPublicKey_dup (EVP_PKEY_get0_RSA (Pkey
))) != NULL
) {
629 // Release Resources.
631 if (X509Cert
!= NULL
) {
632 X509_free (X509Cert
);
636 EVP_PKEY_free (Pkey
);
643 Verify one X509 certificate was issued by the trusted CA.
645 @param[in] Cert Pointer to the DER-encoded X509 certificate to be verified.
646 @param[in] CertSize Size of the X509 certificate in bytes.
647 @param[in] CACert Pointer to the DER-encoded trusted CA certificate.
648 @param[in] CACertSize Size of the CA Certificate in bytes.
650 If Cert is NULL, then return FALSE.
651 If CACert is NULL, then return FALSE.
653 @retval TRUE The certificate was issued by the trusted CA.
654 @retval FALSE Invalid certificate or the certificate was not issued by the given
661 IN CONST UINT8
*Cert
,
663 IN CONST UINT8
*CACert
,
670 X509_STORE
*CertStore
;
671 X509_STORE_CTX
*CertCtx
;
674 // Check input parameters.
676 if ((Cert
== NULL
) || (CACert
== NULL
)) {
687 // Register & Initialize necessary digest algorithms for certificate verification.
689 if (EVP_add_digest (EVP_md5 ()) == 0) {
693 if (EVP_add_digest (EVP_sha1 ()) == 0) {
697 if (EVP_add_digest (EVP_sha256 ()) == 0) {
702 // Read DER-encoded certificate to be verified and Construct X509 object.
704 Status
= X509ConstructCertificate (Cert
, CertSize
, (UINT8
**)&X509Cert
);
705 if ((X509Cert
== NULL
) || (!Status
)) {
711 // Read DER-encoded root certificate and Construct X509 object.
713 Status
= X509ConstructCertificate (CACert
, CACertSize
, (UINT8
**)&X509CACert
);
714 if ((X509CACert
== NULL
) || (!Status
)) {
722 // Set up X509 Store for trusted certificate.
724 CertStore
= X509_STORE_new ();
725 if (CertStore
== NULL
) {
729 if (!(X509_STORE_add_cert (CertStore
, X509CACert
))) {
734 // Allow partial certificate chains, terminated by a non-self-signed but
735 // still trusted intermediate certificate. Also disable time checks.
737 X509_STORE_set_flags (
739 X509_V_FLAG_PARTIAL_CHAIN
| X509_V_FLAG_NO_CHECK_TIME
743 // Set up X509_STORE_CTX for the subsequent verification operation.
745 CertCtx
= X509_STORE_CTX_new ();
746 if (CertCtx
== NULL
) {
750 if (!X509_STORE_CTX_init (CertCtx
, CertStore
, X509Cert
, NULL
)) {
755 // X509 Certificate Verification.
757 Status
= (BOOLEAN
)X509_verify_cert (CertCtx
);
758 X509_STORE_CTX_cleanup (CertCtx
);
762 // Release Resources.
764 if (X509Cert
!= NULL
) {
765 X509_free (X509Cert
);
768 if (X509CACert
!= NULL
) {
769 X509_free (X509CACert
);
772 if (CertStore
!= NULL
) {
773 X509_STORE_free (CertStore
);
776 X509_STORE_CTX_free (CertCtx
);
782 Retrieve the TBSCertificate from one given X.509 certificate.
784 @param[in] Cert Pointer to the given DER-encoded X509 certificate.
785 @param[in] CertSize Size of the X509 certificate in bytes.
786 @param[out] TBSCert DER-Encoded To-Be-Signed certificate.
787 @param[out] TBSCertSize Size of the TBS certificate in bytes.
789 If Cert is NULL, then return FALSE.
790 If TBSCert is NULL, then return FALSE.
791 If TBSCertSize is NULL, then return FALSE.
793 @retval TRUE The TBSCertificate was retrieved successfully.
794 @retval FALSE Invalid X.509 certificate.
800 IN CONST UINT8
*Cert
,
803 OUT UINTN
*TBSCertSize
812 // Check input parameters.
