Skip to content

API XMLSec OpenSSL X509

Jump to bottom
Aleksey Sanin edited this page Jun 22, 2026 · 5 revisions

OpenSSL X.509 Support

API Group: xmlsec_openssl_x509

X.509 certificate handling for the OpenSSL back-end.

X509 certificates verification support functions for OpenSSL.

X509 certificates implementation for OpenSSL.

X509 key data implementation.

Macros

XMLSEC_STACK_OF_X509

Defined as: STACK_OF(X509)

Source: include/xmlsec/openssl/x509.h

Macro. To make docbook happy.

XMLSEC_STACK_OF_X509_CRL

Defined as: STACK_OF(X509_CRL)

Source: include/xmlsec/openssl/x509.h

Macro. To make docbook happy.

xmlSecOpenSSLKeyDataX509Id

Defined as: xmlSecOpenSSLKeyDataX509GetKlass()

Source: include/xmlsec/openssl/x509.h

The OpenSSL X509 data klass.

xmlSecOpenSSLKeyDataRawX509CertId

Defined as: xmlSecOpenSSLKeyDataRawX509CertGetKlass()

Source: include/xmlsec/openssl/x509.h

The OpenSSL raw X509 certificate klass.

xmlSecOpenSSLX509StoreId

Defined as: xmlSecOpenSSLX509StoreGetKlass()

Source: include/xmlsec/openssl/x509.h

The OpenSSL X509 store klass.

Functions

xmlSecOpenSSLKeyDataX509GetKlass

xmlSecKeyDataId xmlSecOpenSSLKeyDataX509GetKlass(void);

Source: include/xmlsec/openssl/x509.h

The OpenSSL X509 key data klass.

The OpenSSL X509 key data klass (http://www.w3.org/TR/xmldsig-core/#sec-X509Data).

Returns: the X509 data klass.

xmlSecOpenSSLKeyDataX509GetKeyCert

X509 * xmlSecOpenSSLKeyDataX509GetKeyCert(xmlSecKeyDataPtr data);

Source: include/xmlsec/openssl/x509.h

Gets the certificate from which the key was extracted.

Parameters:

  • data — the pointer to X509 key data.

Returns: the key's certificate or NULL if key data was not used for key extraction or an error occurs.

xmlSecOpenSSLKeyDataX509AdoptKeyCert

int xmlSecOpenSSLKeyDataX509AdoptKeyCert(xmlSecKeyDataPtr data, X509 *cert);

Source: include/xmlsec/openssl/x509.h

Adds certificate to the X509 key data and sets the it as the key's.

Parameters:

  • data — the pointer to X509 key data.
  • cert — the pointer to OpenSSL X509 certificate. certificate in data. On success, the data owns the cert. This function DOES NOT check if the key matches the key cert (use xmlSecOpenSSLAppKeyCertLoadBIO that performs this check).

Returns: 0 on success or a negative value if an error occurs.

xmlSecOpenSSLKeyDataX509AdoptCert

int xmlSecOpenSSLKeyDataX509AdoptCert(xmlSecKeyDataPtr data, X509 *cert);

Source: include/xmlsec/openssl/x509.h

Adds certificate to the X509 key data.

Adds certificate to the X509 key data. On success, the data owns the cert.

Parameters:

  • data — the pointer to X509 key data.
  • cert — the pointer to OpenSSL X509 certificate.

Returns: 0 on success or a negative value if an error occurs.

xmlSecOpenSSLKeyDataX509GetCert

X509 * xmlSecOpenSSLKeyDataX509GetCert(xmlSecKeyDataPtr data, xmlSecSize pos);

Source: include/xmlsec/openssl/x509.h

Gets a certificate from X509 key data.

Parameters:

  • data — the pointer to X509 key data.
  • pos — the desired certificate position.

Returns: the pointer to certificate or NULL if pos is larger than the number of certificates in data or an error occurs.

xmlSecOpenSSLKeyDataX509GetCertsSize

xmlSecSize xmlSecOpenSSLKeyDataX509GetCertsSize(xmlSecKeyDataPtr data);

Source: include/xmlsec/openssl/x509.h

Gets the number of certificates in data.

