| License | BSD-style |
|---|---|
| Maintainer | Vincent Hanquez <vincent@snarc.org> |
| Stability | experimental |
| Portability | unknown |
| Safe Haskell | None |
| Language | Haskell98 |
Data.X509
Contents
- Types
- Common extension usually found in x509v3
- Accessor turning extension into a specific one
- Certificate Revocation List (CRL)
- Naming
- Certificate Chain
- marshall between CertificateChain and CertificateChainRaw
- Signed types and marshalling
- Parametrized Signed accessor
- Hash distinguished names related function
Description
Read/Write X509 Certificate, CRL and their signed equivalents.
Follows RFC5280 / RFC6818
- type SignedCertificate = SignedExact Certificate
- type SignedCRL = SignedExact CRL
- data Certificate = Certificate {}
- data PubKey
- data PubKeyEC
- = PubKeyEC_Prime { }
- | PubKeyEC_Named { }
- newtype SerializedPoint = SerializedPoint ByteString
- data PrivKey
- pubkeyToAlg :: PubKey -> PubKeyALG
- privkeyToAlg :: PrivKey -> PubKeyALG
- data HashALG
- data PubKeyALG
- data SignatureALG
- class Extension a where
- data ExtBasicConstraints = ExtBasicConstraints Bool (Maybe Integer)
- data ExtKeyUsage = ExtKeyUsage [ExtKeyUsageFlag]
- data ExtKeyUsageFlag
- data ExtExtendedKeyUsage = ExtExtendedKeyUsage [ExtKeyUsagePurpose]
- data ExtKeyUsagePurpose
- data ExtSubjectKeyId = ExtSubjectKeyId ByteString
- data ExtSubjectAltName = ExtSubjectAltName [AltName]
- data ExtAuthorityKeyId = ExtAuthorityKeyId ByteString
- data ExtCrlDistributionPoints = ExtCrlDistributionPoints [DistributionPoint]
- data AltName
- data DistributionPoint
- data ReasonFlag
- extensionGet :: Extension a => Extensions -> Maybe a
- extensionGetE :: Extension a => Extensions -> Maybe (Either String a)
- extensionDecode :: Extension a => ExtensionRaw -> Maybe (Either String a)
- extensionEncode :: Extension a => Bool -> a -> ExtensionRaw
- data ExtensionRaw = ExtensionRaw {
- extRawOID :: OID
- extRawCritical :: Bool
- extRawASN1 :: [ASN1]
- newtype Extensions = Extensions (Maybe [ExtensionRaw])
- data CRL = CRL {}
- data RevokedCertificate = RevokedCertificate {}
- newtype DistinguishedName = DistinguishedName {}
- data DnElement
- data ASN1CharacterString :: * = ASN1CharacterString {}
- getDnElement :: DnElement -> DistinguishedName -> Maybe ASN1CharacterString
- newtype CertificateChain = CertificateChain [SignedExact Certificate]
- newtype CertificateChainRaw = CertificateChainRaw [ByteString]
- decodeCertificateChain :: CertificateChainRaw -> Either (Int, String) CertificateChain
- encodeCertificateChain :: CertificateChain -> CertificateChainRaw
- data (Show a, Eq a, ASN1Object a) => Signed a = Signed {}
- data (Show a, Eq a, ASN1Object a) => SignedExact a
- getSigned :: SignedExact a -> Signed a
- getSignedData :: (Show a, Eq a, ASN1Object a) => SignedExact a -> ByteString
- objectToSignedExact :: (Show a, Eq a, ASN1Object a) => (ByteString -> (ByteString, SignatureALG, r)) -> a -> (SignedExact a, r)
- objectToSignedExactF :: (Functor f, Show a, Eq a, ASN1Object a) => (ByteString -> f (ByteString, SignatureALG)) -> a -> f (SignedExact a)
- encodeSignedObject :: SignedExact a -> ByteString
- decodeSignedObject :: (Show a, Eq a, ASN1Object a) => ByteString -> Either String (SignedExact a)
- getCertificate :: SignedCertificate -> Certificate
- getCRL :: SignedCRL -> CRL
- decodeSignedCertificate :: ByteString -> Either String SignedCertificate
- decodeSignedCRL :: ByteString -> Either String SignedCRL
- hashDN :: DistinguishedName -> ByteString
- hashDN_old :: DistinguishedName -> ByteString
Types
type SignedCertificate = SignedExact Certificate #
A Signed Certificate
type SignedCRL = SignedExact CRL #
A Signed CRL
data Certificate #
X.509 Certificate type.
