x509 0.9.0 · OCaml Package

Certificate chain authenticators

type t = ?host:[ `host ] Domain_name.t -> Certificate.t list -> Validation.r

An authenticator a is a function type which takes a hostname and a certificate stack to an authentication decision Validation.r.

val chain_of_trust : 
  ?time:Ptime.t ->
  ?crls:CRL.t list ->
  ?hash_whitelist:Nocrypto.Hash.hash list ->
  Certificate.t list ->
  t

chain_of_trust ~time ~crls ~hash_whitelist trust_anchors is authenticator, which uses the given time and list of trust_anchors to verify the certificate chain. All signatures must use a hash algorithm specified in hash_whitelist, defaults to SHA-2. Signatures on revocation lists crls must also use a hash algorithm in hash_whitelist. This is an implementation of the algorithm described in RFC 5280, using Validation.verify_chain_of_trust. The given trust anchors are not validated, you can filter them with Validation.valid_cas if desired.

val server_key_fingerprint : 
  ?time:Ptime.t ->
  hash:Nocrypto.Hash.hash ->
  fingerprints:([ `host ] Domain_name.t * Cstruct.t) list ->
  t

server_key_fingerprint ~time hash fingerprints is an authenticator that uses the given time and list of fingerprints to verify that the fingerprint of the first element of the certificate chain matches the given fingerprint, using Validation.trust_key_fingerprint.

val server_cert_fingerprint : 
  ?time:Ptime.t ->
  hash:Nocrypto.Hash.hash ->
  fingerprints:([ `host ] Domain_name.t * Cstruct.t) list ->
  t

server_cert_fingerprint ~time hash fingerprints is an authenticator that uses the given time and list of fingerprints to verify the first element of the certificate chain, using Validation.trust_cert_fingerprint. Note that public key pinning has advantages over certificate pinning.

val null : t

null is authenticator, which always returns Ok (). (Useful for testing purposes only.)

package x509