814 if ((Cert
== NULL
) || (TBSCert
== NULL
) ||
815 (TBSCertSize
== NULL
) || (CertSize
> INT_MAX
))
821 // An X.509 Certificate is: (defined in RFC3280)
822 // Certificate ::= SEQUENCE {
823 // tbsCertificate TBSCertificate,
824 // signatureAlgorithm AlgorithmIdentifier,
825 // signature BIT STRING }
829 // TBSCertificate ::= SEQUENCE {
830 // version [0] Version DEFAULT v1,
834 // So we can just ASN1-parse the x.509 DER-encoded data. If we strip
835 // the first SEQUENCE, the second SEQUENCE is the TBSCertificate.
839 ASN1_get_object (&Temp
, (long *)&Length
, (int *)&Asn1Tag
, (int *)&ObjClass
, (long)CertSize
);
841 if (Asn1Tag
!= V_ASN1_SEQUENCE
) {
845 *TBSCert
= (UINT8
*)Temp
;
847 ASN1_get_object (&Temp
, (long *)&Length
, (int *)&Asn1Tag
, (int *)&ObjClass
, (long)Length
);
849 // Verify the parsed TBSCertificate is one correct SEQUENCE data.
851 if (Asn1Tag
!= V_ASN1_SEQUENCE
) {
855 *TBSCertSize
= Length
+ (Temp
- *TBSCert
);
861 Retrieve the EC Public Key from one DER-encoded X509 certificate.
863 @param[in] Cert Pointer to the DER-encoded X509 certificate.
864 @param[in] CertSize Size of the X509 certificate in bytes.
865 @param[out] EcContext Pointer to new-generated EC DSA context which contain the retrieved
866 EC public key component. Use EcFree() function to free the
869 If Cert is NULL, then return FALSE.
870 If EcContext is NULL, then return FALSE.
872 @retval TRUE EC Public Key was retrieved successfully.
873 @retval FALSE Fail to retrieve EC public key from X509 certificate.
878 EcGetPublicKeyFromX509 (
879 IN CONST UINT8
*Cert
,
889 // Check input parameters.
891 if ((Cert
== NULL
) || (EcContext
== NULL
)) {
899 // Read DER-encoded X509 Certificate and Construct X509 object.
901 Status
= X509ConstructCertificate (Cert
, CertSize
, (UINT8
**)&X509Cert
);
902 if ((X509Cert
== NULL
) || (!Status
)) {
910 // Retrieve and check EVP_PKEY data from X509 Certificate.
912 Pkey
= X509_get_pubkey (X509Cert
);
913 if ((Pkey
== NULL
) || (EVP_PKEY_id (Pkey
) != EVP_PKEY_EC
)) {
918 // Duplicate EC Context from the retrieved EVP_PKEY.
920 if ((*EcContext
= EC_KEY_dup (EVP_PKEY_get0_EC_KEY (Pkey
))) != NULL
) {
926 // Release Resources.
928 if (X509Cert
!= NULL
) {
929 X509_free (X509Cert
);
933 EVP_PKEY_free (Pkey
);
940 Retrieve the version from one X.509 certificate.
942 If Cert is NULL, then return FALSE.
943 If CertSize is 0, then return FALSE.
944 If this interface is not supported, then return FALSE.
946 @param[in] Cert Pointer to the DER-encoded X509 certificate.
947 @param[in] CertSize Size of the X509 certificate in bytes.
948 @param[out] Version Pointer to the retrieved version integer.
950 @retval TRUE The certificate version retrieved successfully.
951 @retval FALSE If Cert is NULL or CertSize is Zero.
952 @retval FALSE The operation is not supported.
958 IN CONST UINT8
*Cert
,
967 Status
= X509ConstructCertificate (Cert
, CertSize
, (UINT8
**)&X509Cert
);
968 if ((X509Cert
== NULL
) || (!Status
)) {
970 // Invalid X.509 Certificate
976 *Version
= X509_get_version (X509Cert
);
979 if (X509Cert
!= NULL
) {
980 X509_free (X509Cert
);
987 Retrieve the serialNumber from one X.509 certificate.
989 If Cert is NULL, then return FALSE.
990 If CertSize is 0, then return FALSE.
991 If this interface is not supported, then return FALSE.
993 @param[in] Cert Pointer to the DER-encoded X509 certificate.
