1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
|
The STORE type
==============
A STORE, as defined in this code section, is really a rather simple
thing which stores objects and per-object associations to a number
of attributes. What attributes are supported entirely depends on
the particular implementation of a STORE. It has some support for
generation of certain objects (for example, keys and CRLs).
Supported object types
----------------------
For now, the objects that are supported are the following:
X.509 certificate
X.509 CRL
private key
public key
number
arbitrary (application) data
The intention is that a STORE should be able to store everything
needed by an application that wants a cert/key store, as well as
the data a CA might need to store (this includes the serial number
counter, which explains the support for numbers).
Supported attribute types
-------------------------
For now, the following attributes are supported:
Friendly Name - the value is a normal C string
Key ID - the value is a 160 bit SHA1 hash
Issuer Key ID - the value is a 160 bit SHA1 hash
Subject Key ID - the value is a 160 bit SHA1 hash
Issuer/Serial Hash - the value is a 160 bit SHA1 hash
Issuer - the value is a X509_NAME
Serial - the value is a BIGNUM
Subject - the value is a X509_NAME
Certificate Hash - the value is a 160 bit SHA1 hash
Email - the value is a normal C string
Filename - the value is a normal C string
It is expected that these attributes should be enough to support
the need from most, if not all, current applications. Applications
that need to do certificate verification would typically use Subject
Key ID, Issuer/Serial Hash or Subject to look up issuer certificates.
S/MIME applications would typically use Email to look up recipient
and signer certificates.
There's added support for combined sets of attributes to search for,
with the special OR attribute.
Supported basic functionality
-----------------------------
The functions that are supported through the STORE type are these:
generate_object - for example to generate keys and CRLs
get_object - to look up one object
NOTE: this function is really rather
redundant and probably of lesser usage
than the list functions
store_object - store an object and the attributes
associated with it
modify_object - modify the attributes associated with
a specific object
revoke_object - revoke an object
NOTE: this only marks an object as
invalid, it doesn't remove the object
from the database
delete_object - remove an object from the database
list_object - list objects associated with a given
set of attributes
NOTE: this is really four functions:
list_start, list_next, list_end and
list_endp
update_store - update the internal data of the store
lock_store - lock the store
unlock_store - unlock the store
The list functions need some extra explanation: list_start is
used to set up a lookup. That's where the attributes to use in
the search are set up. It returns a search context. list_next
returns the next object searched for. list_end closes the search.
list_endp is used to check if we have reached the end.
A few words on the store functions as well: update_store is
typically used by a CA application to update the internal
structure of a database. This may for example involve automatic
removal of expired certificates. lock_store and unlock_store
are used for locking a store to allow exclusive writes.
|