moonbitstack/mooncred/x509 does not have a README file
Refused
pub(all) suberror Refused {
Malformed(at~ : Int, String)
Expired(at~ : Int)
Premature(at~ : Int)
Issuer
Authority(at~ : Int)
Signature(at~ : Int)
Depth(limit~ : Int)
Budget(limit~ : Int)
Host(String)
Purpose(at~ : Int)
Critical(at~ : Int, oid~ : String)
Constraint(at~ : Int, name~ : String)
Algorithm(at~ : Int, oid~ : String)
} derive(Eq, Debug)Why a chain was refused. at is the position in the chain as given — 0 the leaf, then the
intermediates in the order they arrived — of the certificate the refusal is about.
Attr
Cert
A parsed certificate. tbs is the exact encoding the signature covers and raw the whole
certificate, both as views into the input: a signature is checked over the bytes that arrived,
never over a re-encoding of what they were understood to mean. params is the encoding of
the signature algorithm's parameters, which RSASSA-PSS needs.
Cert::matches
Whether host is one of the certificate's identities: a DNS name against the subjectAltName
dNSName entries, an IPv4 or IPv6 literal against the iPAddress entries. The two never cross —
reading an address as a name is how a certificate for a name comes to be trusted for an
address. A certificate with no subjectAltName matches nothing: the commonName stopped being an
identity with RFC 6125, and Go and webpki no longer fall back to it.
Cert::signed_by
Check the certificate's signature under issuer — its issuer's key, or its own if it is
self-signed. RSA PKCS#1 v1.5 and PSS with SHA-256, SHA-384 or SHA-512, ECDSA with the same
three digests on any of the four curves, and Ed25519. An algorithm outside that set raises
Unsupported rather than returning false, so a caller cannot read "not checked" as "checked
and bad". A key of the wrong kind for the algorithm returns false: no signature by that
algorithm verifies under it.
Constraints
pub(all) struct Constraints {
permitted : Array[GeneralName]
excluded : Array[GeneralName]
} derive(Eq, Debug)A NameConstraints (RFC 5280 §4.2.1.10): the subtrees every name below the CA must fall in,
and the ones none may.
Exts
pub(all) struct Exts {
san : Array[GeneralName]
ca : Bool
path_len : Int?
key_usage : Bits?
eku : Array[String]?
ski : Bytes?
aki : Bytes?
constraints : Constraints?
unknown_critical : Array[String]
} derive(Eq, Debug)The extensions a certificate is judged on (RFC 5280 §4.2). key_usage bits are numbered from
the top of the first octet — 0 digitalSignature, 5 keyCertSign. eku is None when the
extension is absent, which means any purpose, as against a listed set that does not include
the one being asked for. ski and aki are the key identifiers path building uses to try the
likeliest issuer first. unknown_critical names the critical extensions this parser does not
understand: §4.2 makes such a certificate unusable, and a caller can only obey that rule if it
is told rather than left to assume the skip was safe.
GeneralName
A GeneralName (RFC 5280 §4.2.1.6). The forms that name a peer are decoded; the rest keep
their field number and contents, so a caller can see what was there instead of being told the
extension was empty. In a name constraint an Ip is an address followed by its mask, eight or
thirty-two octets; in a subjectAltName it is the bare address.
Key
A public key as a signature can be checked against. An RSA or EC key is held with the digest
its own algorithm defaults to; a certificate's signature algorithm decides the digest it is
actually checked with, so the key is re-read for each signature rather than fixed here.
Name
A distinguished name as it is encoded — a sequence of relative distinguished names, each a set
of attributes — together with the encoding itself. Path building matches an issuer to its
subject by those octets, as webpki and Go do: two readings of one name must not decide whether
a certificate chains.
Name::get
The value of the first attribute with this OID, in encoding order.
Policy
What a validation asks for and how far it may go. depth bounds the intermediates on the
path and budget the signature checks spent finding it; the presets are webpki's.
Policy::new
A policy with any field changed from the preset.
Roots
pub struct Roots {
// private fields
}Trust anchors. An anchor is a name and a key: its own validity and signature are never
checked, which is what lets a long-lived root carry a SHA-1 self-signature. Its name
constraints, when it has them, bind everything below it.
Roots::add
Add one anchor. The same certificate added twice is kept once.
Roots::iter
The anchors, in the order they were added.
Roots::new
Anchors from DER certificates.
Spki
A SubjectPublicKeyInfo: the algorithm OID, the parameter OID when the algorithm takes one (for
an EC key, the named curve), and the key bits. Absent and NULL parameters both read as None,
which is what every algorithm reachable from here means by either.
Spki::key
The public key a SubjectPublicKeyInfo carries: RSA, ECDSA on P-256, P-384, P-521 or
secp256k1, or Ed25519. Another algorithm raises Unsupported.
Spki::p256
The P-256 public key a SubjectPublicKeyInfo carries. Refuses any other curve.
Spki::read
Read a bare SubjectPublicKeyInfo.
A certificate carries one in Cert::spki; this is for the ones that travel on their own — a
PUBLIC KEY PEM file, or the key MySQL's caching_sha2_password hands a client mid-handshake.
Spki::rsa
The RSA public key a SubjectPublicKeyInfo carries.
The key bits are an RSAPublicKey ::= SEQUENCE { modulus INTEGER, publicExponent INTEGER }
(RFC 8017 §A.1.1). Refuses any algorithm but rsaEncryption.
digest and scheme are the signature parameters the key is built with. They do not enter
encryption at all — @rsa.PublicKey::encrypt takes its own — so a caller that only encrypts
can leave them alone.