This type doesn't include the signature, it's describe in the RFC as tbsCertificate.
Constructors
| Certificate | |
Fields
| |
Instances
Public key types known and used in X.509
Elliptic Curve Public Key
TODO: missing support for binary curve.
Constructors
| PubKeyEC_Prime | |
Fields | |
| PubKeyEC_Named | |
Fields | |
newtype SerializedPoint #
Serialized Elliptic Curve Point
Constructors
| SerializedPoint ByteString |
Instances
Private key types known and used in X.509
Constructors
| PrivKeyRSA PrivateKey | RSA private key |
| PrivKeyDSA PrivateKey | DSA private key |
pubkeyToAlg :: PubKey -> PubKeyALG #
Convert a Public key to the Public Key Algorithm type
privkeyToAlg :: PrivKey -> PubKeyALG #
Convert a Public key to the Public Key Algorithm type
Hash Algorithm
Constructors
| HashMD2 | |
| HashMD5 | |
| HashSHA1 | |
| HashSHA224 | |
| HashSHA256 | |
| HashSHA384 | |
| HashSHA512 |
Public Key Algorithm
Constructors
| PubKeyALG_RSA | RSA Public Key algorithm |
| PubKeyALG_RSAPSS | RSA PSS Key algorithm (RFC 3447) |
| PubKeyALG_DSA | DSA Public Key algorithm |
| PubKeyALG_EC | ECDSA & ECDH Public Key algorithm |
| PubKeyALG_DH | Diffie Hellman Public Key algorithm |
| PubKeyALG_Unknown OID | Unknown Public Key algorithm |
data SignatureALG #
Signature Algorithm often composed of a public key algorithm and a hash algorithm
Constructors
| SignatureALG HashALG PubKeyALG | |
| SignatureALG_Unknown OID |
Instances
Extension class.
each extension have a unique OID associated, and a way to encode and decode an ASN1 stream.
Common extension usually found in x509v3
data ExtKeyUsageFlag #
key usage flag that is found in the key usage extension field.
Constructors
Instances
data ExtExtendedKeyUsage #
Extended key usage extension
Constructors
| ExtExtendedKeyUsage [ExtKeyUsagePurpose] |
data ExtKeyUsagePurpose #
Key usage purposes for the ExtendedKeyUsage extension
Constructors
| KeyUsagePurpose_ServerAuth | |
| KeyUsagePurpose_ClientAuth | |
| KeyUsagePurpose_CodeSigning | |
| KeyUsagePurpose_EmailProtection | |
| KeyUsagePurpose_TimeStamping | |
| KeyUsagePurpose_OCSPSigning | |
| KeyUsagePurpose_Unknown OID |
Instances
data ExtSubjectKeyId #
Provide a way to identify a public key by a short hash.
Constructors
| ExtSubjectKeyId ByteString |
Instances
data ExtSubjectAltName #
Provide a way to supply alternate name that can be used for matching host name.
Constructors
| ExtSubjectAltName [AltName] |
data ExtAuthorityKeyId #
Provide a mean to identify the public key corresponding to the private key used to signed a certificate.
Constructors
| ExtAuthorityKeyId ByteString |
Instances
data ExtCrlDistributionPoints #
Identify how CRL information is obtained
Constructors
| ExtCrlDistributionPoints [DistributionPoint] |
Different naming scheme use by the extension.
Not all name types are available, missing: otherName x400Address directoryName ediPartyName registeredID
data ReasonFlag #
Reason flag for the CRL
Constructors
| Reason_Unused | |
| Reason_KeyCompromise | |
| Reason_CACompromise | |
| Reason_AffiliationChanged | |
| Reason_Superseded | |
| Reason_CessationOfOperation | |
| Reason_CertificateHold | |
| Reason_PrivilegeWithdrawn | |
| Reason_AACompromise |
Instances
Accessor turning extension into a specific one
extensionGet :: Extension a => Extensions -> Maybe a #
Get a specific extension from a lists of raw extensions
extensionGetE :: Extension a => Extensions -> Maybe (Either String a) #
Get a specific extension from a lists of raw extensions
extensionDecode :: Extension a => ExtensionRaw -> Maybe (Either String a) #
Try to decode an ExtensionRaw.
