OSX/sec/Security/SecCertificateRequest.h

   1 /*
   2  * Copyright (c) 2008-2009,2012-2014 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 /*!
  25         @header SecCertificateRequest
  26 */
  27
  28 #ifndef _SECURITY_SECCERTIFICATEREQUEST_H_
  29 #define _SECURITY_SECCERTIFICATEREQUEST_H_
  30
  31 #include <Security/SecCertificatePriv.h>
  32 #include <Security/SecKey.h>
  33
  34 __BEGIN_DECLS
  35
  36 extern const void * kSecOidCommonName;
  37 extern const void * kSecOidCountryName;
  38 extern const void * kSecOidStateProvinceName;
  39 extern const void * kSecOidLocalityName;
  40 extern const void * kSecOidOrganization;
  41 extern const void * kSecOidOrganizationalUnit;
  42
  43 extern const unsigned char SecASN1PrintableString;
  44 extern const unsigned char SecASN1UTF8String;
  45
  46 /*
  47         Parameter keys for certificate request generation:
  48         @param kSecCSRChallengePassword CFStringRef
  49             conversion to PrintableString or UTF8String needs to be possible.
  50         @param kSecCertificateKeyUsage  CFNumberRef
  51             with key usage mask using kSecKeyUsage constants.
  52         @param kSecSubjectAltName       CFArrayRef of CFStringRef or CFDataRef
  53             either dnsName or emailAddress (if contains @) or
  54             ipAddress, ipv4 (4) or ipv6 (16) bytes
  55         @param kSecCSRBasicContraintsPathLen    CFNumberRef
  56             if set will include basic constraints and mark it as
  57             a CA cert.  If 0 <= number < 256, specifies path length, otherwise
  58             path length will be omitted.  Basic contraints will always be
  59             marked critical.
  60         @param kSecCertificateExtensions     CFDictionaryRef
  61             if set all keys (strings with oids in dotted notation) will be added
  62             as extensions with accompanying value in binary (CFDataRef) or
  63             appropriate string (CFStringRef) type (based on used character set).
  64         @param kSecCertificateExtensionsEncoded     CFDictionaryRef
  65             if set all keys (strings with oids in dotted notation) will be added
  66             as extensions with accompanying value.  It is assumed that the value
  67             is a CFDataRef and is already properly encoded.  This value will be
  68             placed straight into the extension value OCTET STRING.
  69 */
  70 extern const void * kSecCSRChallengePassword;
  71 extern const void * kSecSubjectAltName;
  72 extern const void * kSecCertificateKeyUsage;
  73 extern const void * kSecCSRBasicContraintsPathLen;
  74 extern const void * kSecCertificateExtensions;
  75 extern const void * kSecCertificateExtensionsEncoded;
  76
  77 typedef struct {
  78     const void *oid;          /* kSecOid constant or CFDataRef with oid */
  79     unsigned char type; /* currently only SecASN1PrintableString */
  80     CFTypeRef value;    /* CFStringRef -> ASCII, UTF8, CFDataRef -> binary */
  81 } SecATV;
  82
  83 typedef SecATV *SecRDN;
  84
  85 /*
  86         @function SecGenerateCertificateRequest
  87         @abstract Return a newly generated CSR for subject and keypair.
  88         @param subject  RDNs in the subject
  89     @param num      Number of RDNs
  90     @param publicKey    Public key
  91     @param privateKey   Private key
  92         @discussion only handles RSA keypairs and uses a SHA-1 PKCS1 signature
  93     @result On success, a newly allocated CSR, otherwise NULL
  94
  95 Example for subject:
  96     SecATV cn[]   = { { kSecOidCommonName, SecASN1PrintableString, CFSTR("test") }, {} };
  97     SecATV c[]    = { { kSecOidCountryName, SecASN1PrintableString, CFSTR("US") }, {} };
  98     SecATV o[]    = { { kSecOidOrganization, SecASN1PrintableString, CFSTR("Apple Inc.") }, {} };
  99     SecRDN atvs[] = { cn, c, o, NULL };
 100 */
 101 CFDataRef SecGenerateCertificateRequestWithParameters(SecRDN *subject,
 102     CFDictionaryRef parameters, SecKeyRef publicKey, SecKeyRef privateKey) CF_RETURNS_RETAINED;
 103
 104 CFDataRef SecGenerateCertificateRequest(CFArrayRef subject,
 105     CFDictionaryRef parameters, SecKeyRef publicKey, SecKeyRef privateKey) CF_RETURNS_RETAINED;
 106
 107 /*
 108         @function SecVerifyCertificateRequest
 109         @abstract validate a CSR and return contained information to certify
 110         @param publicKey (optional/out) SecKeyRef public key to certify
 111     @param challenge (optional/out) CFStringRef enclosed challenge
 112     @param subject (optional/out) encoded subject RDNs
 113     @param extensions (optional/out) encoded extensions
 114 */
 115 bool SecVerifyCertificateRequest(CFDataRef csr, SecKeyRef *publicKey,
 116     CFStringRef *challenge, CFDataRef *subject, CFDataRef *extensions);
 117
 118 SecCertificateRef
 119 SecGenerateSelfSignedCertificate(CFArrayRef subject, CFDictionaryRef parameters,
 120     SecKeyRef publicKey, SecKeyRef privateKey);
 121
 122 SecCertificateRef
 123 SecIdentitySignCertificate(SecIdentityRef issuer, CFDataRef serialno,
 124     SecKeyRef publicKey, CFTypeRef subject, CFTypeRef extensions);
 125
 126
 127 /* PRIVATE */
 128
 129 CF_RETURNS_RETAINED
 130 CFDataRef
 131 SecGenerateCertificateRequestSubject(SecCertificateRef ca_certificate, CFArrayRef subject);
 132
 133 __END_DECLS
 134
 135 #endif /* _SECURITY_SECCERTIFICATEREQUEST_H_ */