994 @param[in] CertSize Size of the X509 certificate in bytes.
995 @param[out] SerialNumber Pointer to the retrieved certificate SerialNumber bytes.
996 @param[in, out] SerialNumberSize The size in bytes of the SerialNumber buffer on input,
997 and the size of buffer returned SerialNumber on output.
999 @retval TRUE The certificate serialNumber retrieved successfully.
1000 @retval FALSE If Cert is NULL or CertSize is Zero.
1001 If SerialNumberSize is NULL.
1002 If Certificate is invalid.
1003 @retval FALSE If no SerialNumber exists.
1004 @retval FALSE If the SerialNumber is NULL. The required buffer size
1005 (including the final null) is returned in the
1006 SerialNumberSize parameter.
1007 @retval FALSE The operation is not supported.
1011 X509GetSerialNumber (
1012 IN CONST UINT8
*Cert
,
1014 OUT UINT8
*SerialNumber
, OPTIONAL
1015 IN OUT UINTN
*SerialNumberSize
1020 ASN1_INTEGER
*Asn1Integer
;
1024 // Check input parameters.
1026 if ((Cert
== NULL
) || (SerialNumberSize
== NULL
)) {
1033 // Read DER-encoded X509 Certificate and Construct X509 object.
1035 Status
= X509ConstructCertificate (Cert
, CertSize
, (UINT8
**)&X509Cert
);
1036 if ((X509Cert
== NULL
) || (!Status
)) {
1037 *SerialNumberSize
= 0;
1043 // Retrieve subject name from certificate object.
1045 Asn1Integer
= X509_get_serialNumber (X509Cert
);
1046 if (Asn1Integer
== NULL
) {
1047 *SerialNumberSize
= 0;
1052 if (*SerialNumberSize
< (UINTN
)Asn1Integer
->length
) {
1053 *SerialNumberSize
= (UINTN
)Asn1Integer
->length
;
1058 if (SerialNumber
!= NULL
) {
1059 CopyMem (SerialNumber
, Asn1Integer
->data
, *SerialNumberSize
);
1063 *SerialNumberSize
= (UINTN
)Asn1Integer
->length
;
1067 // Release Resources.
1069 if (X509Cert
!= NULL
) {
1070 X509_free (X509Cert
);
1077 Retrieve the issuer bytes from one X.509 certificate.
1079 If Cert is NULL, then return FALSE.
1080 If CertIssuerSize is NULL, then return FALSE.
1081 If this interface is not supported, then return FALSE.
1083 @param[in] Cert Pointer to the DER-encoded X509 certificate.
1084 @param[in] CertSize Size of the X509 certificate in bytes.
1085 @param[out] CertIssuer Pointer to the retrieved certificate subject bytes.
1086 @param[in, out] CertIssuerSize The size in bytes of the CertIssuer buffer on input,
1087 and the size of buffer returned CertSubject on output.
1089 @retval TRUE The certificate issuer retrieved successfully.
1090 @retval FALSE Invalid certificate, or the CertIssuerSize is too small for the result.
1091 The CertIssuerSize will be updated with the required size.
1092 @retval FALSE This interface is not supported.
1098 IN CONST UINT8
*Cert
,
1100 OUT UINT8
*CertIssuer
,
1101 IN OUT UINTN
*CertIssuerSize
1106 X509_NAME
*X509Name
;
1110 // Check input parameters.
1112 if ((Cert
== NULL
) || (CertIssuerSize
== NULL
)) {
1119 // Read DER-encoded X509 Certificate and Construct X509 object.
1121 Status
= X509ConstructCertificate (Cert
, CertSize
, (UINT8
**)&X509Cert
);
1122 if ((X509Cert
== NULL
) || (!Status
)) {
1130 // Retrieve subject name from certificate object.
1132 X509Name
= X509_get_subject_name (X509Cert
);
1133 if (X509Name
== NULL
) {
1137 X509NameSize
= i2d_X509_NAME (X509Name
, NULL
);
1138 if (*CertIssuerSize
< X509NameSize
) {
1139 *CertIssuerSize
= X509NameSize
;
1143 *CertIssuerSize
= X509NameSize
;
1144 if (CertIssuer
!= NULL
) {
1145 i2d_X509_NAME (X509Name
, &CertIssuer
);
1151 // Release Resources.
