Legend:
Library
Module
Module type
Parameter
Class
Class type
Library
Module
Module type
Parameter
Class
Class type
package x509
X.509 Certificate Revocation Lists.
A certificate revocation list is a signed structure consisting of an issuer, a timestamp, possibly a timestamp when to expect the next update, and a list of revoked certificates (represented by a serial, a revocation date, and extensions (e.g. reason) - see RFC 5280 section 5.2 for a list of available extensions (not enforced)). It also may contain any extensions, e.g. a CRL number and whether it is partial or complete.
Encoding and decoding in ASN.1 DER format
val encode_der : t -> Cstruct.tencode_der crl is buffer, the ASN.1 DER encoding of the given certificate revocation list.
val decode_der : Cstruct.t -> (t, [> Rresult.R.msg ]) Rresult.resultdecode_der buffer is crl, the certificate revocation list of the ASN.1 encoded buffer.
Operations on CRLs
val issuer : t -> Distinguished_name.tissuer c is the issuer of the revocation list.
val this_update : t -> Ptime.tthis_update t is the timestamp of the revocation list.
val next_update : t -> Ptime.t optionnext_update t is either None or Some ts, the timestamp of the next update.
The type of a revoked certificate, which consists of a serial number, the revocation date, and possibly extensions. See RFC 5280 section 5.3 for allowed extensions (not enforced).
val reason : revoked_cert -> Extension.reason optionreason revoked extracts the Reason extension from revoked if present.
val revoked_certificates : t -> revoked_cert listrevoked_certificates t is the list of revoked certificates of the revocation list.
val extensions : t -> Extension.textensions t is the list of extensions, see RFC 5280 section 5.2 for possible values.
val crl_number : t -> int optioncrl_number t is the number of the CRL.
val signature_algorithm : t -> ([ `RSA | `ECDSA ] * Nocrypto.Hash.hash) optionsignature_algorithm t is the algorithm used for the signature.
Validation and verification of CRLs
val validate :
t ->
?hash_whitelist:Nocrypto.Hash.hash list ->
Public_key.t ->
boolvalidate t ~hash_whitelist pk validates the digital signature of the revocation list. The hash_whitelist defaults to SHA-2.
val verify :
t ->
?hash_whitelist:Nocrypto.Hash.hash list ->
?time:Ptime.t ->
Certificate.t ->
boolverify t ~hash_whitelist ~time cert verifies that the issuer of t matches the subject of cert, and validates the digital signature of the revocation list. The used hash algorithm must be in the hash_whitelist (defaults to SHA-2). If time is provided, it must be after this_update and before next_update of t.
val is_revoked :
t list ->
?hash_whitelist:Nocrypto.Hash.hash list ->
issuer:Certificate.t ->
cert:Certificate.t ->
boolis_revoked crls ~hash_whitelist ~issuer ~cert is true if there exists a revocation of cert in crls which is signed by the issuer. The subject of issuer must match the issuer of the crl. The hash algorithm used for signing must be in the hash_whitelist (defaults to SHA-2).
Construction and signing of CRLs
val revoke :
?digest:Nocrypto.Hash.hash ->
issuer:Distinguished_name.t ->
this_update:Ptime.t ->
?next_update:Ptime.t ->
?extensions:Extension.t ->
revoked_cert list ->
Private_key.t ->
trevoked ~digest ~issuer ~this_update ~next_update ~extensions certs priv constructs a revocation list with the given parameters.
val revoke_certificate :
revoked_cert ->
this_update:Ptime.t ->
?next_update:Ptime.t ->
t ->
Private_key.t ->
trevoke_certificate cert ~this_update ~next_update t priv adds cert to the revocation list, increments its counter, adjusts this_update and next_update timestamps, and digitally signs it using priv.
val revoke_certificates :
revoked_cert list ->
this_update:Ptime.t ->
?next_update:Ptime.t ->
t ->
Private_key.t ->
trevoke_certificates certs ~this_update ~next_update t priv adds certs to the revocation list, increments its counter, adjusts this_update and next_update timestamps, and digitally signs it using priv.