Name
x509_verify,
x509_verify_array,
x509_cert_verify_array,
x509_ca_cert_add,
x509_ca_certs_remove,
xenc_x509_ca_certs_list,
X509_get_subject
—
verify X.509 certificates and manage the trusted-CA store
Synopsis
integer x509_verify(
|
in cert varchar); |
integer x509_verify_array(
|
in cert varchar, |
| |
in chain any); |
integer x509_cert_verify_array(
|
in cert varchar, |
| |
in chain any, |
| |
in options any); |
integer x509_ca_cert_add(
|
in ca_cert_pem varchar); |
integer x509_ca_certs_remove(
|
in subject_pattern varchar); |
any xenc_x509_ca_certs_list(
|
); |
varchar X509_get_subject(
|
in cert varchar); |
Description
x509_verify validates a single PEM-encoded
certificate against the server's trusted-CA store and returns 1 on success
or 0 on failure (e.g. expired, untrusted issuer, malformed). It is the
lighter-weight sibling of
x509_certificate_verify.
x509_verify_array and
x509_cert_verify_array verify the certificate against
an explicit intermediate-CA chain (a vector of
PEM-encoded certificates) instead of (or in addition to) the trusted
store. The _cert_ variant accepts an options vector
enabling features such as time-of-validation overrides and CRL checking.
x509_ca_cert_add imports a CA certificate (PEM) into
the server's trusted store. The trust is persistent across server
restarts. x509_ca_certs_remove removes one or more CA
certificates; pass a subject DN pattern to limit the removal, or omit the
argument to clear the entire store.
xenc_x509_ca_certs_list returns the current contents
of the store as a vector of subject DNs.
X509_get_subject returns the subject distinguished
name of cert as a single string in OpenSSL one-line
format. Useful for indexing or logging certificates without parsing them
fully.