1153 if (X509Cert
!= NULL
) {
1154 X509_free (X509Cert
);
1161 Retrieve the Signature Algorithm from one X.509 certificate.
1163 @param[in] Cert Pointer to the DER-encoded X509 certificate.
1164 @param[in] CertSize Size of the X509 certificate in bytes.
1165 @param[out] Oid Signature Algorithm Object identifier buffer.
1166 @param[in,out] OidSize Signature Algorithm Object identifier buffer size
1168 @retval TRUE The certificate Extension data retrieved successfully.
1169 @retval FALSE If Cert is NULL.
1171 If Oid is not NULL and *OidSize is 0.
1172 If Certificate is invalid.
1173 @retval FALSE If no SignatureType.
1174 @retval FALSE If the Oid is NULL. The required buffer size
1175 is returned in the OidSize.
1176 @retval FALSE The operation is not supported.
1180 X509GetSignatureAlgorithm (
1181 IN CONST UINT8
*Cert
,
1183 OUT UINT8
*Oid
, OPTIONAL
1184 IN OUT UINTN
*OidSize
1190 ASN1_OBJECT
*Asn1Obj
;
1193 // Check input parameters.
1195 if ((Cert
== NULL
) || (OidSize
== NULL
) || (CertSize
== 0)) {
1203 // Read DER-encoded X509 Certificate and Construct X509 object.
1205 Status
= X509ConstructCertificate (Cert
, CertSize
, (UINT8
**)&X509Cert
);
1206 if ((X509Cert
== NULL
) || (!Status
)) {
1212 // Retrieve subject name from certificate object.
1214 Nid
= X509_get_signature_nid (X509Cert
);
1215 if (Nid
== NID_undef
) {
1221 Asn1Obj
= OBJ_nid2obj (Nid
);
1222 if (Asn1Obj
== NULL
) {
1228 if (*OidSize
< (UINTN
)Asn1Obj
->length
) {
1229 *OidSize
= Asn1Obj
->length
;
1235 CopyMem (Oid
, Asn1Obj
->data
, Asn1Obj
->length
);
1238 *OidSize
= Asn1Obj
->length
;
1243 // Release Resources.
1245 if (X509Cert
!= NULL
) {
1246 X509_free (X509Cert
);
1253 Retrieve Extension data from one X.509 certificate.
1255 @param[in] Cert Pointer to the DER-encoded X509 certificate.
1256 @param[in] CertSize Size of the X509 certificate in bytes.
1257 @param[in] Oid Object identifier buffer
1258 @param[in] OidSize Object identifier buffer size
1259 @param[out] ExtensionData Extension bytes.
1260 @param[in, out] ExtensionDataSize Extension bytes size.
1262 @retval TRUE The certificate Extension data retrieved successfully.
1263 @retval FALSE If Cert is NULL.
1264 If ExtensionDataSize is NULL.
1265 If ExtensionData is not NULL and *ExtensionDataSize is 0.
1266 If Certificate is invalid.
1267 @retval FALSE If no Extension entry match Oid.
1268 @retval FALSE If the ExtensionData is NULL. The required buffer size
1269 is returned in the ExtensionDataSize parameter.
1270 @retval FALSE The operation is not supported.
1274 X509GetExtensionData (
1275 IN CONST UINT8
*Cert
,
1277 IN CONST UINT8
*Oid
,
1279 OUT UINT8
*ExtensionData
,
1280 IN OUT UINTN
*ExtensionDataSize
1287 CONST
STACK_OF (X509_EXTENSION
) *Extensions
;
1288 ASN1_OBJECT
*Asn1Obj
;
1289 ASN1_OCTET_STRING
*Asn1Oct
;
1290 X509_EXTENSION
*Ext
;
1295 // Check input parameters.
1297 if ((Cert
== NULL
) || (CertSize
== 0) || (Oid
== NULL
) || (OidSize
== 0) || (ExtensionDataSize
== NULL
)) {
1305 // Read DER-encoded X509 Certificate and Construct X509 object.