If this function return: * Nothing, the OID doesn't match * Just Left, the OID matched, but the extension couldn't be decoded * Just Right, the OID matched, and the extension has been succesfully decoded
extensionEncode :: Extension a => Bool -> a -> ExtensionRaw #
Encode an Extension to extensionRaw
data ExtensionRaw #
An undecoded extension
Constructors
| ExtensionRaw | |
Fields
| |
Instances
Certificate Revocation List (CRL)
Describe a Certificate revocation list
Constructors
| CRL | |
data RevokedCertificate #
Describe a revoked certificate identifiable by serial number.
Constructors
| RevokedCertificate | |
Fields | |
Naming
Elements commonly available in a DistinguishedName structure
Constructors
| DnCommonName | CN |
| DnCountry | Country |
| DnOrganization | O |
| DnOrganizationUnit | OU |
| DnEmailAddress | Email Address (legacy) |
getDnElement :: DnElement -> DistinguishedName -> Maybe ASN1CharacterString #
Try to get a specific element in a DistinguishedName structure
Certificate Chain
newtype CertificateChain #
A chain of X.509 certificates in exact form.
Constructors
| CertificateChain [SignedExact Certificate] |
Instances
newtype CertificateChainRaw #
Represent a chain of X.509 certificates in bytestring form.
Constructors
| CertificateChainRaw [ByteString] |
Instances
marshall between CertificateChain and CertificateChainRaw
decodeCertificateChain :: CertificateChainRaw -> Either (Int, String) CertificateChain #
Decode a CertificateChainRaw into a CertificateChain if every raw certificate are decoded correctly, otherwise return the index of the failed certificate and the error associated.
encodeCertificateChain :: CertificateChain -> CertificateChainRaw #
Convert a CertificateChain into a CertificateChainRaw
Signed types and marshalling
data (Show a, Eq a, ASN1Object a) => Signed a #
Represent a signed object using a traditional X509 structure.
When dealing with external certificate, use the SignedExact structure not this one.
Constructors
| Signed | |
Fields
| |
data (Show a, Eq a, ASN1Object a) => SignedExact a #
Represent the signed object plus the raw data that we need to keep around for non compliant case to be able to verify signature.
Instances
| (ASN1Object a, Eq a, Show a) => Eq (SignedExact a) # | |
| (ASN1Object a, Eq a, Show a) => Show (SignedExact a) # | |
getSigned :: SignedExact a -> Signed a #
get the decoded Signed data
getSignedData :: (Show a, Eq a, ASN1Object a) => SignedExact a -> ByteString #
Get the signed data for the signature
Arguments
| :: (Show a, Eq a, ASN1Object a) | |
| => (ByteString -> (ByteString, SignatureALG, r)) | signature function |
| -> a | object to sign |
| -> (SignedExact a, r) |
Transform an object into a SignedExact object
Arguments
| :: (Functor f, Show a, Eq a, ASN1Object a) | |
| => (ByteString -> f (ByteString, SignatureALG)) | signature function |
| -> a | object to sign |
| -> f (SignedExact a) |
A generalization of objectToSignedExact where the signature function
runs in an arbitrary functor. This allows for example to sign using an
algorithm needing random values.
encodeSignedObject :: SignedExact a -> ByteString #
The raw representation of the whole signed structure
decodeSignedObject :: (Show a, Eq a, ASN1Object a) => ByteString -> Either String (SignedExact a) #
Try to parse a bytestring that use the typical X509 signed structure format
Parametrized Signed accessor
getCertificate :: SignedCertificate -> Certificate #
Get the Certificate associated to a SignedCertificate
decodeSignedCertificate :: ByteString -> Either String SignedCertificate #
Try to decode a bytestring to a SignedCertificate
decodeSignedCRL :: ByteString -> Either String SignedCRL #
Try to decode a bytestring to a SignedCRL
Hash distinguished names related function
hashDN :: DistinguishedName -> ByteString #
Make an OpenSSL style hash of distinguished name
OpenSSL algorithm is odd, and has been replicated here somewhat. only lower the case of ascii character.
hashDN_old :: DistinguishedName -> ByteString #
Create an openssl style old hash of distinguished name