1gnutls_certificate_set_rawpk_key_mem(g3n)utglnsutls_certificate_set_rawpk_key_mem(3)
2
6 gnutls_certificate_set_rawpk_key_mem - API function
7
9 #include <gnutls/gnutls.h>
10 int gnutls_certificate_set_rawpk_key_mem(gnutls_certificate_creden‐
12 tials_t cred, const gnutls_datum_t * spki, const gnutls_datum_t * pkey,
13 gnutls_x509_crt_fmt_t format, const char * pass, unsigned int key_us‐
14 age, const char ** names, unsigned int names_length, unsigned int
15 flags);
16
18 gnutls_certificate_credentials_t cred
19 is a gnutls_certificate_credentials_t type.
20 const gnutls_datum_t * spki
22 contains a raw public key in PKIX.SubjectPublicKeyInfo for‐
23 mat.
24 const gnutls_datum_t * pkey
26 contains a raw private key.
27 gnutls_x509_crt_fmt_t format
29 encoding of the keys. DER or PEM.
30 const char * pass
32 an optional password to unlock the private key pkey.
33 unsigned int key_usage
35 An ORed sequence of GNUTLS_KEY_* flags.
36 const char ** names
38 is an array of DNS names belonging to the public-key (NULL
39 if none).
40 unsigned int names_length
42 holds the length of the names list.
43 unsigned int flags
45 an ORed sequence of gnutls_pkcs_encrypt_flags_t. These ap‐
46 ply to the private key pkey.
47
49 This function sets a public/private keypair in the gnutls_certifi‐
50 cate_credentials_t type to be used for authentication and/or encryp‐
51 tion. spki and privkey should match otherwise set signatures cannot
52 be validated. In case of no match this function returns GNUTLS_E_CER‐
53 TIFICATE_KEY_MISMATCH. This function should be called once for the
54 client because there is currently no mechanism to determine which raw
55 public-key to select for the peer when there are multiple present. Mul‐
56 tiple raw public keys for the server can be distinghuished by setting
57 the names .
58 Note here that spki is a raw public-key as defined in RFC7250. It
60 means that there is no surrounding certificate that holds the public
61 key and that there is therefore no direct mechanism to prove the au‐
62 thenticity of this key. The keypair can be used during a TLS handshake
63 but its authenticity should be established via a different mechanism
64 (e.g. TOFU or known fingerprint).
65 The supported formats are basic unencrypted key, PKCS8, PKCS12, and the
67 openssl format and will be autodetected.
68 If the raw public-key and the private key are given in PEM encoding
70 then the strings that hold their values must be null terminated.
71 Key usage (as defined by X.509 extension (2.5.29.15)) can be explicitly
73 set because there is no certificate structure around the key to define
74 this value. See for more info gnutls_x509_crt_get_key_usage().
75 Note that, this function by default returns zero on success and a nega‐
77 tive value on error. Since 3.5.6, when the flag GNUTLS_CERTIFI‐
78 CATE_API_V2 is set using gnutls_certificate_set_flags() it returns an
79 index (greater or equal to zero). That index can be used in other func‐
80 tions to refer to the added key-pair.
81
83 On success, GNUTLS_E_SUCCESS (0) is returned, in case the key pair does
84 not match GNUTLS_E_CERTIFICATE_KEY_MISMATCH is returned, in other erro‐
85 neous cases a different negative error code is returned.
86
88 3.6.6
89
91 Report bugs to <bugs@gnutls.org>.
92 Home page: https://www.gnutls.org
93
96 Copyright © 2001-2023 Free Software Foundation, Inc., and others.
97 Copying and distribution of this file, with or without modification,
98 are permitted in any medium without royalty provided the copyright no‐
99 tice and this notice are preserved.
100
102 The full documentation for gnutls is maintained as a Texinfo manual.
103 If the /usr/share/doc/gnutls/ directory does not contain the HTML form
104 visit
105 https://www.gnutls.org/manual/
107gnutls 3.8g.n2utls_certificate_set_rawpk_key_mem(3)