1ssl_crl_cache_api(3)       Erlang Module Definition       ssl_crl_cache_api(3)
2
3
4

NAME

6       ssl_crl_cache_api - API for a SSL/TLS CRL (Certificate Revocation List)
7       cache.
8

DESCRIPTION

10       When SSL/TLS performs certificate path validation according to RFC 5280
11       it  should also perform CRL validation checks. To enable the CRL checks
12       the application needs access to CRLs. A database of CRLs can be set  up
13       in  many  different  ways. This module provides the behavior of the API
14       needed to integrate an arbitrary CRL cache with the erlang ssl applica‐
15       tion.  It  is  also  used by the application itself to provide a simple
16       default implementation of a CRL cache.
17

DATA TYPES

19       crl_cache_ref() = any()
20
21              Reference to the CRL cache.
22
23       dist_point() = #'DistributionPoint'{}
24
25              For description see  X509 certificates records
26
27       logger_info() =
28           {logger:level(),
29            Report :: #{description => string(), reason => term()},
30            logger:metadata()}
31
32              Information for ssl applications use of  Logger(3)
33

EXPORTS

35       fresh_crl(DistributionPoint, CRL) -> FreshCRL
36       fresh_crl(DistributionPoint, CRL) -> FreshCRL | {LoggerInfo, FreshCRL}
37
38              Types:
39
40                  DistributionPoint =  dist_point()
41                  CRL = [public_key:der_encoded()]
42                  FreshCRL = [public_key:der_encoded()]
43                  LoggerInfo = {logger,  logger_info() }}
44
45              fun fresh_crl/2  will be used as input option update_crl to pub‐
46              lic_key:pkix_crls_validate/3
47
48              It  is  possible  to return logger info that will be used by the
49              TLS connection to produce log events.
50
51       lookup(DistributionPoint, Issuer, DbHandle) -> not_available |  CRLs  |
52       {LoggerInfo, CRLs}
53       lookup(DistributionPoint, Issuer, DbHandle) -> not_available | CRLs
54       lookup(DistributionPoint, DbHandle) -> not_available | CRLs
55
56              Types:
57
58                  DistributionPoint =  dist_point()
59                  Issuer = public_key:issuer_name()
60                  DbHandle =  crl_cache_ref()
61                  CRLs = [public_key:der_encoded()]
62                  LoggerInfo = {logger,  logger_info() }}
63
64              Lookup  the  CRLs belonging to the distribution point  Distribu‐
65              tionpoint. This function may choose to only look in the cache or
66              to follow distribution point links depending on how the cache is
67              administrated.
68
69              The Issuer argument contains the issuer name of the  certificate
70              to  be  checked.  Normally  the returned CRL should be issued by
71              this issuer, except if the cRLIssuer field of  DistributionPoint
72              has a value, in which case that value should be used instead.
73
74              In  an earlier version of this API, the lookup function received
75              two arguments, omitting Issuer. For compatibility, this is still
76              supported: if there is no lookup/3 function in the callback mod‐
77              ule, lookup/2 is called instead.
78
79              It is possible to return logger info that will be  used  by  the
80              TLS connection to produce log events.
81
82       select(Issuer, DbHandle) -> CRLs | {LoggerInfo, CRLs}
83       select(Issuer, DbHandle) -> CRLs
84
85              Types:
86
87                  Issuer = public_key:issuer_name() | list()
88                  DbHandle =  cache_ref()
89                  LoggerInfo = {logger,  logger_info() }
90
91              Select  the  CRLs  in the cache that are issued by Issuer unless
92              the value is a list of so called general names, see   X509  cer‐
93              tificates  records, originating form #'DistributionPoint'.cRLis‐
94              suer and representing different mechanism to  obtain  the  CRLs.
95              The cache callback needs to use the appropriate entry to retrive
96              the CRLs or return an empty list if it does not exist.
97
98              It is possible to return logger info that will be  used  by  the
99              TLS connection to produce log events.
100
101
102
103Ericsson AB                        ssl 9.6.1              ssl_crl_cache_api(3)