Parameters:

  • data — the pointer to X509 key data.

Returns: te number of certificates in data.

xmlSecOpenSSLKeyDataX509AdoptCrl

int xmlSecOpenSSLKeyDataX509AdoptCrl(xmlSecKeyDataPtr data, X509_CRL *crl);

Source: include/xmlsec/openssl/x509.h

Adds CRL to the X509 key data.

Parameters:

  • data — the pointer to X509 key data.
  • crl — the pointer to OpenSSL X509 CRL.

Returns: 0 on success or a negative value if an error occurs.

xmlSecOpenSSLKeyDataX509GetCrl

X509_CRL * xmlSecOpenSSLKeyDataX509GetCrl(xmlSecKeyDataPtr data, xmlSecSize pos);

Source: include/xmlsec/openssl/x509.h

Gets a CRL from X509 key data.

Parameters:

  • data — the pointer to X509 key data.
  • pos — the desired CRL position.

Returns: the pointer to CRL or NULL if pos is larger than the number of CRLs in data or an error occurs.

xmlSecOpenSSLKeyDataX509GetCrlsSize

xmlSecSize xmlSecOpenSSLKeyDataX509GetCrlsSize(xmlSecKeyDataPtr data);

Source: include/xmlsec/openssl/x509.h

Gets the number of CRLs in data.

Parameters:

  • data — the pointer to X509 key data.

Returns: te number of CRLs in data.

xmlSecOpenSSLX509CertGetKey

xmlSecKeyDataPtr xmlSecOpenSSLX509CertGetKey(X509 *cert);

Source: include/xmlsec/openssl/x509.h

Extracts public key from the cert.

Parameters:

  • cert — the certificate.

Returns: public key value or NULL if an error occurs.

xmlSecOpenSSLKeyDataRawX509CertGetKlass

xmlSecKeyDataId xmlSecOpenSSLKeyDataRawX509CertGetKlass(void);

Source: include/xmlsec/openssl/x509.h

The raw X509 certificates key data klass.

Returns: raw X509 certificates key data klass.

xmlSecOpenSSLX509StoreGetKlass

xmlSecKeyDataStoreId xmlSecOpenSSLX509StoreGetKlass(void);

Source: include/xmlsec/openssl/x509.h

The OpenSSL X509 certificates key data store klass.

Returns: the store klass.

xmlSecOpenSSLX509StoreVerify

X509 * xmlSecOpenSSLX509StoreVerify(xmlSecKeyDataStorePtr store, STACK_OF(X509) *certs, STACK_OF(X509_CRL) *crls, xmlSecKeyInfoCtx *keyInfoCtx);

Source: include/xmlsec/openssl/x509.h

xmlSecOpenSSLX509StoreVerifyKey

int xmlSecOpenSSLX509StoreVerifyKey(xmlSecKeyDataStorePtr store, xmlSecKeyPtr key, xmlSecKeyInfoCtxPtr keyInfoCtx);

Source: include/xmlsec/openssl/x509.h

Verifies key with the keys manager mngr created with xmlSecCryptoAppDefaultKeysMngrInit.

Parameters:

  • store — the pointer to X509 key data store klass.

  • key — the pointer to key.

  • keyInfoCtx — the key info context for verification. function:

  • Checks that key certificate is present

  • Checks that key certificate is valid

Adds key to the keys manager mngr created with xmlSecCryptoAppDefaultKeysMngrInit function.

Returns: 1 if key is verified, 0 otherwise, or a negative value if an error occurs.

xmlSecOpenSSLX509StoreVerifyCrl

int xmlSecOpenSSLX509StoreVerifyCrl(xmlSecKeyDataStorePtr store, X509_CRL *crl, xmlSecKeyInfoCtxPtr keyInfoCtx);

Source: include/xmlsec/openssl/x509.h

Verifies crl by checking:

Parameters:

  • store — the pointer to X509 key data store klass.
  • crl — the CRL to verify.
  • keyInfoCtx — the key info context for verification parameters.
  1. Signature is valid (signed by issuer cert in store)
  2. thisUpdate <= verification_time <= nextUpdate

Returns: 1 if verified, 0 if not verified, or a negative value on error.

xmlSecOpenSSLX509StoreAdoptCert

int xmlSecOpenSSLX509StoreAdoptCert(xmlSecKeyDataStorePtr store, X509 *cert, xmlSecKeyDataType type);

Source: include/xmlsec/openssl/x509.h

Adds cert to the trusted or untrusted store.