1307 Status
= X509ConstructCertificate (Cert
, CertSize
, (UINT8
**)&X509Cert
);
1308 if ((X509Cert
== NULL
) || (!Status
)) {
1309 *ExtensionDataSize
= 0;
1314 // Retrieve Extensions from certificate object.
1316 Extensions
= X509_get0_extensions (X509Cert
);
1317 if (sk_X509_EXTENSION_num (Extensions
) <= 0) {
1318 *ExtensionDataSize
= 0;
1323 // Traverse Extensions
1328 for (i
= 0; i
< sk_X509_EXTENSION_num (Extensions
); i
++) {
1329 Ext
= sk_X509_EXTENSION_value (Extensions
, (int)i
);
1334 Asn1Obj
= X509_EXTENSION_get_object (Ext
);
1335 if (Asn1Obj
== NULL
) {
1339 Asn1Oct
= X509_EXTENSION_get_data (Ext
);
1340 if (Asn1Oct
== NULL
) {
1344 ObjLength
= OBJ_length (Asn1Obj
);
1345 OctLength
= ASN1_STRING_length (Asn1Oct
);
1346 if ((OidSize
== ObjLength
) && (CompareMem (OBJ_get0_data (Asn1Obj
), Oid
, OidSize
) == 0)) {
1355 // reset to 0 if not found
1361 if (*ExtensionDataSize
< OctLength
) {
1362 *ExtensionDataSize
= OctLength
;
1367 if (Asn1Oct
!= NULL
) {
1368 CopyMem (ExtensionData
, ASN1_STRING_get0_data (Asn1Oct
), OctLength
);
1371 *ExtensionDataSize
= OctLength
;
1373 *ExtensionDataSize
= 0;
1378 // Release Resources.
1380 if (X509Cert
!= NULL
) {
1381 X509_free (X509Cert
);
1388 Retrieve the Extended Key Usage from one X.509 certificate.
1390 @param[in] Cert Pointer to the DER-encoded X509 certificate.
1391 @param[in] CertSize Size of the X509 certificate in bytes.
1392 @param[out] Usage Key Usage bytes.
1393 @param[in, out] UsageSize Key Usage buffer sizs in bytes.
1395 @retval TRUE The Usage bytes retrieve successfully.
1396 @retval FALSE If Cert is NULL.
1397 If CertSize is NULL.
1398 If Usage is not NULL and *UsageSize is 0.
1400 @retval FALSE If the Usage is NULL. The required buffer size
1401 is returned in the UsageSize parameter.
1402 @retval FALSE The operation is not supported.
1406 X509GetExtendedKeyUsage (
1407 IN CONST UINT8
*Cert
,
1410 IN OUT UINTN
*UsageSize
1415 Status
= X509GetExtensionData (Cert
, CertSize
, mOidExtKeyUsage
, sizeof (mOidExtKeyUsage
), Usage
, UsageSize
);
1420 Retrieve the Validity from one X.509 certificate
1422 If Cert is NULL, then return FALSE.
1423 If CertIssuerSize is NULL, then return FALSE.
1424 If this interface is not supported, then return FALSE.
1426 @param[in] Cert Pointer to the DER-encoded X509 certificate.
1427 @param[in] CertSize Size of the X509 certificate in bytes.
1428 @param[out] From notBefore Pointer to DateTime object.
1429 @param[in,out] FromSize notBefore DateTime object size.
1430 @param[out] To notAfter Pointer to DateTime object.
1431 @param[in,out] ToSize notAfter DateTime object size.
1433 Note: X509CompareDateTime to compare DateTime oject
1434 x509SetDateTime to get a DateTime object from a DateTimeStr
1436 @retval TRUE The certificate Validity retrieved successfully.
1437 @retval FALSE Invalid certificate, or Validity retrieve failed.
1438 @retval FALSE This interface is not supported.
1443 IN CONST UINT8
*Cert
,
1446 IN OUT UINTN
*FromSize
,
1448 IN OUT UINTN
*ToSize
1459 // Check input parameters.
