Support reading x509v3 extensions from a certificate

[daurnimator]

I was playing with using OCSP validation, but found that I had no way to read the OCSP url outside of cert:text()

Please add support for reading x509v3 extensions.

[wahern]

Can you use the features recently added by kunkku, such as crt:getExtension, extension:getID, extension:getName, and extension:getData?

[daurnimator]

Can you use the features recently added by kunkku, such as crt:getExtension, extension:getID, extension:getName, and extension:getData?

Partially. e.g.

s=require"cqueues.socket".connect("globalsign.com", 443);
s:starttls();
ssl = s:checktls();
cert = ssl:getPeerCertificate();
aia = cert:getExtension("authorityInfoAccess");
io.write(aia:getData())

Will print the contents of the extension field. However, it is an ASN.1 encoded string.
Something to parse this further would be useful.

---

Otherwise, an iterator over the available extensions would be useful; it took me a bit to figure out that the extension 'name' that OCSP is under was "authorityInfoAccess"

[wahern]

Here's my testing code:

for i=1,crt:getExtensionCount() do
        local ext = crt:getExtension(i)

        print(string.format("%s: %s", ext:getLongName() or ext:getID(), ext:getCritical() and "critical" or ""))
        print(ext:text(0, 8))
end

I'll add the __tostring metamethod once I figure out what the appropriate flags to X509V3_EXT_print should be.

[daurnimator]

crt:getExtension(i)

Ah ha! I didn't know you could get by index :)

[wahern]

I added that about an hour ago, along with the updated documentation.

[daurnimator]

I added that about an hour ago

Commit 6fbdef8 appears to also include some 'unsigned' changes, was that mean to be in there?

[daurnimator]

what the appropriate flags to X509V3_EXT_print should be.

The flags define what to do when openssl doesn't have knowledge of how to stringify a field, or a field doesn't match specifications:

The defined flags are:

• X509V3_EXT_DEFAULT: return failure
• X509V3_EXT_ERROR_UNKNOWN: print <Parse Error> or <Not Supported> in place
• X509V3_EXT_PARSE_UNKNOWN: try and parse it as ASN.1
• X509V3_EXT_DUMP_UNKNOWN: just write the raw bytes

Anything else returns success but does nothing.

[daurnimator]

Closing as I feel like this is effectively done now.