1OSSL_CMP_EXEC_CERTREQ(3ossl) OpenSSL OSSL_CMP_EXEC_CERTREQ(3ossl)
2
6 OSSL_CMP_exec_certreq, OSSL_CMP_exec_IR_ses, OSSL_CMP_exec_CR_ses,
7 OSSL_CMP_exec_P10CR_ses, OSSL_CMP_exec_KUR_ses, OSSL_CMP_IR,
8 OSSL_CMP_CR, OSSL_CMP_P10CR, OSSL_CMP_KUR, OSSL_CMP_try_certreq,
9 OSSL_CMP_exec_RR_ses, OSSL_CMP_exec_GENM_ses - functions implementing
10 CMP client transactions
11
13 #include <openssl/cmp.h>
14 X509 *OSSL_CMP_exec_certreq(OSSL_CMP_CTX *ctx, int req_type,
16 const OSSL_CRMF_MSG *crm);
17 X509 *OSSL_CMP_exec_IR_ses(OSSL_CMP_CTX *ctx);
18 X509 *OSSL_CMP_exec_CR_ses(OSSL_CMP_CTX *ctx);
19 X509 *OSSL_CMP_exec_P10CR_ses(OSSL_CMP_CTX *ctx);
20 X509 *OSSL_CMP_exec_KUR_ses(OSSL_CMP_CTX *ctx);
21 #define OSSL_CMP_IR
22 #define OSSL_CMP_CR
23 #define OSSL_CMP_P10CR
24 #define OSSL_CMP_KUR
25 int OSSL_CMP_try_certreq(OSSL_CMP_CTX *ctx, int req_type,
26 const OSSL_CRMF_MSG *crm, int *checkAfter);
27 int OSSL_CMP_exec_RR_ses(OSSL_CMP_CTX *ctx);
28 STACK_OF(OSSL_CMP_ITAV) *OSSL_CMP_exec_GENM_ses(OSSL_CMP_CTX *ctx);
29
31 This is the OpenSSL API for doing CMP (Certificate Management Protocol)
32 client-server transactions, i.e., sequences of CMP requests and
33 responses.
34 All functions take a populated OSSL_CMP_CTX structure as their first
36 argument. Usually the server name, port, and path ("CMP alias") need
37 to be set, as well as credentials the client can use for authenticating
38 itself to the client. In order to authenticate the server the client
39 typically needs a trust store. The functions return their respective
40 main results directly, while there are also accessor functions for
41 retrieving various results and status information from the ctx. See
42 OSSL_CMP_CTX_new(3) etc. for details.
43 The default conveying protocol is HTTP. Timeout values may be given
45 per request-response pair and per transaction. See
46 OSSL_CMP_MSG_http_perform(3) for details.
47 OSSL_CMP_exec_IR_ses() requests an initial certificate from the given
49 PKI.
50 OSSL_CMP_exec_CR_ses() requests an additional certificate.
52 OSSL_CMP_exec_P10CR_ses() conveys a legacy PKCS#10 CSR requesting a
54 certificate.
55 OSSL_CMP_exec_KUR_ses() obtains an updated certificate.
57 These four types of certificate enrollment are implemented as macros
59 calling OSSL_CMP_exec_certreq().
60 OSSL_CMP_exec_certreq() performs a certificate request of the type
62 specified by the req_type parameter, which may be IR, CR, P10CR, or
63 KUR. For IR, CR, and KUR, the certificate template to be used in the
64 request may be supplied via the crm parameter pointing to a CRMF
65 structure. Typically crm is NULL, then the template ingredients are
66 taken from ctx and need to be filled in using
67 OSSL_CMP_CTX_set1_subjectName(3), OSSL_CMP_CTX_set0_newPkey(3),
68 OSSL_CMP_CTX_set1_oldCert(3), etc. For P10CR,
69 OSSL_CMP_CTX_set1_p10CSR(3) needs to be used instead. The enrollment
70 session may be blocked by sleeping until the addressed CA (or an
71 intermedate PKI component) can fully process and answer the request.
72 OSSL_CMP_try_certreq() is an alternative to the above functions that is
74 more flexible regarding what to do after receiving a checkAfter value.