Adds trusted (root) or untrusted certificate to the store.

Parameters:

  • store — the pointer to X509 key data store klass.
  • cert — the pointer to OpenSSL X509 certificate.
  • type — the certificate type (trusted/untrusted).

Returns: 0 on success or a negative value if an error occurs.

xmlSecOpenSSLX509StoreAdoptCrl

int xmlSecOpenSSLX509StoreAdoptCrl(xmlSecKeyDataStorePtr store, X509_CRL *crl);

Source: include/xmlsec/openssl/x509.h

Adds X509 CRL to the store.

Parameters:

  • store — the pointer to X509 key data store klass.
  • crl — the pointer to OpenSSL X509_CRL.

Returns: 0 on success or a negative value if an error occurs.

xmlSecOpenSSLX509StoreAddCertsPath

int xmlSecOpenSSLX509StoreAddCertsPath(xmlSecKeyDataStorePtr store, const char *path);

Source: include/xmlsec/openssl/x509.h

Adds all certs in the path to the list of trusted certs.

Parameters:

  • store — the pointer to OpenSSL x509 store.
  • path — the path to the certs dir. in store.

Returns: 0 on success or a negative value otherwise.

xmlSecOpenSSLX509StoreAddCertsFile

int xmlSecOpenSSLX509StoreAddCertsFile(xmlSecKeyDataStorePtr store, const char *filename);

Source: include/xmlsec/openssl/x509.h

Adds all certs in the file to the list of trusted certs.

Parameters:

  • store — the pointer to OpenSSL x509 store.
  • filename — the certs file. in store. It is possible for the file to contain multiple certs.

Returns: 0 on success or a negative value otherwise.

xmlSecOpenSSLX509StoreFindCert

X509 * xmlSecOpenSSLX509StoreFindCert(xmlSecKeyDataStorePtr store, xmlChar *subjectName, xmlChar *issuerName, xmlChar *issuerSerial, xmlChar *ski, xmlSecKeyInfoCtx *keyInfoCtx);

Source: include/xmlsec/openssl/x509.h

Deprecated. Searches store for a certificate that matches given criteria.

Parameters:

  • store — the pointer to X509 key data store klass.
  • subjectName — the desired certificate name.
  • issuerName — the desired certificate issuer name.
  • issuerSerial — the desired certificate issuer serial number.
  • ski — the desired certificate SKI.
  • keyInfoCtx — the pointer to dsig:KeyInfo/ element processing context.

Returns: pointer to found certificate or NULL if certificate is not found or an error occurs.

xmlSecOpenSSLX509StoreFindCert_ex

X509 * xmlSecOpenSSLX509StoreFindCert_ex(xmlSecKeyDataStorePtr store, xmlChar *subjectName, xmlChar *issuerName, xmlChar *issuerSerial, xmlSecByte *ski, xmlSecSize skiSize, xmlSecKeyInfoCtx *keyInfoCtx);

Source: include/xmlsec/openssl/x509.h

Deprecated. Searches store for a certificate that matches given criteria.

Parameters:

  • store — the pointer to X509 key data store klass.
  • subjectName — the desired certificate name.
  • issuerName — the desired certificate issuer name.
  • issuerSerial — the desired certificate issuer serial number.
  • ski — the desired certificate SKI.
  • skiSize — the desired certificate SKI size.
  • keyInfoCtx — the pointer to dsig:KeyInfo/ element processing context.

Returns: pointer to found certificate or NULL if certificate is not found or an error occurs.

XML Security Library Website | GitHub

Clone this wiki locally