1461 if ((Cert
== NULL
) || (FromSize
== NULL
) || (ToSize
== NULL
) || (CertSize
== 0)) {
1469 // Read DER-encoded X509 Certificate and Construct X509 object.
1471 Status
= X509ConstructCertificate (Cert
, CertSize
, (UINT8
**)&X509Cert
);
1472 if ((X509Cert
== NULL
) || (!Status
)) {
1477 // Retrieve Validity from/to from certificate object.
1479 F
= X509_get0_notBefore (X509Cert
);
1480 T
= X509_get0_notAfter (X509Cert
);
1482 if ((F
== NULL
) || (T
== NULL
)) {
1486 FSize
= sizeof (ASN1_TIME
) + F
->length
;
1487 if (*FromSize
< FSize
) {
1494 CopyMem (From
, F
, sizeof (ASN1_TIME
));
1495 ((ASN1_TIME
*)From
)->data
= From
+ sizeof (ASN1_TIME
);
1496 CopyMem (From
+ sizeof (ASN1_TIME
), F
->data
, F
->length
);
1499 TSize
= sizeof (ASN1_TIME
) + T
->length
;
1500 if (*ToSize
< TSize
) {
1507 CopyMem (To
, T
, sizeof (ASN1_TIME
));
1508 ((ASN1_TIME
*)To
)->data
= To
+ sizeof (ASN1_TIME
);
1509 CopyMem (To
+ sizeof (ASN1_TIME
), T
->data
, T
->length
);
1516 // Release Resources.
1518 if (X509Cert
!= NULL
) {
1519 X509_free (X509Cert
);
1526 Format a DateTimeStr to DataTime object in DataTime Buffer
1528 If DateTimeStr is NULL, then return FALSE.
1529 If DateTimeSize is NULL, then return FALSE.
1530 If this interface is not supported, then return FALSE.
1532 @param[in] DateTimeStr DateTime string like YYYYMMDDhhmmssZ
1533 Ref: https://www.w3.org/TR/NOTE-datetime
1534 Z stand for UTC time
1535 @param[out] DateTime Pointer to a DateTime object.
1536 @param[in,out] DateTimeSize DateTime object buffer size.
1538 @retval TRUE The DateTime object create successfully.
1539 @retval FALSE If DateTimeStr is NULL.
1540 If DateTimeSize is NULL.
1541 If DateTime is not NULL and *DateTimeSize is 0.
1542 If Year Month Day Hour Minute Second combination is invalid datetime.
1543 @retval FALSE If the DateTime is NULL. The required buffer size
1544 (including the final null) is returned in the
1545 DateTimeSize parameter.
1546 @retval FALSE The operation is not supported.
1550 X509FormatDateTime (
1551 IN CONST CHAR8
*DateTimeStr
,
1553 IN OUT UINTN
*DateTimeSize
1564 Dt
= ASN1_TIME_new ();
1570 Ret
= ASN1_TIME_set_string_X509 (Dt
, DateTimeStr
);
1576 DSize
= sizeof (ASN1_TIME
) + Dt
->length
;
1577 if (*DateTimeSize
< DSize
) {
1578 *DateTimeSize
= DSize
;
1583 *DateTimeSize
= DSize
;
1584 if (DateTime
!= NULL
) {
1585 CopyMem (DateTime
, Dt
, sizeof (ASN1_TIME
));
1586 ((ASN1_TIME
*)DateTime
)->data
= (UINT8
*)DateTime
+ sizeof (ASN1_TIME
);
1587 CopyMem ((UINT8
*)DateTime
+ sizeof (ASN1_TIME
), Dt
->data
, Dt
->length
);
1594 ASN1_TIME_free (Dt
);
1601 Compare DateTime1 object and DateTime2 object.
1603 If DateTime1 is NULL, then return -2.
1604 If DateTime2 is NULL, then return -2.
1605 If DateTime1 == DateTime2, then return 0
1606 If DateTime1 > DateTime2, then return 1
1607 If DateTime1 < DateTime2, then return -1
1609 @param[in] DateTime1 Pointer to a DateTime Ojbect
1610 @param[in] DateTime2 Pointer to a DateTime Object
1612 @retval 0 If DateTime1 == DateTime2
1613 @retval 1 If DateTime1 > DateTime2
1614 @retval -1 If DateTime1 < DateTime2
1618 X509CompareDateTime (
1619 IN CONST VOID
*DateTime1
,
1620 IN CONST VOID
*DateTime2
1623 return (INT32
)ASN1_TIME_compare (DateTime1
, DateTime2
);
1627 Retrieve the Key Usage from one X.509 certificate.
1629 @param[in] Cert Pointer to the DER-encoded X509 certificate.