75 When called for the first time (with no certificate request in progress
76 for the given ctx) it starts a new transaction by sending a certificate
77 request constructed as stated above using the req_type and optional crm
78 parameter. Otherwise (when according to ctx a 'waiting' status has
79 been received before) it continues polling for the pending request
80 unless the req_type argument is < 0, which aborts the request. If the
81 requested certificate is available the function returns 1 and the
82 caller can use OSSL_CMP_CTX_get0_newCert(3) to retrieve the new
83 certificate. If no error occurred but no certificate is available yet
84 then OSSL_CMP_try_certreq() remembers in the CMP context that it should
85 be retried and returns -1 after assigning the received checkAfter value
86 via the output pointer argument (unless it is NULL). The checkAfter
87 value indicates the number of seconds the caller should let pass before
88 trying again. The caller is free to sleep for the given number of
89 seconds or for some other time and/or to do anything else before
90 retrying by calling OSSL_CMP_try_certreq() again with the same
91 parameter values as before. OSSL_CMP_try_certreq() then polls to see
92 whether meanwhile the requested certificate is available. If the
93 caller decides to abort the pending certificate request and provides a
94 negative value as the req_type argument then OSSL_CMP_try_certreq()
95 aborts the CMP transaction by sending an error message to the server.
96 OSSL_CMP_exec_RR_ses() requests the revocation of the certificate
98 specified in the ctx using OSSL_CMP_CTX_set1_oldCert(3). RFC 4210 is
99 vague in which PKIStatus should be returned by the server. We take
100 "accepted" and "grantedWithMods" as clear success and handle
101 "revocationWarning" and "revocationNotification" just as warnings
102 because CAs typically return them as an indication that the certificate
103 was already revoked. "rejection" is a clear error. The values
104 "waiting" and "keyUpdateWarning" make no sense for revocation and thus
105 are treated as an error as well.
106 OSSL_CMP_exec_GENM_ses() sends a general message containing the
108 sequence of infoType and infoValue pairs (InfoTypeAndValue; short:
109 ITAV) provided in the ctx using OSSL_CMP_CTX_push0_genm_ITAV(3). It
110 returns the list of ITAVs received in the GenRep. This can be used,
111 for instance, to poll for CRLs or CA Key Updates. See RFC 4210 section
112 5.3.19 and appendix E.5 for details.
113
115 CMP is defined in RFC 4210 (and CRMF in RFC 4211).
116 So far the CMP client implementation is limited to one request per CMP
118 message (and consequently to at most one response component per CMP
119 message).
120
122 OSSL_CMP_exec_certreq(), OSSL_CMP_exec_IR_ses(),
123 OSSL_CMP_exec_CR_ses(), OSSL_CMP_exec_P10CR_ses(), and
124 OSSL_CMP_exec_KUR_ses() return a pointer to the newly obtained X509
125 certificate on success, NULL on error. This pointer will be freed
126 implicitly by OSSL_CMP_CTX_free() or CSSL_CMP_CTX_reinit().
127 OSSL_CMP_try_certreq() returns 1 if the requested certificate is
129 available via OSSL_CMP_CTX_get0_newCert(3) or on successfully aborting
130 a pending certificate request, 0 on error, and -1 in case a 'waiting'
131 status has been received and checkAfter value is available. In the
132 latter case OSSL_CMP_CTX_get0_newCert(3) yields NULL and the output
133 parameter checkAfter has been used to assign the received value unless
134 checkAfter is NULL.
135 OSSL_CMP_exec_RR_ses() returns 1 on success, 0 on error.
137 OSSL_CMP_exec_GENM_ses() returns a pointer to the received ITAV
139 sequence on success, NULL on error. This pointer must be freed by the
140 caller.
141
143 See OSSL_CMP_CTX for examples on how to prepare the context for these
144 functions.
145
147 OSSL_CMP_CTX_new(3), OSSL_CMP_CTX_free(3),
148 OSSL_CMP_CTX_set1_subjectName(3), OSSL_CMP_CTX_set0_newPkey(3),
149 OSSL_CMP_CTX_set1_p10CSR(3), OSSL_CMP_CTX_set1_oldCert(3),
150 OSSL_CMP_CTX_get0_newCert(3), OSSL_CMP_CTX_push0_genm_ITAV(3),
151 OSSL_CMP_MSG_http_perform(3)
152
154 The OpenSSL CMP support was added in OpenSSL 3.0.
155
157 Copyright 2007-2021 The OpenSSL Project Authors. All Rights Reserved.
158 Licensed under the Apache License 2.0 (the "License"). You may not use
160 this file except in compliance with the License. You can obtain a copy
161 in the file LICENSE in the source distribution or at
162 <https://www.openssl.org/source/license.html>.
1633.0.5 2022-11-01 OSSL_CMP_EXEC_CERTREQ(3ossl)