Usage
The key purpose the leaf must allow (RFC 5280 §4.2.1.12). Any asks for none and checks
nothing; Other names a purpose by OID.
Validity
alg_ec_key
fn alg_ec_key() -> BytesThe id-ecPublicKey with the prime256v1 (P-256) curve AlgorithmIdentifier (RFC 5480).
alg_ecdsa_sha256
fn alg_ecdsa_sha256() -> BytesThe ecdsa-with-SHA256 AlgorithmIdentifier (RFC 5758): a SEQUENCE of just the OID, ECDSA
taking no parameters.
common_name
fn common_name(cn : String) -> BytesA Name with a single commonName attribute: RDNSequence → RelativeDistinguishedName (SET) →
AttributeTypeAndValue (SEQUENCE of the commonName OID 2.5.4.3 and the UTF8String value).
dns_match
fn dns_match(pattern : String, host : String) -> BoolWhether the dNSName pattern names host (RFC 6125 §6.4.3): label by label, ASCII case
insensitive. A first label of exactly * stands for one whole label, so *.a.example covers
b.a.example and neither a.example nor c.b.a.example. A * anywhere else, or fused to
the rest of its label as in b*.a.example, matches nothing — a partial wildcard is a claim on
a name the issuer never checked.
eku_server_auth
let eku_server_auth : Stringid-kp-serverAuth: the purpose a TLS server certificate needs (RFC 5280 §4.2.1.12).
oid_cn
let oid_cn : StringcommonName (X.520 §6.2.2), the attribute a name is usually read from.
parse
Parse a DER certificate (RFC 5280 §4.1). Raises on anything that is not exactly one
well-formed certificate: a truncated or over-long field, a payload glued to the end, a version
that does not admit the fields present, or an outer signature algorithm that disagrees with
the one the signature actually covers.
pem
The DER inside a PEM envelope (RFC 7468).
Everything outside the -----BEGIN ...----- and -----END ...----- lines
is dropped and the rest is base64-decoded. The label is not checked: what
the octets are is the caller's question, and a CERTIFICATE and a
PUBLIC KEY reach different readers from here.
Whitespace inside the body is ignored, which is what RFC 7468 §2 asks of a
parser and what makes a CRLF file read the same as an LF one.
pems
The DER of every PEM envelope in text with the label label, in order — a CA bundle such
as ca-certificates.crt or curl's cacert.pem is a run of CERTIFICATE envelopes with prose
between them. Envelopes with another label are passed over.
policy
A server certificate, at most six intermediates, at most a hundred signature checks.
self_signed
fn self_signed(key : PrivateKey, serial : Bytes, cn : String, not_before : String, not_after : String) -> BytesA self-signed X.509 certificate: build the TBSCertificate for key's public key, sign its
DER with ES256, DER-encode the r/s signature (RFC 5280 requires the ECDSA-Sig-Value
SEQUENCE, not the raw concatenation), and wrap TBS + algorithm + signature in the outer
Certificate SEQUENCE.
spki_of
A SubjectPublicKeyInfo for a P-256 key: the ecPublicKey/prime256v1 algorithm and the
uncompressed point as a BIT STRING.
tbs_of
fn tbs_of(serial : Bytes, cn : String, not_before : String, not_after : String, pub_key : PublicKey) -> BytesThe TBSCertificate (RFC 5280 §4.1.2): version v3 [0] EXPLICIT INTEGER 2, the serial number,
the signature algorithm, the issuer, the validity, the subject, and the SubjectPublicKeyInfo.
Self-signed, so issuer and subject are the same commonName. Extensions are omitted (a valid,
minimal profile).
validity_of
fn validity_of(not_before : String, not_after : String) -> BytesA Validity: notBefore and notAfter as UTCTime YYMMDDHHMMSSZ.
verify
Validate a chain and return the path found: the leaf, the intermediates it runs through, and
the anchor it ends on.
chain is the leaf followed by the intermediates the peer sent, in any order; ones the path
does not need are ignored, which is what a TLS server's habit of sending a cross-signed extra
asks for. now is the time to judge validity at, in seconds since the Unix epoch. host,
when given, is a DNS name or an IP literal the leaf must name; without it names are not
compared.
The rules, and whose they are:
- Names come from subjectAltName only, never the commonName (RFC 6125, Go since 1.15, webpki).
- Every issuer must be a CA, have keyCertSign when it lists key usages, and respect its pathLenConstraint. A leaf that is a CA is refused, as webpki does.
- Validity is checked on every certificate but the anchor.
- The leaf must allow policy.usage; an issuer that lists key purposes must allow it too (Go and the Mozilla root programme chain the restriction).
- An unknown critical extension anywhere on the path refuses it.
- Name constraints bind dNSName, iPAddress, rfc822Name, directoryName and the host of a URI; a constraint of another form, over a name of that form, refuses rather than guesses.
- Several candidate issuers with the issuer's name are each tried, preferring the one whose subjectKeyIdentifier matches the authorityKeyIdentifier; every signature check spends from policy.budget.
When no path works, the refusal is the first reason a candidate path failed, or Issuer when
there was no candidate at all.
Install
Download zipmooncred — credential formats for MoonBit: JSON Web Tokens, JWS and JWK with the JOSE algorithm set, and X.509 certificates with chain validation to the Mozilla roots, built on mooncrypt's algorithms.
jwtjwsjwkjosetokencredentialx509certificateoauth2moonbit
Apache-2.0
Updated 5 hours ago
778 downloads