1630 @param[in] CertSize Size of the X509 certificate in bytes.
1631 @param[out] Usage Key Usage (CRYPTO_X509_KU_*)
1633 @retval TRUE The certificate Key Usage retrieved successfully.
1634 @retval FALSE Invalid certificate, or Usage is NULL
1635 @retval FALSE This interface is not supported.
1640 IN CONST UINT8
*Cert
,
1649 // Check input parameters.
1651 if ((Cert
== NULL
) || (Usage
== NULL
)) {
1659 // Read DER-encoded X509 Certificate and Construct X509 object.
1661 Status
= X509ConstructCertificate (Cert
, CertSize
, (UINT8
**)&X509Cert
);
1662 if ((X509Cert
== NULL
) || (!Status
)) {
1667 // Retrieve subject name from certificate object.
1669 *Usage
= X509_get_key_usage (X509Cert
);
1670 if (*Usage
== NID_undef
) {
1678 // Release Resources.
1680 if (X509Cert
!= NULL
) {
1681 X509_free (X509Cert
);
1688 Verify one X509 certificate was issued by the trusted CA.
1689 @param[in] RootCert Trusted Root Certificate buffer
1691 @param[in] RootCertLength Trusted Root Certificate buffer length
1692 @param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
1693 where the first certificate is signed by the Root
1694 Certificate or is the Root Cerificate itself. and
1695 subsequent cerificate is signed by the preceding
1697 @param[in] CertChainLength Total length of the certificate chain, in bytes.
1699 @retval TRUE All cerificates was issued by the first certificate in X509Certchain.
1700 @retval FALSE Invalid certificate or the certificate was not issued by the given
1705 X509VerifyCertChain (
1706 IN CONST UINT8
*RootCert
,
1707 IN UINTN RootCertLength
,
1708 IN CONST UINT8
*CertChain
,
1709 IN UINTN CertChainLength
1712 CONST UINT8
*TmpPtr
;
1716 CONST UINT8
*CurrentCert
;
1717 UINTN CurrentCertLen
;
1718 CONST UINT8
*PrecedingCert
;
1719 UINTN PrecedingCertLen
;
1723 PrecedingCert
= RootCert
;
1724 PrecedingCertLen
= RootCertLength
;
1726 CurrentCert
= CertChain
;
1732 TmpPtr
= CurrentCert
;
1733 Ret
= ASN1_get_object (
1734 (CONST UINT8
**)&TmpPtr
,
1738 (long)(CertChainLength
+ CertChain
- TmpPtr
)
1740 if ((Asn1Tag
!= V_ASN1_SEQUENCE
) || (Ret
== 0x80)) {
1745 // Calculate CurrentCert length;
1747 CurrentCertLen
= TmpPtr
- CurrentCert
+ Length
;
1750 // Verify CurrentCert with preceding cert;
1752 VerifyFlag
= X509VerifyCert (CurrentCert
, CurrentCertLen
, PrecedingCert
, PrecedingCertLen
);
1753 if (VerifyFlag
== FALSE
) {
1758 // move Current cert to Preceding cert
1760 PrecedingCertLen
= CurrentCertLen
;
1761 PrecedingCert
= CurrentCert
;
1766 CurrentCert
= CurrentCert
+ CurrentCertLen
;
1773 Get one X509 certificate from CertChain.
1775 @param[in] CertChain One or more ASN.1 DER-encoded X.509 certificates
1776 where the first certificate is signed by the Root
1777 Certificate or is the Root Cerificate itself. and
1778 subsequent cerificate is signed by the preceding
1780 @param[in] CertChainLength Total length of the certificate chain, in bytes.
1782 @param[in] CertIndex Index of certificate.
