diff options
| author | cinap_lenrek <cinap_lenrek@felloff.net> | 2017-12-30 03:07:47 +0100 |
|---|---|---|
| committer | cinap_lenrek <cinap_lenrek@felloff.net> | 2017-12-30 03:07:47 +0100 |
| commit | 57f8b6ec7591007ff22627038b51c4f4aa2a9be8 (patch) | |
| tree | 3d4cbe53bdb48b2c2b4145bafb5b4f2853f638fa /sys/include | |
| parent | b42d441a230bad9fd1ae8e3543b1c0f28c7c62aa (diff) | |
libsec: implement SPKI fingerprinting for okCertificate()
Instead of only using a hash over the whole certificate for
white/black-listing, now we can also use a hash over the
Subject Public Key Info (SPKI) field of the certificate which
contians the public key algorithm and the public key itself.
This allows certificates to be renewed independendtly of the
public key.
X509dump() now prints the public key thumbprint in addition
to the certificate thumbprint.
tlsclient will print the certificate when run with -D flag.
okCertificate() will print the public key thumbprint in its
error string when no match has been found.
Diffstat (limited to 'sys/include')
| -rw-r--r-- | sys/include/ape/libsec.h | 4 | ||||
| -rw-r--r-- | sys/include/libsec.h | 1 |
2 files changed, 4 insertions, 1 deletions
diff --git a/sys/include/ape/libsec.h b/sys/include/ape/libsec.h index bd4b352f7..610e69e28 100644 --- a/sys/include/ape/libsec.h +++ b/sys/include/ape/libsec.h @@ -382,7 +382,9 @@ int pkcs1unpadbuf(uchar *buf, int len, mpint *modulus, int blocktype); int asn1encodeRSApub(RSApub *pk, uchar *buf, int len); int asn1encodedigest(DigestState* (*fun)(uchar*, ulong, uchar*, DigestState*), uchar *digest, uchar *buf, int len); - + +int X509digestSPKI(uchar *, int, DigestState* (*)(uchar*, ulong, uchar*, DigestState*), uchar *); + /* * elgamal */ diff --git a/sys/include/libsec.h b/sys/include/libsec.h index b1616782f..f9c75306b 100644 --- a/sys/include/libsec.h +++ b/sys/include/libsec.h @@ -375,6 +375,7 @@ int asn1encodeRSApub(RSApub *pk, uchar *buf, int len); int asn1encodedigest(DigestState* (*fun)(uchar*, ulong, uchar*, DigestState*), uchar *digest, uchar *buf, int len); +int X509digestSPKI(uchar *, int, DigestState* (*)(uchar*, ulong, uchar*, DigestState*), uchar *); /* * elgamal |