1784 @param[out] Cert The certificate at the index of CertChain.
1785 @param[out] CertLength The length certificate at the index of CertChain.
1787 @retval TRUE Success.
1788 @retval FALSE Failed to get certificate from certificate chain.
1792 X509GetCertFromCertChain (
1793 IN CONST UINT8
*CertChain
,
1794 IN UINTN CertChainLength
,
1795 IN CONST INT32 CertIndex
,
1796 OUT CONST UINT8
**Cert
,
1797 OUT UINTN
*CertLength
1802 UINTN CurrentCertLen
;
1803 CONST UINT8
*CurrentCert
;
1804 CONST UINT8
*TmpPtr
;
1810 // Check input parameters.
1812 if ((CertChain
== NULL
) || (Cert
== NULL
) ||
1813 (CertIndex
< -1) || (CertLength
== NULL
))
1820 CurrentCert
= CertChain
;
1824 // Traverse the certificate chain
1827 TmpPtr
= CurrentCert
;
1829 // Get asn1 object and taglen
1830 Ret
= ASN1_get_object (
1831 (CONST UINT8
**)&TmpPtr
,
1835 (long)(CertChainLength
+ CertChain
- TmpPtr
)
1837 if ((Asn1Tag
!= V_ASN1_SEQUENCE
) || (Ret
== 0x80)) {
1842 // Calculate CurrentCert length;
1844 CurrentCertLen
= TmpPtr
- CurrentCert
+ Asn1Len
;
1847 if (CurrentIndex
== CertIndex
) {
1848 *Cert
= CurrentCert
;
1849 *CertLength
= CurrentCertLen
;
1856 CurrentCert
= CurrentCert
+ CurrentCertLen
;
1860 // If CertIndex is -1, Return the last certificate
1862 if ((CertIndex
== -1) && (CurrentIndex
>= 0)) {
1863 *Cert
= CurrentCert
- CurrentCertLen
;
1864 *CertLength
= CurrentCertLen
;
1872 Retrieve the tag and length of the tag.
1874 @param Ptr The position in the ASN.1 data
1875 @param End End of data
1876 @param Length The variable that will receive the length
1877 @param Tag The expected tag
1879 @retval TRUE Get tag successful
1880 @retval FALSe Failed to get tag or tag not match
1886 IN CONST UINT8
*End
,
1897 // Save Ptr position
1901 ASN1_get_object ((CONST UINT8
**)Ptr
, &ObjLength
, &ObjTag
, &ObjCls
, (INT32
)(End
- (*Ptr
)));
1902 if ((ObjTag
== (INT32
)(Tag
& CRYPTO_ASN1_TAG_VALUE_MASK
)) &&
1903 (ObjCls
== (INT32
)(Tag
& CRYPTO_ASN1_TAG_CLASS_MASK
)))
1905 *Length
= (UINTN
)ObjLength
;
1909 // if doesn't match Tag, restore Ptr to origin Ptr
1917 Retrieve the basic constraints from one X.509 certificate.
1919 @param[in] Cert Pointer to the DER-encoded X509 certificate.
1920 @param[in] CertSize size of the X509 certificate in bytes.
1921 @param[out] BasicConstraints basic constraints bytes.
1922 @param[in, out] BasicConstraintsSize basic constraints buffer sizs in bytes.
1924 @retval TRUE The basic constraints retrieve successfully.
1925 @retval FALSE If cert is NULL.
1926 If cert_size is NULL.
1927 If basic_constraints is not NULL and *basic_constraints_size is 0.
1929 @retval FALSE The required buffer size is small.
1930 The return buffer size is basic_constraints_size parameter.
1931 @retval FALSE If no Extension entry match oid.
1932 @retval FALSE The operation is not supported.
1936 X509GetExtendedBasicConstraints (
1939 UINT8
*BasicConstraints
,
1940 UINTN
*BasicConstraintsSize
1945 if ((Cert
== NULL
) || (CertSize
== 0) || (BasicConstraintsSize
== NULL
)) {
1949 Status
= X509GetExtensionData (
1952 mOidBasicConstraints
,
1953 sizeof (mOidBasicConstraints
),
1955 BasicConstraintsSize